PMI-RMP · Domain 4 of 5

PMI-RMP Domain 4: Risk Response

Risk Response covers choosing the right strategy for each threat and opportunity, turning it into owned, time-bound actions, then carrying out the responses and dealing with the residual and secondary risks they leave behind.

Exam weight
13%
Official tasks
2
Estimated questions estimate
~15
Suggested study time estimate
15–20 hrs

About 14 min read Reviewed October 2026

Overview

Risk Response is 13% of the PMI-RMP exam and has two tasks: plan risk response and implement risk response. Planning means selecting a strategy for each priority risk, such as avoid, transfer, mitigate or accept for threats, exploit, share, enhance or accept for opportunities, and escalate for risks outside the project's authority. Each response becomes time-bound actions with an owner, contingency plans with triggers, fallback plans, and an assessment of how the response changes probability and impact. Implementation means executing those plans, gathering stakeholder feedback, and reacting to residual and secondary risks, using workarounds when something unplanned occurs.

The domain turns the priorities from Risk Analysis into action and hands Monitor and Close Risks the responses, reserves and residual risks it must track. It is the smallest domain by weight, but its vocabulary is precise and heavily tested.

How it's tested

Most items describe a prioritized risk and ask which strategy is most appropriate, or describe a response under way and ask what to do about its side effects. Read for who has authority, whether the risk is a threat or an opportunity, whether the aim is to remove, reduce, move or capture it, and whether the response was planned in advance.

  • Name the strategy

    An action is described, such as buying insurance or assigning top staff, and you identify the strategy it represents or the best one to use.

  • Planned or unplanned

    A risk occurs and you decide between executing a contingency plan, a fallback plan or a workaround.

  • After the response

    A response leaves residual risk or creates a secondary risk, and you choose how to record and handle it.

Reasoning it through

A key design approval depends on a regulator outside the program, and the project team has no influence over its timing. Options include mitigating with extra design reviews, accepting with a reserve, or escalating. Because the risk's owner and impact sit beyond the project manager's authority, escalation to the program or portfolio level is appropriate, and the risk is then monitored as escalated rather than owned by the project.

Tasks 2

Official tasks from the PMI outline, in outline order.

4.1 Plan risk responseSelect strategies and define owned, time-bound actions.
What it means
For each priority risk, the risk manager facilitates selection of a strategy, defines time-bound actions with action owners, prepares contingency and fallback plans with triggers, determines how effective the response is expected to be on probability and impact, allocates responsibilities, and re-evaluates organizational risk.
What to understand
Strategy must fit priority, cost and authority: the response should cost less than the exposure it reduces, be agreed by the owner and be achievable in time. Responses are then integrated into the plan, schedule and budget, and reserves are sized for accepted and residual risks.
How it shows up
A stem gives a risk and its context and asks which strategy is most appropriate, or which element is missing from a response plan.
Common confusion
Choosing the strategy that removes the most risk without checking whether its cost exceeds the exposure or whether the project has authority to act.
4.2 Implement risk responseExecute plans and handle residual and secondary risks.
What it means
Owners carry out agreed responses and execute contingency plans when triggers occur. The risk manager encourages stakeholder feedback on how responses are working and evaluates and reacts to secondary and residual risks, improvising with workarounds when something unplanned happens.
What to understand
Implementation is where many responses fail: an agreed plan that nobody executes leaves exposure unchanged. New secondary risks go into the register and are analyzed like any other risk, while residual risk is recorded and covered by acceptance or reserves.
How it shows up
A trigger fires or a response produces a side effect, and the question asks what the owner or risk manager should do next.
Common confusion
Calling an improvised reaction a contingency plan; if it was not planned in advance, it is a workaround.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Threat strategies: escalate, avoid, transfer, mitigate, accept

    Escalate moves the risk to a higher authority, avoid removes it, transfer moves its impact and ownership to a third party, mitigate reduces probability or impact, and accept acknowledges it without proactive action.

    Remember
    Avoid changes the plan to eliminate the risk; mitigate only reduces it.
    Tested as
    Strategy identification is the most frequent question type in this domain.
    Trap
    Labeling any risk reduction as avoidance.

  • Opportunity strategies: escalate, exploit, share, enhance, accept

    Exploit makes sure the opportunity happens, share assigns some ownership to a partner best able to capture it, enhance increases its probability or impact, and accept takes the benefit if it arises without pursuing it.

    Remember
    Exploit aims for certainty; enhance only improves the odds or the size.
    Tested as
    Stems describe assigning the best people or forming a joint venture and ask for the strategy name.
    Trap
    Calling an action that only raises the chance of an opportunity exploit.

  • Transfer

    Shifting the ownership and financial impact of a threat to a third party, typically through insurance, warranties, performance bonds or fixed-price contracts.

    Remember
    Transfer usually costs a premium and seldom removes the risk itself; schedule and reputational effects often remain.
    Tested as
    Contract-type and insurance scenarios.
    Trap
    Believing a transferred risk needs no further monitoring by the project.

