PMI-RMP · Domain 1 of 5

PMI-RMP Domain 1: Risk Strategy and Planning

Risk Strategy and Planning covers the groundwork before any risk is logged: reading the project's documents and environment, turning organizational appetite into measurable thresholds, and writing a risk management plan stakeholders will actually follow.

Exam weight
22%
Official tasks
6
Estimated questions estimate
~25
Suggested study time estimate
20–30 hrs

About 17 min read Reviewed October 2026

Overview

Risk Strategy and Planning is 22% of the PMI-RMP exam and has six tasks. It starts before identification: you review lessons learned, benchmarks and historical data, scan the environment with tools such as PESTLE and SWOT, judge the organization's risk culture and appetite, and convert that appetite into thresholds the project can measure. You then choose the processes, tools, categories and metrics, and record them in a risk management plan with roles, a risk breakdown structure (RBS), communication rules and prioritization criteria.

The domain exists because every later decision depends on it. Probability and impact definitions written here drive the scoring in Risk Analysis, thresholds written here decide which risks Risk Response must act on, and the metrics chosen here are what Monitor and Close Risks measures against. Stakeholder leadership runs through all six tasks, because a plan nobody accepts is only a document.

How it's tested

Questions here are mostly situational: a new or troubled project, a sponsor with a stated attitude to risk, and a choice of what the risk manager should do FIRST or NEXT. Expect process-order logic (analyze documents and environment before writing the plan), definitional precision on appetite and thresholds, and leadership choices that favor facilitation and coaching over directives.

  • What comes first

    A project is starting or restarting and you choose the earliest correct step. Document and environment analysis precede thresholds, and thresholds precede the plan.

  • Appetite into numbers

    Stakeholders state a vague attitude to risk and you pick the action that converts it into an agreed, measurable threshold such as a cost or schedule limit.

  • Plan content

    A problem appears later (inconsistent scoring, unclear owners, no escalation path) and you trace it back to the plan section that should have defined it.

Reasoning it through

A sponsor says the organization is cautious, but two directors disagree on how much schedule slip is acceptable. The risk register is not yet built. Options include starting identification workshops, writing the plan with the sponsor's view, or facilitating agreement on a measurable threshold. Thresholds must be agreed before they are written into the plan, and identification needs them, so facilitating the threshold discussion is the answer.

Tasks 6

Official tasks from the PMI outline, in outline order.

