PMI-RMP · Domain 2 of 5

PMI-RMP Domain 2: Risk Identification

Risk Identification is where uncertainty becomes a documented list: running identification exercises, testing assumptions and constraints, recording triggers, and building a risk register clear enough for analysis to work on.

Exam weight
23%
Official tasks
4
Estimated questions estimate
~26
Suggested study time estimate
25–30 hrs

About 15 min read Reviewed October 2026

Overview

Risk Identification is 23% of the PMI-RMP exam, tied for the largest share, and has four tasks. You run identification exercises such as interviews, workshops, focus groups and expert sessions, and analyze documents and data in their business context. You test the project's assumptions and constraints for risk, record triggers, causes, timing and consequences, and build the risk register with each risk's origin, owner and classification as a threat or an opportunity.

The domain depends on Risk Strategy and Planning for its categories, RBS and thresholds, and it feeds Risk Analysis directly: a risk that is vaguely written or missing a cause cannot be scored reliably. Good identification separates the cause, the uncertain event and the effect, because responses later act on causes and triggers, not on symptoms.

How it's tested

Questions present a workshop, a document review or a stakeholder conversation and ask which technique fits, whether an item is a risk at all, or what to record. Read for tense and certainty: an uncertain future event is a risk, an event that has occurred is an issue, and a warning sign that a risk is about to occur is a trigger.

  • Risk, issue or trigger

    A situation is described and you decide where it belongs. Tense and certainty are the clues.

  • Pick the technique

    A constraint such as dispersed experts, dominant personalities or a tight deadline points to a technique such as the Delphi technique, interviews or a checklist.

  • Complete the register entry

    An entry is missing something, such as an owner, a cause, or its threat or opportunity classification, and you pick what must be added before analysis.

Reasoning it through

During a workshop, a senior engineer's views dominate and junior members stop contributing. Several options add more workshop time or have the project manager moderate harder. The issue is anchoring on one voice, so the best response is an anonymous technique such as the Delphi technique or written idea collection, which removes the social pressure while keeping expert input.

Tasks 4

Official tasks from the PMI outline, in outline order.

2.1 Conduct risk identification exercisesRun workshops, interviews and expert sessions and analyze the results.
What it means
The risk manager selects and runs identification techniques such as brainstorming, interviews, focus groups, the Delphi technique, checklists drawn from the RBS, and analysis of documents, transcripts and telemetry data, then classifies each result as a threat or an opportunity.
What to understand
Technique choice depends on context: anonymous methods counter groupthink and dominant voices, interviews draw out sensitive concerns, checklists ensure coverage but miss novel risks. Raw output must be analyzed and de-duplicated, not dropped straight into the register.
How it shows up
A stem describes a workshop problem, such as one person dominating or experts in many time zones, and asks for the most suitable technique.
Common confusion
Relying only on checklists from past projects, which reinforces known risks and misses ones specific to this project.
2.2 Examine assumption and constraint analysesTest what the plan takes for granted.
What it means
Every assumption is a belief treated as true for planning, and every constraint is a limiting factor. The risk manager uses the results of assumption and constraint analysis, categorizes them, assesses the risk if each proves false or binding, and maps how each links to objectives.
What to understand
An assumption that turns out to be false becomes a source of risk. Rate each by stability and impact if wrong; unstable, high-impact assumptions become register entries. Stakeholders should be encouraged to challenge assumptions rather than defend them.
How it shows up
A plan assumes a vendor will deliver on time or staff will be available; the question asks what the risk manager should do with that assumption.
Common confusion
Treating assumptions as settled facts that need no review once they are written into the assumption log.
2.3 Document risk triggers and thresholds based on context/environmentRecord warning signs, causes, timing and consequences.
What it means
For each risk you record the trigger (an early warning sign that it is about to occur or has begun to occur), its causes, when it could occur, and its consequences, and you confirm that thresholds and categories still fit the updated risk data.
What to understand
Triggers are what make contingency plans executable, because they define the moment to act. Thresholds set in planning may need revisiting as the context changes, and stakeholders are encouraged to challenge thresholds that no longer fit.
How it shows up
A stem gives a warning sign, such as a supplier missing two interim milestones, and asks what it represents or what should happen next.
Common confusion
Mistaking the trigger for the risk itself; the trigger is the signal, the risk is the uncertain event it warns of.
2.4 Develop risk registerValidate risks and record origin, owner, probability, impact and urgency.
What it means
The risk register holds each validated risk with its description, trigger, initial probability, impact and urgency, origin (internal or external), classification as a threat or opportunity, and an owner.
What to understand
Each risk needs a single owner who is accountable for monitoring it and ensuring a response. Good descriptions use cause, risk and effect structure so the entry can be analyzed and responded to.
How it shows up
A register entry lacks an owner or is too vague to score, and the question asks for the best improvement before analysis.
Common confusion
Assigning ownership to a team or to the risk manager by default, rather than to the person best placed to manage that specific risk.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Individual project risk

    An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.

