AgilePM Foundation · Domain 9 of 10

AgilePM Foundation Domain 9: Risk management and the project approach

How AgilePM manages risk: integrating risk management into the lifecycle, understanding which risks agility reduces and which it creates, and using the Project Approach Questionnaire to test whether the conditions for agile success are in place.

Exam weight estimate
Not published
Official syllabus topics
3
Estimated questions estimate
~5
Suggested study time estimate
3–4 hrs

About 13 min read Reviewed October 2026

Overview

Risk management and the project approach covers how AgilePM handles uncertainty. Risk management is not a separate stage but part of the lifecycle: risks are first considered in Feasibility, assessed in more depth in Foundations, and then identified, owned and reviewed continually during development, with short timeboxes and frequent reviews giving natural points to surface them.

The area also explains how agility changes risk exposure. Incremental delivery, early feedback, integrated testing and fixed timeboxes reduce many classic project risks, such as building the wrong thing or discovering problems late. But an agile approach brings its own risks if its preconditions are missing, such as unavailable business people or a team that is not empowered. The Project Approach Questionnaire (PAQ) is AgilePM's tool for exposing those risks: key roles rate how far each condition for success is in place, and the gaps become risks to address.

How it's tested

Expect questions on the purpose and timing of the Project Approach Questionnaire, on which risks an agile approach reduces or introduces, and on where risk activities fit in the lifecycle. Distractors confuse the PAQ with a risk register or a prioritisation tool, or claim agile removes the need for risk management.

  • Purpose of the PAQ

    You identify what the Project Approach Questionnaire assesses, when it is used, who completes it, or what to do with a negative response.

  • Agility and risk exposure

    A practice is described and you choose the risk it reduces, or a missing condition is described and you choose the risk it creates.

  • Risk in the lifecycle

    You choose when or how risk is identified and reviewed during an AgilePM project.

Reasoning it through

A question says the PAQ shows strong disagreement with the statement that business people will be available to work with the team. One option says the project should switch to a traditional approach immediately. That overreacts. The PAQ highlights a risk to address: the right response is to raise and manage it, for example by securing business commitment, and escalate if it cannot be resolved.

Syllabus topics 3

Official syllabus topics from the APMG International outline, in outline order.

9.1 Risk in agile projects and how AgilePM integrates risk managementIdentifying, assessing, owning and reviewing risk throughout the lifecycle.
What it means
Risk management identifies uncertain events that could affect objectives, assesses their probability and impact, assigns owners, plans responses and monitors them. AgilePM builds this into the lifecycle: an initial view in Feasibility, a fuller assessment in Foundations, and continual review during development.
What to understand
Short timeboxes and frequent events such as Daily Scrums, Sprint Reviews and Retrospectives provide regular points to surface and review risks. Risks that exceed a level's authority are escalated through the usual roles and tolerances.
How it shows up
You choose when risks should be identified or reviewed, or what an agile team should do when a new risk appears mid-Sprint.
Common confusion
Thinking risk management happens once at the start, or that agile projects do not need formal risk management.
9.2 How agility in practice affects risk exposureRisks agility reduces and risks it introduces when preconditions are weak.
What it means
Agile practices reduce many risks: frequent delivery and feedback reduce the risk of building the wrong thing, integrated testing reduces late defects, timeboxing with MoSCoW reduces the risk of missing the deadline, and incremental deployment delivers value early. They also create risks if preconditions are missing, such as insufficient business involvement, lack of empowerment, or governance that insists on traditional controls.
What to understand
Agility is a way of managing risk, not an absence of risk. The same features that reduce risk, such as emergent detail and flexible scope, become risks when the business is unavailable or Must Haves are unclear.
How it shows up
A practice is described and you identify the risk it reduces, or a weakness is described and you identify the risk it creates for an agile project.
Common confusion
Assuming an agile approach is always lower risk regardless of the organisation's readiness.
9.3 Using the Project Approach Questionnaire to identify and address risksAssessing readiness for the AgilePM approach and turning gaps into managed risks.
What it means
The Project Approach Questionnaire (PAQ) is a set of statements about the project and its environment, such as business commitment, team empowerment, stability and acceptance of incremental delivery, that key roles rate for agreement. It is first used in Feasibility and revisited in Foundations and later as needed.
What to understand
Disagreement with a statement signals a risk to the approach, which is then addressed: by changing conditions, adjusting the approach or escalating. The PAQ is completed collaboratively so that differing views among roles are also exposed.
How it shows up
You choose the PAQ's purpose, when it is used, or the appropriate response to a negative answer.
Common confusion
Treating the PAQ as the project's risk register or as a pass-or-fail test that decides whether the project is agile.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Project Approach Questionnaire (PAQ)

    A questionnaire of statements about the project and its environment, rated for agreement by key roles, that shows how far the conditions for successful use of the AgilePM approach are in place.