1.1 Perform a preliminary document analysisMine existing documents before identifying anything new.
What it means
Before workshops begin, the risk manager gathers the charter, business case, contracts, benchmarks, lessons learned and historical data from similar projects, decides who should analyze them, and filters out what is irrelevant to risk.
What to understand
This is a source-quality step: you check where each document came from and whether it applies, because a lessons-learned file from an unlike project can mislead. The output is a curated set of inputs for environment analysis and identification.
How it shows up
A new risk manager joins mid-planning and asks what to do first; reviewing existing project and historical documents beats calling a workshop.
Common confusion
Treating document analysis as the identification technique itself rather than as preparation that feeds identification and planning.
1.2 Assess project environment for threats and opportunitiesRead the internal and external context, culture and methodology.
What it means
You determine the relevant organizational process assets (OPAs) and enterprise environmental factors (EEFs), the delivery approach (predictive, agile or hybrid), external factors through PESTLE and SWOT, the organization's risk culture maturity, and the business driver and key assumptions behind the project.
What to understand
Environment drives strategy. A low-maturity risk culture needs more coaching and simpler tools; an agile team needs risk activities built into iterations; a regulated market adds compliance constraints. The ECO expects you to look for opportunities here as well as threats.
How it shows up
A stem describes a pending regulation, an immature risk culture or a switch to agile delivery and asks how it should shape the risk approach.
Common confusion
Using SWOT only for threats and weaknesses and forgetting that strengths and opportunities are explicitly part of the scan.
1.3 Confirm risk thresholds based on risk appetitesTurn appetite into measurable, agreed limits.
What it means
Risk appetite is how much uncertainty the organization is willing to take on in pursuit of value; a risk threshold is the measurable point (for example, 5% cost overrun or two weeks of delay) beyond which a risk needs a specific response or escalation. You align project thresholds to the organization's appetite and to how much it can absorb.
What to understand
Thresholds must be numeric, agreed by key stakeholders and recorded in the plan. When stakeholders disagree, the risk manager facilitates resolution rather than choosing a number alone, and escalates to the sponsor only if facilitation fails.
How it shows up
Directors give conflicting views on acceptable delay, and the correct action is to facilitate agreement on a measurable threshold before proceeding.
Common confusion
Using appetite and threshold interchangeably; appetite is the attitude, the threshold is the line you measure against.
1.4 Establish risk management strategyChoose processes, tools, categories and metrics, and lead adoption.
What it means
The strategy sets how risk will be managed on this project: which processes and tools, which templates and forms, which risk categories, and which metrics will show whether the risk process is working. It also covers coaching the team and leading stakeholders to adopt it.
What to understand
Strategy is tailored to size, complexity and approach; a small agile project may use a lightweight register reviewed each iteration, while a large program may add quantitative analysis. Metrics chosen here, such as risk closure rate or exposure trend, are what you later monitor.
How it shows up
A scenario asks how to scale risk management to a small or fast-moving project; the answer tailors the approach rather than dropping it or applying the heaviest process.
Common confusion
Confusing the strategy (the approach and choices) with the plan (the documented record of those choices, roles and schedule).
1.5 Document the risk management planRecord roles, RBS, scales, communication and prioritization criteria.
What it means
The risk management plan documents roles and responsibilities (often with a RACI-style responsibility assignment matrix), key activities and timing, the RBS, definitions of probability and impact, the probability and impact matrix, prioritization criteria, the communication approach, and how stakeholders will be educated and empowered.
What to understand
The plan says how risk will be managed; it does not list individual risks, which belong in the risk register. Many later problems, such as two analysts scoring the same risk differently, trace back to missing or vague definitions in this plan.
How it shows up
Team members rate the same risk inconsistently, and the best fix is to clarify the probability and impact definitions in the plan.
Common confusion
Expecting the plan to contain the list of identified risks and their owners, which is the register's job.
1.6 Plan and lead risk management activities with stakeholdersEngage, educate and set rules of engagement.
What it means
Using the project manager's stakeholder analysis, the risk manager manages stakeholder risk attitudes, involves them in prioritization, sets rules of engagement for risk activities, tailors communication to each group, and trains and coaches stakeholders so they share ownership.
What to understand
The ECO frames the risk manager as a leader and facilitator. Risk attitudes (averse, tolerant, neutral, seeking) and biases change how people score and accept risk, so engagement is planned, not left to chance.
How it shows up
A key stakeholder dismisses the risk process or dominates workshops, and the right move is targeted engagement and coaching, not exclusion or escalation first.
Common confusion
Assuming stakeholder engagement belongs only to the project manager and is outside the risk manager's tasks.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Risk appetite

    The degree of uncertainty an organization or stakeholder is willing to accept in pursuit of its objectives, usually stated qualitatively by leadership.

    Remember
    Appetite is an attitude and cannot be measured directly against a forecast until it is translated into thresholds.
    Tested as
    Stems quote a sponsor's attitude and ask what the risk manager must do with it, which is convert it into agreed thresholds.
    Trap
    Selecting an answer that measures performance against appetite itself, when only a threshold gives a usable trigger for action.

  • Risk threshold

    A measurable level of risk exposure, such as a 10% cost increase, above which a risk is treated as unacceptable and must be addressed or escalated.

    Remember
    Thresholds are numeric, agreed by key stakeholders, aligned to appetite, and recorded in the risk management plan.
    Tested as
    Many monitoring and response questions turn on whether exposure has crossed a threshold that was set here.
    Trap
    Treating a threshold set by the risk manager alone as valid; without stakeholder agreement it will be challenged when it matters.

  • Risk attitude

    A person's or group's chosen response to uncertainty, commonly described as risk-averse, risk-tolerant, risk-neutral or risk-seeking, shaped by perception and bias.

    Remember
    Attitude explains why stakeholders score the same risk differently; the plan and facilitation are how you manage it.
    Tested as
    Scenarios describe a stakeholder who downplays or exaggerates risks and ask for the right engagement response.
    Trap
    Treating a risk-averse stakeholder's high scores as data errors to overwrite rather than an attitude to understand and address.

  • Risk management plan

    The component of the project management plan that describes how risk management will be structured and performed, including roles, timing, categories, scales and reporting.

    Remember
    It defines the method, not the risks; individual risks live in the risk register.
    Tested as
    Questions trace inconsistent scoring, unclear ownership or missing escalation back to a gap in this plan.
    Trap
    Choosing to update the risk register when the root problem is an undefined scale or rule that belongs in the plan.

  • Risk breakdown structure (RBS)

    A hierarchical grouping of potential sources of risk, for example technical, external, organizational and project management, used to prompt identification and to group risks for analysis.

    Remember
    The RBS is defined in the plan, used as a checklist during identification and as categories during qualitative analysis.
    Tested as
    Expect questions on using RBS categories to spot gaps in coverage or concentrations of risk in one source.
    Trap
    Confusing the RBS with the work breakdown structure, which decomposes deliverables, not sources of risk.