    Remember
    It is uncertain and in the future; once it has happened it is an issue and moves to the issue log.
    Tested as
    Many stems test whether an event described is still a risk or has already become an issue.
    Trap
    Logging a problem that has already occurred in the risk register and planning a risk response for it.

  • Cause, risk, effect (risk metalanguage)

    A three-part risk statement: because of a cause, an uncertain event may occur, which would lead to an effect on objectives.

    Remember
    Responses act on causes and events; effects describe impact. Mixing them up leads to responses that treat symptoms.
    Tested as
    Questions ask which statement is a well-formed risk, or why a register entry cannot be analyzed.
    Trap
    Accepting a category label such as "schedule risk" as a risk description.

  • Risk trigger

    An event or condition that indicates a risk is about to occur or has begun to occur, such as a supplier missing interim milestones.

    Remember
    Triggers are recorded in the register and are what tell the owner to execute a contingency plan.
    Tested as
    Scenarios describe a warning sign and ask what action the risk owner should now take.
    Trap
    Treating a fired trigger as a new risk to analyze instead of the cue to implement the agreed contingency response.

  • Delphi technique

    An anonymous, iterative method where a facilitator collects expert opinions by questionnaire, shares a summary, and repeats until views converge.

    Remember
    Anonymity removes the influence of rank and dominant personalities and works for geographically dispersed experts.
    Tested as
    The likely answer when a stem mentions groupthink, a dominant senior voice or experts in different locations.
    Trap
    Choosing a larger brainstorming session, which keeps the same social pressure that caused the problem.

  • Assumption and constraint analysis

    Reviewing each planning assumption and constraint to judge how likely it is to be wrong or binding and what that would do to objectives.

    Remember
    Unstable assumptions with high impact if false become risks in the register.
    Tested as
    Appears when a plan depends on an unverified condition such as resource availability or vendor capacity.
    Trap
    Leaving the assumption in the assumption log without assessing its risk.

  • Risk owner

    The single person accountable for monitoring a risk, selecting and ensuring the response, and reporting its status.

    Remember
    Owners are named in the register and should be the person best placed to manage that risk, not automatically the risk manager.
    Tested as
    Questions on stalled responses often trace to an entry with no owner or a group listed as owner.
    Trap
    Making the project manager or risk manager the owner of every risk.

  • Risk register

    The project document that records identified individual risks with their descriptions, triggers, owners, scores and, later, responses and status.

    Remember
    It grows through the project: identification adds entries, analysis adds scores, response adds actions, monitoring updates status and closure.
    Tested as
    Most domains reference the register; this domain tests what must be in an entry at creation.
    Trap
    Thinking the register is completed once and then archived.

  • Risk urgency

    How soon a response is needed, based on when the risk could occur and how long a response takes to put in place.

    Remember
    A medium risk that could occur next week may need action before a high risk that is months away.
    Tested as
    Used in register and prioritization stems where two risks have similar scores but different timing.
    Trap
    Prioritizing only by probability and impact and ignoring proximity.

  • Internal vs. external risk origin

    Whether a risk comes from within the project or organization, such as resource skills, or from outside, such as regulation or market conditions.

    Remember
    Origin influences ownership and response options; external risks often need escalation or transfer.
    Tested as
    Register-completion questions ask what attribute is missing or how origin affects who owns a risk.
    Trap
    Assuming external risks cannot be managed and leaving them without owners.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Risk vs. issue vs. trigger

ConceptMeaningKey differenceCommon trap
Risk An uncertain future event that could affect objectives Has not happened; recorded in the risk register Logging past events here
Issue A current condition or event affecting the project Already occurred; recorded in the issue log Planning avoidance for something already happening
Trigger A warning sign that a risk is about to occur or has begun Signal to act on a planned response Analyzing it as a brand-new risk

Brainstorming vs. Delphi technique vs. interviews

ConceptMeaningKey differenceCommon trap
Brainstorming Group generates risks openly in a facilitated session Fast and collaborative but prone to groupthink Using it when one voice dominates
Delphi technique Anonymous expert rounds with summarized feedback Removes rank pressure; suits dispersed experts Expecting quick results; it takes several rounds
Interviews One-to-one discussions with stakeholders or experts Draws out sensitive or political concerns Using them alone for broad coverage

Assumption vs. constraint

ConceptMeaningKey differenceCommon trap
Assumption A factor taken as true for planning without proof Becomes a risk source if it proves false Treating it as a confirmed fact
Constraint A limiting factor such as a fixed deadline or budget Known limit; risk arises if it tightens or binds Thinking a known constraint carries no risk

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Issue in the risk register

    What candidates pick
    Add the event to the risk register and plan a mitigation response.
    Why it looks right
    The event is clearly harmful and the register is the familiar place for problems.
    Why it's wrong
    If the event has already happened, it is an issue. It goes to the issue log and needs corrective action or a workaround, not a risk response.

    Clue to watch for Past or present tense such as "has failed" or "is now delayed".