    Remember
    Purpose: assess suitability and expose risks to the approach.
    Tested as
    The most specific named tool in this area.
    Trap
    Confusing it with a risk register or prioritisation technique.

  • PAQ timing

    The PAQ is first completed in Feasibility, revisited in Foundations, and can be revisited later, for example at increment boundaries, as conditions change.

    Remember
    Early and repeated, not once.
    Tested as
    When-is-it-used questions.
    Trap
    Placing it only at project closure or only in Development.

  • Acting on PAQ results

    Negative or divided responses identify risks that should be recorded, owned and addressed, for example by securing business commitment or adjusting the approach.

    Remember
    A negative answer is a risk to manage, not automatic cancellation.
    Tested as
    Response-to-result questions.
    Trap
    Abandoning the agile approach at the first negative answer.

  • Collaborative completion

    The PAQ is completed by key project roles together, so different perspectives and disagreements are visible.

    Remember
    Disagreement between roles is itself useful information.
    Tested as
    Who-completes-it questions.
    Trap
    Having the Project Manager complete it alone.

  • Instrumental success factors

    The conditions DSDM and AgilePM identify as needed for agile project success, such as business commitment, empowered teams, iterative development with integrated testing and acceptance of incremental delivery.

    Remember
    The PAQ checks how far these factors are present.
    Tested as
    Questions linking PAQ statements to success conditions.
    Trap
    Treating them as optional nice-to-haves.

  • Risk management steps

    Identify risks, assess probability and impact, assign an owner, plan and implement responses, and monitor and review continually.

    Remember
    Every risk needs an owner and regular review.
    Tested as
    General risk process questions.
    Trap
    Stopping after identification.

  • Risks agility reduces

    Building the wrong thing (via frequent feedback), late discovery of defects (via integrated testing), missing the deadline (via timeboxing and MoSCoW) and late value (via incremental deployment).

    Remember
    Agile is a risk-reduction strategy when conditions are right.
    Tested as
    Which-risk-does-this-reduce questions.
    Trap
    Thinking agile reduces cost overrun by having no budget limits.

  • Risks agility introduces

    Insufficient business availability, lack of empowerment, unclear Must Haves, unstable teams, or governance and contracts that expect fixed scope.

    Remember
    These are exactly what the PAQ is designed to expose.
    Tested as
    Readiness and environment questions.
    Trap
    Assuming the team alone can compensate for missing business involvement.

  • Risk review in Scrum events

    Daily Scrums, Sprint Reviews and Retrospectives give frequent, natural points to surface and review risks and impediments.

    Remember
    Short cycles mean risks are reviewed often.
    Tested as
    Lifecycle and integration questions.
    Trap
    Waiting for a formal monthly risk meeting.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Project Approach Questionnaire vs. risk register

ConceptMeaningKey differenceCommon trap
Project Approach Questionnaire Rated statements about the project's environment and readiness for AgilePM Diagnoses risks to the approach; used early and revisited Using it to track individual risks and owners
Risk register or log List of identified risks with assessment, owner and responses Tracks and manages each risk throughout Thinking it assesses suitability for agile

Risks agility reduces vs. risks it introduces

ConceptMeaningKey differenceCommon trap
Reduces Wrong product, late defects, missed deadlines, late value Results from feedback, integrated testing, timeboxing and increments Believing these benefits appear regardless of conditions
Introduces Business unavailability, weak empowerment, unclear priorities, rigid governance Results from missing preconditions Ignoring them because the team is skilled

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. PAQ as risk register

    What candidates pick
    Use the PAQ to record each risk, its owner and its response.
    Why it looks right
    Both are risk-related documents used early.
    Why it's wrong
    The PAQ assesses readiness for the AgilePM approach; individual risks it reveals are then managed through normal risk management.

    Clue to watch for A question about tracking specific risks and owners.