  • Probability and impact definitions

    Descriptions in the plan of what each level (for example, very low to very high) means numerically for probability and for impact on cost, schedule, scope and quality.

    Remember
    Without shared definitions, qualitative scores are opinions and cannot be compared across risks or assessors.
    Tested as
    A favored root-cause question: two assessors disagree on the same risk because definitions were never set.
    Trap
    Retraining the assessors or averaging their scores instead of fixing the missing definitions.

  • PESTLE

    An environmental scan across political, economic, social, technological, legal and environmental factors to surface external sources of threat and opportunity.

    Remember
    It looks outward at the environment; SWOT combines internal strengths and weaknesses with external opportunities and threats.
    Tested as
    Used in stems where a market, regulatory or economic change must be factored into the risk strategy.
    Trap
    Applying PESTLE to internal process weaknesses, which it is not designed to capture.

  • Risk culture maturity

    How established and trusted risk management practice is in the organization, from ad hoc and blame-oriented to embedded and routinely used for decisions.

    Remember
    Lower maturity calls for simpler tools, more coaching and visible leadership support, not the heaviest process.
    Tested as
    Scenarios describe teams hiding risks or treating the register as paperwork, and ask for the best strategic response.
    Trap
    Choosing to impose a detailed quantitative process on a team that does not yet report risks openly.

  • RACI / responsibility assignment matrix

    A matrix showing who is Responsible, Accountable, Consulted and Informed for each risk activity, documented in the risk management plan.

    Remember
    Only one person is Accountable for an activity; risk owners for individual risks are then named in the register.
    Tested as
    Questions on confusion over who runs workshops, approves thresholds or reports exposure point back to this matrix.
    Trap
    Assigning accountability to a group or committee, which leaves no single person answerable.

  • Tailoring

    Adapting the depth, frequency and tools of risk management to the project's size, complexity, approach and the organization's culture.

    Remember
    The ECO states predictive, agile and hybrid approaches appear across all domains, so tailoring is always in scope.
    Tested as
    Appears when a small, agile or low-maturity project is described and the options range from no process to a full one.
    Trap
    Believing agile projects do not need a risk strategy; they integrate it into backlog, iteration planning and reviews instead.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Risk appetite vs. risk threshold vs. risk attitude

ConceptMeaningKey differenceCommon trap
Risk appetite How much uncertainty the organization is willing to accept for reward Qualitative statement of willingness set by leadership Trying to trigger responses directly from it
Risk threshold Measurable limit of acceptable exposure on a specific objective Numeric and agreed; derived from appetite Setting it unilaterally without stakeholder agreement
Risk attitude An individual's or group's chosen response to uncertainty Varies by person and situation; shaped by bias Mistaking one stakeholder's attitude for the organization's appetite

Risk management plan vs. risk register

ConceptMeaningKey differenceCommon trap
Risk management plan How risk management will be done on this project Method: roles, scales, RBS, timing, reporting Looking here for a list of specific risks
Risk register Record of individual risks and their details Content: each risk, owner, scores, responses Fixing a method problem by editing register entries

PESTLE vs. SWOT

ConceptMeaningKey differenceCommon trap
PESTLE Scan of political, economic, social, technological, legal and environmental factors External environment only Using it for internal capability gaps
SWOT Strengths, weaknesses, opportunities and threats Combines internal and external views Ignoring the strengths and opportunities quadrants

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Jumping to identification

    What candidates pick
    Schedule a risk identification workshop as the first action on a new project.
    Why it looks right
    Identification feels like real risk work and produces visible output quickly.
    Why it's wrong
    Without document analysis, environment assessment and agreed thresholds, the workshop has no criteria for scope or significance and results cannot be prioritized consistently.

    Clue to watch for The stem says the project is just starting or no plan, thresholds or scales exist yet.

  2. Risk manager sets the threshold

    What candidates pick
    Define the threshold yourself based on experience to move the project forward.
    Why it looks right
    The risk manager is the expert and the debate is stalling progress.
    Why it's wrong
    Thresholds express stakeholder and organizational appetite; a number imposed without agreement will not be honored when a risk breaches it.

    Clue to watch for Stakeholders disagree about acceptable cost or delay, and an option offers to facilitate agreement.

  3. Escalating before facilitating

    What candidates pick
    Escalate a disagreement on appetite straight to the sponsor.
    Why it looks right
    The sponsor has authority and can settle it immediately.
    Why it's wrong
    The ECO expects the risk manager to lead conflict resolution among stakeholders first; escalation is appropriate only after facilitation fails or authority is exceeded.

    Clue to watch for No attempt to resolve the disagreement has been described yet.

