Overview
Portfolio Risk Management has six tasks. You determine the acceptable level of risk for the portfolio from organizational and stakeholder risk tolerances, develop the portfolio risk management plan from governance risk guidelines, perform dependency analysis on interdependencies and intradependencies, develop and maintain a portfolio-level risk register, promote common understanding and ownership of portfolio risks, and recommend and obtain approval for a portfolio management reserve based on aggregate exposure.
The domain exists because portfolio risk is not the sum of project risk registers. Risks to strategic goals, concentrations of exposure, shared dependencies and correlated threats only become visible at portfolio level. It builds on the risk tolerances recorded in Governance, uses the interdependency map from Strategic Alignment, takes in escalated risks and trends from Portfolio Performance, and relies on Communications Management to build ownership.
How it's tested
Questions describe an organization's attitude to risk, a set of components with shared dependencies, or a risk that has grown beyond a component's ability to manage, and ask what the portfolio manager should do or which risk belongs at portfolio level. Expect BEST and NEXT wording and options that test the line between component and portfolio responsibility.
-
Whose risk is it
A risk is described in one component. You decide whether it stays with the component or is escalated because it threatens strategic goals, other components or exceeds component tolerance.
-
Hidden concentration
Several components rely on the same vendor, platform or team. The answer comes from dependency analysis that reveals correlated exposure invisible in individual registers.
-
Reserve logic
Aggregate exposure has changed. You recommend a reserve sized on that exposure and obtain governance approval, rather than adding contingency to each component.
Four components each rate their dependency on one cloud vendor as low risk. The vendor announces financial difficulty. Options include asking each component to update its register, raising contingency budgets, or analyzing the shared dependency at portfolio level. Because the same cause would hit all four at once, the exposure is correlated and belongs in the portfolio register, so dependency analysis and a portfolio-level response come first.
Tasks 6
Official tasks from the PMI outline, in outline order.
4.1 Determine acceptable level of risk for the portfolioSet portfolio risk tolerance from organizational and stakeholder views.
- What it means
- Based on organizational and stakeholder risk tolerances, you establish how much risk the portfolio may carry, often as limits on exposure to strategic goals, financial loss or concentration, to inform governance.
- What to understand
- Acceptable risk must be explicit and agreed, because it drives which risks are escalated, which components are funded and how large the reserve is. Different stakeholders hold different tolerances, which must be reconciled.
- How it shows up
- Executives disagree about how much high-risk innovation the portfolio should hold; the expected step is to establish an agreed portfolio risk level before balancing.
- Common confusion
- Treating one powerful stakeholder's tolerance as the organization's tolerance.
4.2 Develop the portfolio risk management planDefine how portfolio risk will be managed.
- What it means
- Using governance risk guidelines, processes, procedures and organizational assets, you document how portfolio risks will be identified, analyzed, escalated, responded to and monitored, so the organization can capitalize on opportunities and respond to threats.
- What to understand
- The plan connects component risk processes to portfolio level: escalation criteria, risk categories, reporting cadence and roles. It covers opportunities as well as threats.
- How it shows up
- Components escalate risks inconsistently; the fix is clear escalation criteria in the portfolio risk management plan.
- Common confusion
- Confusing the portfolio risk management plan with the portfolio risk register.
4.3 Perform dependency analysis to identify and monitor risks related to the interdependencies and intradependenciesFind risk that flows between and within portfolios.
- What it means
- You map dependencies within the portfolio and across portfolios, such as shared resources, vendors, platforms or deliverables, and identify and monitor the risks those links create.
- What to understand
- Dependencies create correlated risk: one cause can hit several components at once. Such exposure only appears when risks are viewed together, which is why it is a portfolio task.
- How it shows up
- Multiple components rely on one specialist vendor; dependency analysis reveals the concentrated exposure that individual registers rated as low.
- Common confusion
- Assuming that if every component rates a risk low, the portfolio exposure is also low.
4.4 Develop, monitor, and maintain portfolio-level risk registerTrack risks to strategy and escalated component risks.
- What it means
- You keep a register of risks to strategic goals and business value, plus risks escalated from components, with owners, analysis and responses, to support decision making.
