PMI-RMP · Domain 3 of 5

PMI-RMP Domain 3: Risk Analysis

Risk Analysis turns a list of risks into priorities and numbers: qualitative scoring with agreed scales, quantitative modeling of overall project risk with EMV, decision trees and simulation, and judging how threats and opportunities affect objectives.

Exam weight
23%
Official tasks
3
Estimated questions estimate
~26
Suggested study time estimate
25–30 hrs

About 15 min read Reviewed October 2026

Overview

Risk Analysis is 23% of the PMI-RMP exam, tied for the largest domain, with three tasks. Qualitative analysis classifies risks by RBS category and ranks them by probability, impact and urgency using the probability and impact matrix defined in the plan. Quantitative analysis models the combined effect of risks on objectives through expected monetary value (EMV), decision trees, Monte Carlo simulation and sensitivity analysis, and it forecasts and trends overall project risk. The third task assesses complexity and the effect of threats and opportunities on scope, schedule, cost, resources, quality, stakeholders and compliance.

The domain sits between Risk Identification, which supplies the register, and Risk Response, which acts on the priorities produced here. It is also the most calculation-oriented domain in the outline, which names EMV, decision trees and Monte Carlo, so arithmetic accuracy and knowing which technique answers which question both matter.

How it's tested

Expect a mix of calculation items (EMV, decision tree branches, probability arithmetic) and judgment items about which analysis to run and how to read its output. Read whether the question concerns one risk's priority or the project's overall exposure, and whether probabilities, impacts or confidence levels are being asked for.

  • Calculate and decide

    Probabilities and impacts are given; you compute EMV for risks or decision branches and choose the option or reserve.

  • Which technique

    A question needs a schedule confidence level, a ranking or the most influential risk, and you pick Monte Carlo, the probability and impact matrix or sensitivity analysis.

  • Read the output

    A tornado diagram, S-curve or heat map is described and you interpret what it shows and what to do next.

Reasoning it through

A sponsor asks how likely the project is to finish by a committed date given all known schedule risks. The options include ranking risks on the matrix, calculating EMV for the largest risk, or running Monte Carlo simulation. Only simulation combines all risks and duration uncertainty into a probability distribution, so it can state the confidence of meeting a date.

Tasks 3

Official tasks from the PMI outline, in outline order.

3.1 Perform qualitative analysisRank risks by probability, impact and urgency on agreed scales.
What it means
Each risk is classified in the RBS, its probability and impact are rated using the plan's definitions, and the probability and impact matrix converts those ratings into a priority. Urgency and other factors such as manageability can refine the ranking, and stakeholders are coached to categorize consistently.
What to understand
Qualitative scores are ordinal: they rank risks, they do not measure money or days. Their value depends on shared definitions and data quality, so a risk with poor underlying data should have its data improved before its score drives decisions.
How it shows up
Two risks share a score but differ in proximity or data quality, and the question asks which to address first or what to do before relying on the score.
Common confusion
Multiplying ordinal ratings and treating the result as a precise measure of exposure in currency.
3.2 Perform quantitative analysisModel combined effect on objectives with EMV, trees and simulation.
What it means
Quantitative analysis numerically estimates the effect of risks on project objectives, typically for high-priority risks or for overall project risk. Techniques include EMV, decision tree analysis, Monte Carlo simulation, sensitivity analysis with tornado diagrams, and trend forecasting of risk data.
What to understand
EMV equals probability times impact, with threats negative and opportunities positive. Monte Carlo produces a distribution and confidence levels such as P80 for cost or finish date. Sensitivity analysis shows which risks drive the most variation in the outcome.
How it shows up
Expect EMV and decision tree calculations, and questions asking which technique gives a confidence level for meeting a date or budget.
Common confusion
Using EMV of one risk to answer a question about the whole project's probability of meeting a target, which needs simulation.
3.3 Identify threats and opportunitiesAssess complexity and the effect of risks on all objectives.
What it means
This task assesses risk complexity with tools such as SWOT, Ishikawa (fishbone) diagrams and tree diagrams, analyzes the impact on scope, schedule, cost, resources, quality and stakeholders, and checks compliance against organizational strategy and corporate, project and regulatory governance.
What to understand
Analysis looks for interconnections: one root cause can drive several risks, and one risk can affect several objectives. Opportunities are analyzed with the same rigor as threats, and stakeholders are empowered to find them independently.
How it shows up
A stem shows several risks traced to one root cause, or a regulatory change affecting several objectives, and asks for the best analysis or next step.
Common confusion
Analyzing each risk in isolation and missing a shared root cause that a single response could address.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Expected monetary value (EMV)