  • Active vs. passive acceptance

    Active acceptance sets aside a contingency reserve of time or money to handle a risk if it occurs; passive acceptance takes no action beyond periodic review.

    Remember
    Acceptance fits low-priority risks or those where no cost-effective response exists.
    Tested as
    Appears when response cost exceeds exposure or no other strategy is feasible.
    Trap
    Treating acceptance as ignoring the risk; it is still owned and reviewed.

  • Contingency plan and fallback plan

    A contingency plan is a predefined response executed when a specific trigger occurs; a fallback plan is a further predefined response used if the contingency plan fails or is not effective.

    Remember
    Both are planned in advance and recorded in the register with their triggers.
    Tested as
    Scenarios where a trigger fires or the first response fails.
    Trap
    Inventing a new response when a fallback plan already exists.

  • Workaround

    An unplanned response to a threat or issue that has occurred, used when no planned response exists or the planned one does not apply.

    Remember
    Workarounds are reactive; their use often reveals a gap in identification that should be captured as a lesson learned.
    Tested as
    The ECO lists determining workarounds under planning responses; stems test planned versus unplanned.
    Trap
    Calling a pre-agreed contingency action a workaround.

  • Residual risk

    The risk that remains after a response has been implemented, because few responses remove a risk entirely.

    Remember
    Residual risk is recorded and covered by acceptance, usually with contingency reserve.
    Tested as
    Questions ask what remains after mitigation or how to treat what is left.
    Trap
    Assuming a mitigated risk can be closed as soon as the response is complete.

  • Secondary risk

    A new risk that arises as a direct result of implementing a risk response, such as a new vendor dependency created by outsourcing.

    Remember
    Secondary risks are identified, analyzed and given responses like any other risk.
    Tested as
    A response introduces a new problem and you choose the right handling.
    Trap
    Confusing secondary risk with residual risk.

  • Contingency reserve vs. management reserve

    Contingency reserve is time or money in the baseline for identified, accepted risks; management reserve is held outside the baseline for unidentified risks and is controlled by management.

    Remember
    Known risks use contingency reserve; unknown risks use management reserve, which needs approval and usually a baseline change.
    Tested as
    Reserve-selection and reserve-use questions here and in monitoring.
    Trap
    Drawing on management reserve for an identified risk that already had a contingency allocation.

  • Escalation

    Passing a threat or opportunity to the program, portfolio or organizational level when it is outside the project's scope or the response exceeds the project manager's authority.

    Remember
    Once escalated and accepted, the risk is owned at that level and is no longer monitored by the project in the same way.
    Tested as
    Stems describe regulatory, enterprise or cross-project risks the team cannot influence.
    Trap
    Mitigating with project resources a risk the project has no authority to manage.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Threat vs. opportunity response strategies

ConceptMeaningKey differenceCommon trap
Avoid / Exploit Remove the threat entirely / make the opportunity certain Aim for zero threat or a fully realized opportunity Using these labels for partial changes
Transfer / Share Move threat impact to a third party / give a partner a share to capture the opportunity Involves another party through contract or partnership Thinking transfer removes all project effects
Mitigate / Enhance Reduce threat probability or impact / increase opportunity probability or impact Changes the odds or size, not certainty Calling mitigation avoidance
Accept Acknowledge without proactive action, actively with reserve or passively Used for both threats and opportunities Treating it as ignoring the risk

Contingency plan vs. fallback plan vs. workaround

ConceptMeaningKey differenceCommon trap
Contingency plan Predefined action executed when a trigger occurs Planned in advance; first line response Improvising instead of executing it
Fallback plan Predefined backup if the contingency plan fails Planned in advance; second line response Confusing it with the primary contingency
Workaround Unplanned response to an event that has occurred Not planned; reactive Labeling a planned action as a workaround

Residual risk vs. secondary risk

ConceptMeaningKey differenceCommon trap
Residual risk What remains of the original risk after the response Same risk, reduced Closing the risk once the response is done
Secondary risk A new risk caused by implementing a response Different risk, newly created Not entering it in the register

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Enhance labeled as exploit

    What candidates pick
    Call any action that improves an opportunity exploitation.
    Why it looks right
    Both strategies aim to capture upside, and exploit sounds stronger.
    Why it's wrong
    Exploit removes uncertainty so the opportunity definitely occurs; actions that only raise probability or size are enhance.

    Clue to watch for Words such as "ensure" or "guarantee it happens" signal exploit; "increase the chance" signals enhance.

  2. Transfer means gone

    What candidates pick
    Remove the risk from monitoring after buying insurance or signing a fixed-price contract.
    Why it looks right
    Someone else now bears the financial impact.
    Why it's wrong
    Transfer moves ownership of the financial impact but the event can still occur and affect schedule, quality or reputation, so residual risk stays in the register.

    Clue to watch for The stem mentions schedule or delivery consequences that a contract cannot compensate.

