This original ITCertPath learning chapter supports concept review and scenario practice. Confirm final policies and exam details with PMI before your appointment.
Treat uncertainty before it becomes damage
A risk is an uncertain event or condition; an issue exists now. Risk management identifies threats and opportunities, analyzes exposure, assigns owners, plans responses and monitors triggers and residual risk.
A realized threat becomes an issue and should move into active resolution while any resulting secondary risks remain visible.
- Avoid, mitigate, transfer, accept or escalate threats.
- Exploit, enhance, share, accept or escalate opportunities.
- Contingency reserve addresses identified uncertainty within the cost baseline.
- Management reserve addresses unknown work within the project budget but outside the cost baseline.
Quality is designed into the process
Inspection can find defects, but prevention and process improvement reduce the cost of quality. Define measurable acceptance and quality criteria, perform appropriate assurance and control activities, and use root-cause analysis when patterns repeat.
Defects recur despite final testing. Analyze the process with the team, identify the systemic cause, introduce an earlier preventive control, and measure whether recurrence falls.
Compliance needs evidence
Identify applicable legal, regulatory, contractual, safety, security and sustainability requirements early. Engage qualified experts, build controls into the plan, retain evidence and escalate material noncompliance through governance.
- Never defer a mandatory control simply to protect the date.
- Confirm supplier compliance with evidence, not verbal assurance.
- Track regulatory changes as external business-environment risks.
- Communicate consequences and ownership clearly.
Deep-dive lessons
Complete risk-response thinking
A useful risk statement links cause, uncertain event and effect. Qualitative analysis prioritizes risks using probability, impact, urgency and other factors. Quantitative analysis may model combined exposure when the project warrants it.
A response needs an owner, actions, budget, timing and triggers. After response planning, residual risk remains; the response itself can create a secondary risk. Monitor all three and evaluate whether the response is actually reducing exposure.
Quality planning, assurance and control
Planning defines standards, measures, acceptance criteria and the activities needed to achieve them. Managing quality examines whether processes are suitable and being improved. Controlling quality inspects or tests results against requirements.
Prevention costs usually reduce internal and external failure costs. Root-cause tools include the five whys, fishbone diagrams and process analysis. Control charts help distinguish normal variation from signals requiring investigation.