  2. Cancel on a negative answer

    What candidates pick
    Abandon the agile approach because one PAQ statement is rated negatively.
    Why it looks right
    It seems prudent to avoid an unsuitable approach.
    Why it's wrong
    Negative responses identify risks to address, for example by securing commitment or adjusting the approach, and to escalate if unresolved.

    Clue to watch for A single gap in an otherwise positive assessment.

  3. PAQ at the end

    What candidates pick
    Complete the PAQ at project closure to capture lessons.
    Why it looks right
    Questionnaires are often used for lessons learned.
    Why it's wrong
    It is first used in Feasibility and revisited in Foundations and later, so risks can be addressed while they still matter.

    Clue to watch for A timing question.

  4. Agile means less risk management

    What candidates pick
    Skip formal risk management because short Sprints reduce risk.
    Why it looks right
    Agile does reduce several risks.
    Why it's wrong
    AgilePM integrates risk management throughout; agility changes risk exposure but does not remove the need to manage it.

    Clue to watch for An option suggesting risk management is unnecessary.

  5. Team compensates for absent business

    What candidates pick
    Let skilled Developers make business decisions when business people are unavailable.
    Why it looks right
    It keeps work moving.
    Why it's wrong
    Lack of business involvement is a key risk to the approach; it should be raised and addressed, not hidden by the team guessing.

    Clue to watch for Business roles unavailable or uncommitted.

Answer framework

Use these steps for any question about risk or the suitability of the AgilePM approach.

  1. Decide whether the question concerns a specific project risk or the suitability of the approach itself; the second points to the Project Approach Questionnaire.
  2. Place the activity in the lifecycle: PAQ and initial risk view in Feasibility, fuller assessment in Foundations, continual review during development.
  3. For a practice, identify the risk it reduces, such as feedback against building the wrong thing or timeboxing against missing the date.
  4. For a missing condition, such as business unavailability or weak empowerment, treat it as a risk to the approach and plan how to address it.
  5. Prefer responses that make the risk visible, assign ownership and escalate beyond tolerance over responses that ignore it or abandon the project.

Practice question

During Feasibility, the Project Manager wants to check whether the organisation's conditions support an agile approach, such as business availability, team empowerment and acceptance of incremental delivery, and to expose any risks. Which AgilePM tool is designed for this?

Want more like this? The AgilePM Foundation practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with the Project Approach Questionnaire, because it is the area's distinctive named tool. Learn four facts about it: what it assesses, who completes it, when it is used and revisited, and what to do with negative responses. Then write five example statements of your own about business commitment, empowerment and incremental delivery to make its content concrete.

Next, build a two-column list: risks agility reduces and the practice responsible, and risks agility introduces and the missing condition behind each. This prepares you for questions that describe a practice or a weakness and ask about the risk.

The underestimated topic is integration. Candidates often picture risk management as a log created once. Trace risk activities through the lifecycle and through Scrum events so you can answer timing questions confidently.

Afterwards, revisit the project lifecycle framework to fix where Feasibility and Foundations sit, and study governance, compliance and AgilePM products, which uses risk information for decisions. Finish with a practice set mixing PAQ and risk exposure questions.

FAQ

What is the Project Approach Questionnaire?

A set of statements about the project and its environment that key roles rate for agreement, to show how far the conditions for using AgilePM successfully are in place and to expose risks to the approach.

When is the PAQ used?

It is first completed in Feasibility, revisited in Foundations, and can be revisited later in the project as conditions change.

What happens if the PAQ shows a negative response?

The gap is treated as a risk to address, for example by securing business commitment or adjusting the approach, and escalated if it cannot be resolved. It does not automatically end the project.

Is an agile project lower risk than a traditional one?

Agile practices reduce many risks, such as building the wrong thing or missing deadlines, but only when the preconditions are in place. Without them, an agile approach introduces its own risks.

Does AgilePM use a risk register?

Risks are identified, owned and reviewed throughout the project. The PAQ is a different tool: it assesses readiness for the approach rather than tracking individual risks.

Who completes the PAQ?

Key project roles together, so that their differing views on the project's environment are visible and can be discussed.

Other Project Management certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 9 knowledge

You have covered integrated risk management, how agility changes risk exposure and the Project Approach Questionnaire. Check that you can tell the PAQ's purpose apart from other risk tools under exam conditions.

Take the AgilePM Foundation practice test Check your AgilePM Foundation readiness

Keep going