- What to understand
- The portfolio register is selective: it is not a merged copy of every component register. Risks enter when they threaten portfolio objectives, cross components or exceed component tolerance.
- How it shows up
- A team proposes merging all project registers into one portfolio register; the better answer keeps only portfolio-level and escalated risks.
- Common confusion
- Believing a larger register means better risk management.
4.5 Promote common understanding and stakeholder ownership of portfolio risksMake risks understood and owned.
- What it means
- Through communication with stakeholders, you build shared understanding of portfolio risks and clear ownership so responses actually happen.
- What to understand
- Risk responses fail when nobody owns them or stakeholders interpret risk differently. Communication tailored to each audience and named owners are the levers.
- How it shows up
- A critical portfolio risk has no response because two business units each assume the other owns it; the answer is to establish ownership and shared understanding.
- Common confusion
- Assuming the portfolio manager personally owns every portfolio risk.
4.6 Provide recommendation and obtain approval for a portfolio management reserveSize and approve reserve on aggregate exposure.
- What it means
- Based on aggregate portfolio risk exposure, you recommend a portfolio management reserve, often a funding or capacity buffer, and obtain approval for it to protect strategic goals.
- What to understand
- The reserve is based on exposure across the portfolio, not on adding up every component's contingency. It is approved and released through governance.
- How it shows up
- Aggregate exposure rises after a new high-risk component is approved; the expected step is to reassess and recommend an adjusted reserve.
- Common confusion
- Treating the portfolio reserve as extra contingency that component managers can draw on freely.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Portfolio risk
An uncertain event or condition that, if it occurs, affects the portfolio's ability to achieve its strategic objectives, whether positively or negatively.
- Remember
- Portfolio risk includes opportunities and arises from strategy, structure and component interactions, not only from individual projects.
- Tested as
- Stems test whether a risk belongs at portfolio level or should stay with a component.
- Trap
- Assuming portfolio risk is just the total of component risks.
-
Risk tolerance
The degree or amount of risk an organization or stakeholder is prepared to withstand, used to set the acceptable level of portfolio risk.
- Remember
- Tolerances must be reconciled across stakeholders and recorded so they can drive escalation and balancing decisions.
- Tested as
- Appears when stakeholders disagree about acceptable exposure.
- Trap
- Adopting the most senior stakeholder's tolerance without reconciliation.
-
Interdependency and intradependency
Interdependencies link components to each other or to other portfolios; intradependencies are links within a component or portfolio. Both can propagate risk.
- Remember
- Shared dependencies create correlated risk that can hit several components at once.
- Tested as
- Core to task 4.3 and to scenario questions about common vendors or platforms.
- Trap
- Assessing each component's dependency in isolation.
-
Aggregate risk exposure
The combined effect of portfolio risks, accounting for correlation and concentration, rather than a simple sum of separate component estimates.
- Remember
- Correlated risks can make aggregate exposure much larger than individual ratings suggest; diversified risks can reduce it.
- Tested as
- Drives reserve sizing and balancing decisions.
- Trap
- Adding component expected values as if risks were independent.
-
Portfolio management reserve
Funding or capacity held at portfolio level, based on aggregate exposure, to respond to portfolio risks and protect strategic goals; recommended by the portfolio manager and approved through governance.
- Remember
- It is controlled at portfolio level and released through governance, not drawn on freely by components.
- Tested as
- Task 4.6 stems ask how to size or approve it after exposure changes.
- Trap
- Confusing it with a project's contingency reserve, which covers identified risks within that project.
-
Portfolio risk register
The record of risks to strategic goals and business value plus risks escalated from components, with owners, analysis and responses.
- Remember
- It is selective; component risks stay in component registers unless they meet escalation criteria.
- Tested as
- Tested when teams propose merging all registers.
- Trap
- Building one giant register that hides strategic risks among project detail.
-
Risk escalation criteria
Rules in the portfolio risk management plan that define when a component risk moves to portfolio level, for example when it affects other components, strategic goals or exceeds a threshold.