  3. Strongest response wins

    What candidates pick
    Pick avoidance because it eliminates the threat.
    Why it looks right
    Zero risk looks like the best outcome.
    Why it's wrong
    Responses must be cost-effective and proportionate; avoiding a low-impact risk by changing scope can cost more than the exposure it removes.

    Clue to watch for The stem gives a low exposure or a response cost greater than the expected impact.

  4. Improvising when a plan exists

    What candidates pick
    Convene the team to work out a new response when a trigger occurs.
    Why it looks right
    Fresh analysis feels responsible.
    Why it's wrong
    The contingency plan was agreed for exactly this trigger; the owner should execute it, and use the fallback plan if it fails.

    Clue to watch for The register already holds a contingency plan for the risk.

  5. Ignoring the secondary risk

    What candidates pick
    Note the side effect in the meeting minutes and move on.
    Why it looks right
    The original risk has been handled and the side effect looks small.
    Why it's wrong
    Secondary risks must be added to the register, analyzed and given responses like any other risk.

    Clue to watch for The stem says the response itself created a new uncertainty, such as a new supplier dependency.

  6. Wrong reserve

    What candidates pick
    Use management reserve to fund the response to an identified, accepted risk.
    Why it looks right
    Management reserve is the larger pot and the need is urgent.
    Why it's wrong
    Identified, accepted risks are covered by contingency reserve inside the baseline; management reserve is for unidentified risks and requires management approval.

    Clue to watch for The risk was in the register with an active acceptance and an allocation.

  7. Keeping what should be escalated

    What candidates pick
    Mitigate an enterprise-level risk with project resources.
    Why it looks right
    Taking ownership looks proactive.
    Why it's wrong
    When the response exceeds the project's authority or the impact is beyond the project, escalation to the right level is the correct strategy.

    Clue to watch for The stem mentions a regulator, corporate policy or another program controlling the cause.

Answer framework

When a response question appears, use these steps to choose the strategy or action the exam expects.

  1. Confirm whether the item is a threat or an opportunity and whether its cause or impact lies within the project's authority; escalate if not.
  2. Select the strategy by intent: remove or ensure, move or partner, reduce or increase, or accept with or without reserve.
  3. Check that the response is proportionate, cost-effective, agreed by a named owner and achievable before the risk could occur.
  4. Turn the strategy into time-bound actions, contingency and fallback plans with triggers, and reserves for accepted and residual risk.
  5. During implementation, execute planned responses first, record residual and secondary risks, and use workarounds only for unplanned events.

Practice question

A software project may finish a module early if a newly released framework works as advertised. The risk manager wants to make certain the early finish happens, so the sponsor assigns the organization's most experienced framework team to the module. Which strategy is being applied?

Want more like this? The PMI-RMP practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by memorizing the strategy pairs as mirrors: avoid and exploit, transfer and share, mitigate and enhance, plus accept and escalate for both. Then practice with short action statements, such as buying insurance or assigning a top team, and name the strategy. Focus on the intent words in each stem, because they decide most questions.

Next, study the response sequence in time: planned strategy, contingency plan with trigger, fallback plan, and only then workarounds for the unplanned. Pair that with residual versus secondary risk and with contingency versus management reserve, since these are the follow-on questions once a response is in place.

Candidates commonly underestimate escalation and proportionality. Practice scenarios where the strongest response is not the best one because it costs more than the exposure, or because the risk sits outside the project's authority.

This domain is small by weight, so efficient study is enough. Afterwards, move to Monitor and Close Risks, which tracks the responses, reserves and residual risks you plan here, and drill mixed response and monitoring scenarios.

FAQ

How much of the PMI-RMP exam is Risk Response?

PMI weights Risk Response at 13%, the smallest of the five domains, across two tasks. PMI does not publish per-domain question counts.

What is the difference between exploit and enhance?

Exploit acts to make sure an opportunity happens, removing its uncertainty. Enhance increases the probability or impact of the opportunity without guaranteeing it.

Does transferring a risk remove it from the project?

No. Transfer moves the financial impact and ownership to a third party, but the event can still affect schedule, quality or reputation, so residual risk is still tracked.

How is a workaround different from a contingency plan?

A contingency plan is prepared in advance and executed when a trigger occurs. A workaround is an unplanned response to something that has already happened without a suitable plan.

Which reserve covers identified risks?

Contingency reserve, which sits inside the cost or schedule baseline for identified, accepted risks. Management reserve is outside the baseline for unidentified risks and needs management approval.

How long should I study this domain?

Our planning estimate is about 15 to 20 hours, based on its 13% weight and a 120-hour overall plan. The terms are precise, so spend that time on scenario practice.

How does Risk Response connect to the other domains?

It acts on priorities and EMV figures from Risk Analysis and hands responses, reserves and residual risks to Monitor and Close Risks for tracking.

Other Project Management certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered threat and opportunity strategies, contingency and fallback plans, reserves, and residual and secondary risk. Check whether you can name the right strategy from the intent in a stem.

Take the PMI-RMP practice test Check your PMI-RMP readiness

Keep going