How to Master One of the Hardest Parts of the PMI-RMP Exam: Risk Analysis

Ask PMI Risk Management Professional (PMI-RMP)® candidates which domain worries them most, and Risk Analysis comes up again and again. Part of the reason is math: expected monetary value (EMV) and decision tree questions punish small arithmetic slips. But the bigger challenge is judgment. You have to know which analysis a situation calls for, read outputs like tornado diagrams and S-curves correctly, and resist answers that sound rigorous but don’t fit the question.

In this guide, we’ll break down what Risk Analysis covers on the current exam, explain the core concepts with real substance, walk through two sample scenarios, and give you a focused plan to turn this domain into a strength.

What Does Risk Analysis Cover on the PMI-RMP Exam?

Under the PMI-RMP Examination Content Outline (effective January 2023), Risk Analysis is Domain III and accounts for 23% of the exam, or about 23 of the 100 scored questions. That ties it with Risk Identification as the largest domain. It has three tasks:

Perform qualitative analysis: Classify risks in the risk breakdown structure (RBS) using the categories in the risk management plan, estimate impact on schedule, budget, resources, and scope, prioritize by impact and urgency, and apply risk matrices.
Perform quantitative analysis: Analyze risk data against established metrics, perform forecast and trend analysis, and perform sensitivity analysis using techniques such as Monte Carlo simulation, decision trees, critical path analysis, and EMV.
Identify threats and opportunities: Assess project risk complexity with tools like SWOT analysis, Ishikawa (fishbone) diagrams, and tree diagrams, and perform impact analysis on project objectives.

Qualitative Risk Analysis: Prioritizing Individual Risks

Qualitative analysis is fast, relatively inexpensive, and applies to nearly every identified risk. Its purpose is to decide which risks deserve attention first.

Probability and Impact

Each risk is rated for probability (how likely it is to occur) and impact (how much it would affect objectives if it did). The rating scales, including what “high impact” means in days or dollars, come from the risk management plan. That’s a key connection to Domain I: if the scales weren’t defined during planning, ratings become inconsistent from person to person.

The Probability and Impact Matrix

A probability and impact matrix combines the two ratings to assign a priority, often shown in red, amber, and green zones. A well-designed matrix is often mirrored, with threats on one side and opportunities on the other, so high-priority opportunities get as much attention as high-priority threats.

Other Prioritization Factors

Probability and impact aren’t the only factors. PMI’s risk standard and the PMBOK® Guide describe additional risk parameters you should recognize:

Urgency: How soon a response must be implemented to be effective.
Proximity: How soon the risk could affect the project if it occurs.
Manageability and controllability: How easily the risk owner can influence the risk or its outcome.
Detectability: How easily warning signs can be noticed.
Connectivity: How closely a risk is linked to other risks.

Risk Data Quality

A rating is only as good as the information behind it. If stakeholders are guessing, the right move is often to assess data quality and gather better information before acting on the prioritization.

Quantitative Risk Analysis: Measuring Overall Exposure

Quantitative analysis estimates the combined effect of risks on project outcomes such as total cost and finish date. It takes more time, data, and software, so it’s usually reserved for large or complex projects, or for the highest-priority risks that qualitative analysis flags.

Expected Monetary Value (EMV)

EMV is probability multiplied by impact. By convention, threats carry negative values and opportunities carry positive values. A threat with a 20% chance of causing a $50,000 overrun has an EMV of -$10,000. An opportunity with a 40% chance of saving $15,000 has an EMV of +$6,000. Summing EMVs across risks gives a rough basis for sizing contingency reserves.

Decision Tree Analysis

A decision tree maps a choice among alternatives, then the chance events that follow each one. You “roll back” the tree by calculating the EMV at each chance node and adding it to the cost or value of that path. The best option has the lowest expected cost or highest expected value.

Monte Carlo Simulation

A Monte Carlo simulation runs a cost or schedule model thousands of times, randomly sampling from each uncertain input’s range (for example, a three-point estimate). The output is a probability distribution, often shown as an S-curve, that tells you how likely you are to meet a given target. If the P80 cost is $1.2 million, there’s an 80% chance the project will finish at or below that amount.

Sensitivity Analysis and Tornado Diagrams

Sensitivity analysis shows which uncertainties most influence the outcome. A tornado diagram displays them as horizontal bars sorted from largest to smallest, giving the chart its funnel shape. The bars at the top are where response planning will do the most good.