- Remember
- Clear criteria stop both under-escalation and flooding the portfolio with project detail.
- Tested as
- Root cause of inconsistent escalation stems.
- Trap
- Escalating every high-rated project risk regardless of whether it affects the portfolio.
-
Risk concentration
Exposure clustered in one vendor, technology, market, region or type of work, so one event can hurt many components.
- Remember
- Concentration is reduced by rebalancing or diversifying, not only by component-level mitigation.
- Tested as
- Appears in balancing stems where the mix is skewed.
- Trap
- Mitigating each component separately while the shared cause remains.
-
Opportunity management
Identifying and acting on uncertain events that could increase strategic value, listed in the ECO knowledge and skills.
- Remember
- The portfolio risk management plan aims to capitalize on opportunities as well as respond to threats.
- Tested as
- Stems describe a favorable market or technology change and ask how to respond.
- Trap
- Treating risk management as threat avoidance only.
-
Risk ownership
Assigning each portfolio risk to a named person or body accountable for monitoring it and ensuring responses are carried out.
- Remember
- Shared understanding plus a named owner is what turns analysis into action.
- Tested as
- Task 4.5 stems where nobody acts on a known risk.
- Trap
- Assuming the portfolio manager owns every risk because they maintain the register.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Portfolio management reserve vs. contingency reserve
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Portfolio management reserve | Portfolio-level buffer based on aggregate exposure | Held and released through portfolio governance | Letting components draw on it as routine contingency |
| Contingency reserve | Component-level budget for identified risks in that component | Managed within the component's own authority | Summing these and calling the total a portfolio reserve |
Portfolio risk register vs. component risk register
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Portfolio risk register | Risks to strategic goals and escalated component risks | Selective, cross-component and strategic | Copying in every project risk |
| Component risk register | Risks to a single project or program's objectives | Detailed and owned by the component manager | Keeping cross-component risks here where nobody sees the pattern |
Risk tolerance vs. risk threshold
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Risk tolerance | How much risk the organization or stakeholder can withstand | Sets the acceptable level of portfolio risk | Assuming one stakeholder's view is the organization's |
| Risk threshold | Measurable point that triggers escalation or response | Numeric trigger derived from tolerance | Acting on a vague tolerance without a measurable trigger |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
One giant register
- What candidates pick
- Consolidate all component risk registers into the portfolio register.
- Why it looks right
- It seems complete and gives the portfolio manager full visibility.
- Why it's wrong
- Task 4.4 targets risks to strategic goals and escalated risks; burying them among project detail makes portfolio-level exposure harder to see.
Clue to watch for Options include defining escalation criteria or keeping a selective register.
-
Low everywhere means low overall
- What candidates pick
- Accept the portfolio exposure because each component rated the risk low.
- Why it looks right
- The component ratings come from the people closest to the work.
- Why it's wrong
- A shared cause can hit many components at once, so correlated exposure can be high even when each rating is low.
Clue to watch for Several components depend on the same vendor, platform, team or market.
-
More contingency per component
- What candidates pick
- Increase each component's contingency reserve after aggregate exposure rises.
- Why it looks right
- It funds risk where the work happens.
- Why it's wrong
- Task 4.6 expects a portfolio management reserve sized on aggregate exposure and approved through governance, which avoids double counting and keeps control at portfolio level.
Clue to watch for The stem describes exposure across the portfolio or a newly approved high-risk component.
-
Portfolio manager owns all risks
- What candidates pick
- Take personal ownership of an unowned cross-component risk.
- Why it looks right
- It closes the gap quickly and shows initiative.
- Why it's wrong
- Ownership should sit with the person or body able to act on the risk; task 4.5 focuses on building shared understanding and stakeholder ownership.
Clue to watch for Two business units each assume the other is responsible.
-
Threats only
- What candidates pick
- Log a favorable market change as information rather than a risk.
- Why it looks right
- Risk is commonly associated with negative events.
- Why it's wrong
- Portfolio risk management covers opportunities, and the plan should capitalize on them, for example by accelerating or adding components.