    The probability of a risk multiplied by its monetary impact, with threats entered as negative values and opportunities as positive values.

    Remember
    Sum EMVs across risks with their signs; a 40% chance of a $50,000 threat (-$20,000) and a 25% chance of a $20,000 opportunity (+$5,000) net to -$15,000.
    Tested as
    The most common calculation in the domain, used for contingency sizing and comparing options.
    Trap
    Adding opportunity values to threat values as if both were costs, which overstates the reserve.

  • Decision tree analysis

    A diagram of decision branches and chance nodes where each path's EMV is calculated and the branch with the best expected value is selected.

    Remember
    Include the up-front investment for each branch and roll back EMVs from the right; choose the lowest expected cost or highest expected value.
    Tested as
    Build-or-buy and test-or-skip choices with probabilities given in the stem.
    Trap
    Comparing only the risk outcomes and forgetting the fixed cost of each option.

  • Monte Carlo simulation

    A technique that runs a cost or schedule model thousands of times, sampling each uncertain input from its range, to produce a distribution of possible outcomes.

    Remember
    Output is an S-curve or histogram giving confidence levels, such as an 80% chance of finishing by a given date.
    Tested as
    The answer when a stem asks how likely the project is to meet a date or budget overall.
    Trap
    Thinking it ranks individual risks; it models overall project risk.

  • Sensitivity analysis and tornado diagram

    Analysis that shows how much each uncertain input or risk drives variation in an outcome, displayed as horizontal bars ordered from largest to smallest effect.

    Remember
    The top bar is the risk or input with the greatest influence on the result; it is where response effort pays most.
    Tested as
    Stems describe a tornado diagram and ask which risk to focus on.
    Trap
    Reading bar order as probability of occurrence rather than strength of influence on the outcome.

  • Probability and impact matrix

    A grid that combines probability and impact ratings into priority zones, such as high, medium and low, according to rules defined in the risk management plan.

    Remember
    Separate matrices are often used for threats and opportunities, and the zone rules come from the plan.
    Tested as
    Qualitative ranking questions and heat-map interpretation.
    Trap
    Using different personal scales across assessors, which makes the matrix meaningless.

  • Risk data quality assessment

    Evaluating how accurate, reliable and complete the data behind a risk's ratings is before trusting its score.

    Remember
    Low-quality data means the score should be treated with caution and more information gathered.
    Tested as
    A stem notes a high score based on one person's guess and asks what to do next.
    Trap
    Acting immediately on a high score whose data nobody has checked.

  • Overall project risk

    The effect of uncertainty on the project as a whole, arising from all sources including individual risks and variability, as distinct from any single risk.

    Remember
    It is assessed through quantitative modeling and reported as exposure or confidence, not as one register score.
    Tested as
    Questions ask which output shows the project's total exposure for sponsor decisions.
    Trap
    Adding up qualitative scores to describe overall project risk.

  • Ordinal vs. cardinal scales

    Ordinal scales rank items (low, medium, high or 1 to 5) without equal intervals; cardinal scales use real numeric values such as dollars or days.

    Remember
    Qualitative analysis is ordinal ranking; quantitative analysis needs cardinal values.
    Tested as
    Used in stems that try to treat a qualitative score as a cost estimate.
    Trap
    Concluding a risk scored 20 is exactly twice as severe as one scored 10.