Critical Path and Schedule Risk

Schedule risk analysis combines critical path logic with Monte Carlo simulation. A key insight: the most likely critical path may change across iterations, so an activity with float can still drive schedule risk. That’s why criticality analysis, the percentage of iterations in which an activity lands on the critical path, matters.

What Are the Most Common Risk Analysis Traps?

Getting the EMV sign wrong. Treating an opportunity as a cost, or adding a threat’s EMV as a positive number, flips your answer.
Jumping to quantitative analysis. If a question asks what to do with newly identified risks, qualitative prioritization almost always comes first.
Ignoring urgency. Two risks with the same probability-impact score aren’t equal if one needs a response next week.
Misreading an S-curve. The P50 is the median outcome, not a “safe” estimate. A higher confidence level requires a larger reserve.
Forgetting opportunities. The outline repeatedly pairs threats with opportunities. Answer choices that only address downside risk are often incomplete.
Using analysis outputs without the thresholds. Whether a risk exposure is acceptable depends on the thresholds agreed in planning, not your personal comfort level.

How Do You Reason Through Sample Risk Analysis Questions?

Scenario 1: Choosing Between Two Options

Consider a question where a project team must choose how to deliver a component. Building in-house costs $200,000, with a 30% chance of an $80,000 overrun. Buying from a vendor costs $230,000 at a fixed price, with a 10% chance of a $20,000 delay penalty passed on to the project. Which option should the risk manager recommend based on expected cost?

Roll back each branch. In-house: $200,000 + (0.30 x $80,000) = $224,000. Vendor: $230,000 + (0.10 x $20,000) = $232,000. The in-house option has the lower expected cost by $8,000. A strong candidate also notices what the numbers leave out: if the organization’s risk threshold can’t tolerate a possible $280,000 outcome, the vendor option might still be preferred. The best answer depends on what the question asks, so read the stem carefully.

Scenario 2: Interpreting Simulation Results

Now consider a question where a Monte Carlo analysis shows a 40% probability of finishing by the sponsor’s target date, and the tornado diagram shows that one supplier’s delivery duration dominates schedule uncertainty. The sponsor asks what should happen next.

Rerunning the simulation with more iterations won’t change the underlying exposure, and simply telling the sponsor the date is unrealistic and doesn’t solve anything. The best answer typically focuses response planning on the supplier risk identified at the top of the tornado, then reanalyzes to see how much the probability improves. That links Domain III directly to Domain IV.

How Does Risk Analysis Connect to the Other Domains?

Risk Strategy and Planning: Probability and impact scales, risk categories, and thresholds are all defined in the risk management plan. Analysis applies them.
Risk Identification: Poorly written risk statements that mix causes and effects can’t be analyzed reliably. Clear cause-risk-effect statements make analysis possible.
Risk Response: Priorities and sensitivity results tell you where to spend response effort, and EMV helps compare the cost of a response with the exposure it reduces.
Monitor and Close Risks: Reanalysis during monitoring shows whether responses worked and whether overall risk levels and reserves remain appropriate.

A Focused Study Plan for Risk Analysis

Learn the vocabulary. Be able to define urgency, proximity, EMV, P50 and P80, sensitivity analysis, and criticality without notes.
Drill the math. Work 15 to 20 EMV and decision tree problems until you can set them up in under a minute, and always double-check your signs.
Practice reading outputs. Sketch an S-curve and a tornado diagram from memory and explain what each tells a sponsor.
Use targeted practice. In Pocket Prep, use Build Your Own Quiz to isolate Risk Analysis, then review every explanation, including for questions you got right. Revisit errors with the Missed Questions quiz a few days later.
Mix it back in. Once your scores stabilize, return to mixed Timed Quiz sessions so you can recognize analysis questions when they appear alongside the other domains.

Start Preparing for the PMI-RMP Exam With Pocket Prep

Risk Analysis becomes much less intimidating once you’ve worked through enough realistic questions. Pocket Prep’s PMI-RMP practice questions include 500 exam-style questions covering every domain, each with a detailed explanation that walks you through the reasoning. Pair Build Your Own Quiz with Level Up to build from fundamentals to exam-level difficulty, and you’ll be ready for even the toughest calculation questions.