  4. Fixing scores, not scales

    What candidates pick
    Average the conflicting risk scores or have the risk manager rescore everything.
    Why it looks right
    It produces a single number quickly and looks decisive.
    Why it's wrong
    The inconsistency comes from missing probability and impact definitions; until the plan defines them, the next round of scoring will diverge again.

    Clue to watch for Different assessors give very different ratings to the same risk.

  5. One process for every project

    What candidates pick
    Apply the organization's full quantitative risk process to a small agile project.
    Why it looks right
    It appears thorough and compliant with policy.
    Why it's wrong
    Strategy should be tailored to size, complexity and approach; an oversized process wastes effort and reduces engagement, which raises real risk.

    Clue to watch for The stem stresses a short, small or iterative project with limited data.

  6. Ignoring the opportunity side

    What candidates pick
    Limit the environment scan to threats and weaknesses.
    Why it looks right
    Risk is commonly associated with negative events.
    Why it's wrong
    The task explicitly asks for threats and opportunities; missing positive risks means the strategy has no way to capture upside value.

    Clue to watch for The stem mentions a market shift, new technology or funding change that could help the project.

Answer framework

When a planning scenario asks what the risk manager should do, check these steps in order and stop at the first one not yet complete.

  1. Gather and review existing documents, lessons learned, benchmarks and historical data, and confirm which sources genuinely apply to this project.
  2. Assess the environment: OPAs, EEFs, the delivery approach, PESTLE and SWOT factors, and the maturity of the organization's risk culture.
  3. Facilitate stakeholder agreement that converts the organization's stated appetite into measurable thresholds for cost, schedule, scope and quality.
  4. Select and tailor processes, tools, categories, scales and metrics, then document them with roles, timing and communication rules in the plan.
  5. Engage, train and coach stakeholders so they understand and adopt the plan, resolving disagreements yourself through facilitation before escalating anything to the sponsor.

Practice question

A risk manager is assigned to a new infrastructure project. Leadership describes the organization as cautious. Two directors disagree on how much schedule delay is acceptable, and no risk management plan exists yet. What should the risk manager do NEXT?

Want more like this? The PMI-RMP practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Study the six tasks in ECO order, because the order is the logic the exam tests: documents, environment, thresholds, strategy, plan, and stakeholder leadership. For each task, write one sentence on what must already be true before it can start; that habit answers most FIRST and NEXT questions.

Put the most effort into appetite, thresholds and attitudes, and into the contents of the risk management plan. Practice converting a vague statement such as "we can live with a small overrun" into a threshold with a number, an objective and an approver. Then list which later problems each plan section prevents, such as inconsistent scores, unclear owners and missing escalation.

Candidates commonly underestimate the leadership content in tasks 1.4 and 1.6. Expect stems where the technically correct process exists but people are not using it, and the answer is coaching, tailoring or facilitation. Review risk culture maturity and the difference between tailoring and skipping.

Afterwards, move to Risk Identification, since it consumes the RBS, thresholds and categories set here, and drill mixed scenario sets that ask what the risk manager should do first on a new or recovering project.

FAQ

How much of the PMI-RMP exam is Risk Strategy and Planning?

PMI weights this domain at 22% of the exam, across six tasks. That is a little over one item in five of the 115, though PMI does not publish per-domain question counts.

What is the difference between risk appetite and risk threshold?

Appetite is the organization's willingness to accept uncertainty, usually stated in words. A threshold is the measurable limit derived from that appetite, such as a 5% budget overrun, and it is what triggers a response or escalation.

Does the risk management plan list the project's risks?

No. The plan describes how risk management will be performed, including roles, scales, the RBS, timing and reporting. Individual risks, owners and responses are recorded in the risk register.

What question style does this domain use?

Mostly situational questions about a new or troubled project, asking what the risk manager should do first or next. Correct answers follow the planning sequence and favor facilitation and coaching over unilateral decisions.

Do agile projects need a risk management plan?

Yes, but it is tailored. The ECO states predictive, agile and hybrid approaches appear across all domains, so expect lightweight plans where risk work is built into backlog refinement, iteration planning and reviews.

How long should I study this domain?

Our planning estimate is about 20 to 30 hours, based on its 22% weight and a 120-hour overall plan. Spend more if you have never written a risk management plan in practice.

How does this domain connect to the rest of the exam?

Identification uses its RBS and categories, analysis uses its probability and impact definitions, response uses its thresholds, and monitoring measures against its metrics. A gap here often explains a problem described in a later-domain scenario.

Other Project Management certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have worked through document and environment analysis, converting appetite into thresholds, and building a tailored risk management plan. Check whether you can choose the right first step when those pieces are missing.

Take the PMI-RMP practice test Check your PMI-RMP readiness

Keep going