  • Risk urgency and proximity

    How soon a risk could occur and how soon a response must start to be effective.

    Remember
    Urgency can raise a medium-scored risk above a high-scored risk that is far in the future.
    Tested as
    Tie-breaker questions where two risks share a matrix position.
    Trap
    Ranking only on probability and impact.

  • Ishikawa (fishbone) diagram

    A cause-and-effect diagram that groups possible causes of an effect into categories so shared root causes become visible.

    Remember
    It analyzes causes; it does not score probability or impact.
    Tested as
    Appears when several risks may share an underlying cause.
    Trap
    Choosing it when the question asks for a numerical estimate of exposure.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Qualitative vs. quantitative risk analysis

ConceptMeaningKey differenceCommon trap
Qualitative analysis Ranking risks by rated probability, impact and urgency Ordinal scales; applied to all identified risks; fast Reading scores as money or days
Quantitative analysis Numerical modeling of the effect of risks on objectives Cardinal values; usually selected risks or overall project risk Running it on every risk regardless of value

EMV vs. decision tree vs. Monte Carlo vs. sensitivity analysis

ConceptMeaningKey differenceCommon trap
EMV Probability times impact for a risk or outcome Single expected value; signed for threats and opportunities Ignoring the sign of opportunities
Decision tree EMV applied across alternative decision branches Chooses between options, including their fixed costs Forgetting the investment on each branch
Monte Carlo simulation Repeated sampling of a model to build an outcome distribution Gives confidence levels for dates or budgets Using it to rank individual risks
Sensitivity analysis Measures which inputs drive outcome variation most Ranks influence, usually shown as a tornado diagram Reading the top bar as most probable

Individual risk priority vs. overall project risk

ConceptMeaningKey differenceCommon trap
Individual risk priority Where one risk ranks among others From the matrix and urgency; drives which risks get responses Summing priorities to describe the whole project
Overall project risk Combined effect of all uncertainty on the project From quantitative modeling; drives reserves and go or no-go decisions Inferring it from the top-ranked risk alone

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Opportunity added as a cost

    What candidates pick
    Add the EMV of an opportunity to the threat EMVs when sizing the contingency reserve.
    Why it looks right
    All values in the table look like amounts to be summed.
    Why it's wrong
    Opportunities carry a positive sign and offset threats; adding them as costs inflates the reserve.

    Clue to watch for A table mixes threats and opportunities and asks for a net value or reserve.

  2. Matrix for a confidence question

    What candidates pick
    Use the probability and impact matrix to tell the sponsor how likely an on-time finish is.
    Why it looks right
    The matrix is the familiar risk tool and already contains schedule risks.
    Why it's wrong
    The matrix ranks individual risks; only quantitative modeling such as Monte Carlo combines all uncertainty into a probability of meeting a date.

    Clue to watch for The stem asks for a percentage likelihood or confidence for the overall project.

  3. Decision tree without fixed costs

    What candidates pick
    Pick the branch with the lower risk EMV.
    Why it looks right
    Risk outcomes are the most visible numbers on the tree.
    Why it's wrong
    Each branch's expected value includes its up-front cost; a cheaper option with higher risk can still have the lower expected total cost.

    Clue to watch for Branches list an initial cost plus probabilistic outcomes.

  4. Trusting a poorly sourced score

    What candidates pick
    Plan a response immediately for the highest-scored risk.
    Why it looks right
    High priority implies urgency.
    Why it's wrong
    If the rating rests on unreliable data, the next step is a data quality assessment or gathering more information before committing resources.

    Clue to watch for The stem says the rating came from one estimate, with no historical data or expert input.

  5. Tornado read as probability

    What candidates pick
    Say the top bar is the most likely risk to occur.
    Why it looks right
    Ranked charts are often read as likelihood rankings.
    Why it's wrong
    The tornado diagram ranks influence on the outcome's variability, not probability of occurrence.