  2. More brainstorming

    What candidates pick
    Extend the brainstorming session or invite more people.
    Why it looks right
    More time and participants seem to promise more risks.
    Why it's wrong
    When a dominant voice or groupthink is the problem, more open discussion repeats it; an anonymous technique such as Delphi addresses the cause.

    Clue to watch for Junior staff stop speaking, or everyone agrees with the senior expert.

  3. Trigger treated as new risk

    What candidates pick
    Add the warning sign to the register and analyze it.
    Why it looks right
    It is new information about uncertainty, so it feels like a risk to record.
    Why it's wrong
    A trigger already documented for an existing risk is the signal for the owner to act, usually by executing the contingency plan.

    Clue to watch for The stem says a previously identified warning sign has now appeared.

  4. Risk manager owns everything

    What candidates pick
    Assign the risk manager as owner for all register entries.
    Why it looks right
    It centralizes accountability in the person who runs the process.
    Why it's wrong
    Owners should be the people best placed to manage each risk; central ownership overloads one person and weakens engagement.

    Clue to watch for A technical or vendor risk where a specific lead or manager clearly has control.

  5. Assumption accepted as fact

    What candidates pick
    Proceed on the documented assumption because it was approved in planning.
    Why it looks right
    Approved documents feel authoritative and revisiting them looks like rework.
    Why it's wrong
    Assumption analysis exists to test exactly these beliefs; an unverified assumption with high impact if false is a risk to record and analyze.

    Clue to watch for The plan depends on availability, delivery or approval that nobody has confirmed.

  6. Threats only

    What candidates pick
    Limit the workshop to what could go wrong.
    Why it looks right
    Risk is commonly understood as negative and threats feel more urgent.
    Why it's wrong
    The ECO requires each risk to be classified as a threat or an opportunity; ignoring opportunities loses value the project could capture.

    Clue to watch for The stem mentions an early finish, cheaper material or a new capability that could benefit the project.

Answer framework

When an identification scenario asks what to do or record, work through these steps to find the expected answer.

  1. Check tense and certainty first: decide whether the item is a future uncertain risk, a current issue, or a trigger for an existing risk.
  2. Choose an identification technique that fits the constraint described, using anonymous methods for groupthink and interviews for sensitive concerns.
  3. Test every planning assumption and constraint, and record as risks those that are unstable and would hurt objectives if wrong.
  4. Write each risk as cause, uncertain event and effect, and document its trigger, timing, consequences and threat or opportunity classification.
  5. Validate the entry and assign one owner best placed to manage it, along with origin, probability, impact and urgency.

Practice question

During a risk review, a team lead reports that the steel supplier has missed two interim delivery milestones. The register already lists late steel delivery as a risk, with this pattern documented as its trigger and a contingency plan. What should happen NEXT?

Want more like this? The PMI-RMP practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with the vocabulary that the rest of the domain depends on: risk, issue, trigger, cause and effect. Practice classifying short statements until tense and certainty give you the answer instantly, because many questions here are decided by that single judgment.

Next, study identification techniques by the problem each one solves rather than by definition. Make a two-column list of situations (dominant voice, dispersed experts, sensitive politics, need for coverage, novel technology) and the technique that fits. Then work through assumption and constraint analysis with a real or sample project plan, rating each assumption by stability and impact if wrong.

Candidates commonly underestimate triggers and register completeness. Rewrite weak register entries such as "vendor risk" into full cause, event and effect statements with a trigger, an owner and a classification. That exercise also prepares you for Risk Analysis, which cannot score vague entries.

Afterwards, move to Risk Analysis and practice scenario sets that mix identification and analysis, since stems often describe a register entry and ask whether it is ready to be scored.

FAQ

How much of the PMI-RMP exam is Risk Identification?

PMI weights Risk Identification at 23%, tied with Risk Analysis as the largest domain, across four tasks. PMI does not publish per-domain question counts.

How do I tell a risk from an issue on the exam?

Look at tense and certainty. A risk is uncertain and in the future; an issue has occurred or is occurring now and belongs in the issue log with corrective action or a workaround.

What is a risk trigger?

A trigger is an early warning sign that a risk is about to occur or has begun to occur. It is recorded with the risk and tells the owner when to execute the contingency plan.

When should I choose the Delphi technique?

Choose it when anonymity matters, for example when a senior person dominates discussion, when groupthink is likely, or when experts are spread across locations. It trades speed for independent opinions.

Who should own a risk?

The single person best placed to monitor and manage that specific risk. The risk manager facilitates the process but should not own every entry by default.

How long should I study this domain?

Our planning estimate is about 25 to 30 hours, based on its 23% weight and a 120-hour overall plan. Allow extra time for practice with register entries and technique selection.

How does identification connect to the other domains?

It uses the RBS, categories and thresholds from Risk Strategy and Planning and produces the register that Risk Analysis scores. A vague or ownerless entry here becomes an analysis or response problem later.

Other Project Management certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered identification techniques, assumption and constraint analysis, triggers and the risk register. See whether you can classify risks, issues and triggers correctly under exam time pressure.

Take the PMI-RMP practice test Check your PMI-RMP readiness

Keep going