Clue to watch for The stem describes an uncertain event that could increase strategic value.
-
Senior voice sets tolerance
- What candidates pick
- Use the CEO's stated comfort with risk as the portfolio tolerance.
- Why it looks right
- The CEO has the most authority.
- Why it's wrong
- Task 4.1 bases the acceptable level on organizational and stakeholder tolerances that must be reconciled and agreed through governance.
Clue to watch for Board members, business units or regulators express different tolerances.
Answer framework
When a Portfolio Risk Management scenario asks what to do, decide whether the risk is truly portfolio-level and then follow the governed path.
- Confirm the agreed portfolio risk level and the escalation criteria in the portfolio risk management plan, and reconcile them if stakeholders disagree.
- Test whether the risk threatens strategic goals, spans components through a dependency, or exceeds a component's tolerance; if not, leave it with the component.
- Analyze dependencies and concentration to estimate aggregate exposure, including correlated threats and any opportunities.
- Record the risk in the portfolio register with a named owner, and build shared understanding with the affected stakeholders.
- Recommend responses and an adjusted portfolio management reserve based on aggregate exposure, and obtain governance approval before committing any reserve funds or capacity.
Practice question
Want more like this? The PfMP practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Study the six tasks in ECO order. Tasks 4.1 and 4.2 set the rules, 4.3 and 4.4 find and track the risks, 4.5 makes them owned, and 4.6 funds the response. Knowing what must exist before each step answers most sequencing questions.
Give the most time to dependency analysis and aggregate exposure. Practice with a simple map of five components sharing two vendors and one platform, then ask which single event would hurt the most components and how that changes the reserve. This builds the instinct that correlated risk is the portfolio manager's concern.
Candidates commonly underestimate the line between portfolio and component risk. For each practice stem, ask whether the risk threatens strategy, crosses components or exceeds component tolerance. If none applies, the right answer usually leaves it with the component manager.
Also review the difference between a portfolio management reserve and a contingency reserve, because distractors exploit it. Afterwards, return to Portfolio Performance and connect risk concentration to rebalancing, and to Communications Management for how ownership is built through targeted communication.
FAQ
How much of the PfMP exam is Portfolio Risk Management?
PMI weights this domain at 15% of the exam, across six tasks. PMI does not publish a fixed number of questions per domain.
What belongs in the portfolio risk register?
Risks to strategic goals and business value, plus risks escalated from components because they cross components or exceed component tolerance. Routine component risks stay in component registers.
What is the difference between a portfolio management reserve and a contingency reserve?
A contingency reserve covers identified risks within one component under its own authority. The portfolio management reserve is based on aggregate portfolio exposure and is approved and released through governance.
Why does dependency analysis matter so much?
Shared vendors, platforms or teams mean one event can hit several components at once. That correlated exposure is invisible in individual registers and only shows up at portfolio level.
What question style does this domain use?
Situational stems about tolerance, shared dependencies, escalated risks or reserves, asking for the next or best action. Many test whether a risk belongs at portfolio or component level.
How long should I study this domain?
Our planning estimate is about 15 to 20 hours, based on its 15% weight and a 120-hour overall plan. Add time if you have only managed risk within single projects.
How does this domain connect to the others?
Governance sets the risk tolerances and approves the reserve, Strategic Alignment maps the interdependencies, Portfolio Performance supplies trends and escalations, and Communications Management helps build ownership.
Other Project Management certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- PRINCE2 7 Practitioner Study guide
- PMI Risk Management Professional Study guide
- PMI Scheduling Professional Study guide
- Project Management Professional Study guide
- CompTIA Project+ Study guide
- PRINCE2 7 Foundation Study guide
- Program Management Professional Study guide
- Certified Associate in Project Management Study guide
- Agile Project Management Study guide
- PMI Agile Certified Practitioner Study guide
- Project Management Professional (PMBOK 7) Study guide
- Disciplined Agile Scrum Master Study guide
Test your Domain 4 knowledge
You have worked through portfolio risk tolerance, dependency analysis, the portfolio risk register and reserve sizing. Check whether you can spot correlated exposure and route it through governance.