    Clue to watch for The question asks which risk most affects total cost or duration.

  6. Ignoring urgency

    What candidates pick
    Address the higher-scored risk first, even though it is months away.
    Why it looks right
    The matrix appears to settle priority.
    Why it's wrong
    Urgency and proximity refine priority; a lower-scored risk that could occur next week may need action first.

    Clue to watch for Two risks with similar or adjacent scores and very different timing.

Answer framework

When an analysis question appears, use these steps to decide which method applies and what the answer must contain.

  1. Decide whether the question concerns ranking individual risks or estimating the project's overall exposure or confidence of meeting a target.
  2. For ranking, apply the plan's probability and impact definitions and matrix, then refine with urgency and a check of data quality.
  3. For money or option choices, calculate EMV with threats negative and opportunities positive, including each branch's fixed cost in decision trees.
  4. For confidence in a date or budget across all risks, use Monte Carlo simulation, and use sensitivity analysis to find the biggest drivers.
  5. Look across results for shared root causes and effects on every objective before passing priorities to response planning.

Practice question

A risk manager is sizing a contingency reserve from two risks. Risk A is a threat with a 40% probability and a $50,000 impact. Risk B is an opportunity with a 25% probability and a $20,000 benefit. What contingency reserve does the EMV of these risks support?

Want more like this? The PMI-RMP practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with the quantitative mechanics, because they are the most reliable points in the domain. Work EMV problems with mixed threats and opportunities until signing is automatic, then build and roll back decision trees that include each option's up-front cost. Time yourself: these should take about a minute each.

Next, study what each technique answers. Write the question each one is for: the matrix ranks individual risks, EMV gives an expected value, decision trees choose between options, Monte Carlo gives confidence levels, and sensitivity analysis finds the biggest drivers. Many questions are solved by matching the stem's question to that list.

Candidates commonly underestimate the qualitative judgment items: data quality, urgency, ordinal scales and the difference between individual and overall project risk. Review these through short scenarios rather than definitions, and practice reading S-curves and tornado diagrams.

Afterwards, move to Risk Response, since the priorities and EMV figures you produce here drive which strategy is chosen and how contingency reserves are sized. Then mix calculation and judgment questions in timed sets.

FAQ

How much of the PMI-RMP exam is Risk Analysis?

PMI weights Risk Analysis at 23%, tied with Risk Identification as the largest domain, across three tasks. PMI does not publish per-domain question counts.

Are there calculations on the PMI-RMP exam?

The outline names EMV, decision trees, Monte Carlo and critical path analysis, so be ready to calculate EMV and decision tree branch values and do simple probability arithmetic. Simulation is best studied by learning to interpret its output, since it cannot be run by hand.

How do I handle opportunities in EMV?

Give them a positive sign and threats a negative sign, then sum. The net figure is the expected value of the set, and a net negative supports a contingency reserve of that size.

When is Monte Carlo the right answer?

When the question asks for the probability or confidence of meeting a date or budget given all risks and estimate uncertainty. It models overall project risk rather than ranking individual risks.

Should every risk get quantitative analysis?

Not usually. Qualitative analysis applies to all risks, while quantitative analysis is reserved for high-priority risks or overall project risk where the value justifies the effort and the data supports it.

How long should I study this domain?

Our planning estimate is about 25 to 30 hours, based on its 23% weight and a 120-hour overall plan. Add time if EMV and decision trees are new to you.

How does analysis connect to the other domains?

It scores the register built in Risk Identification using scales from the risk management plan, and its priorities and EMV figures drive strategy choice and reserve sizing in Risk Response.

Other Project Management certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered qualitative ranking, EMV, decision trees, Monte Carlo output and sensitivity analysis. Test whether you can calculate and choose the right technique under time pressure.

Take the PMI-RMP practice test Check your PMI-RMP readiness

Keep going