Memory hook: Risk may happen; issue has happened; change needs authority.
Must remember
Governance defines decision rights, reporting, escalation and acceptable conduct. Establish success criteria and tolerances early. Follow legal, contractual, safety, privacy and sustainability obligations; an aggressive schedule does not authorize ignoring them. Seek the appropriate specialist where interpretation is required.
Assess a proposed change’s impact on scope, schedule, cost, quality, risk and benefits before the authorized decision. Predictive baselines usually use formal integrated change control. Adaptive backlog reprioritization operates within agreed funding, scope boundaries and product authority; it does not bypass compliance or every contract constraint. Implement approved changes and update affected artifacts.
A risk is an uncertain condition with potential effect; an issue already requires attention. Identify threats/opportunities, assess probability and impact, assign an owner and plan responses. Threat strategies include avoid, mitigate, transfer, accept or escalate. Opportunities may be exploited, enhanced, shared, accepted or escalated. Transfer does not eliminate accountability or all residual risk.
Track triggers, residual risks and secondary risks introduced by a response. Qualitative analysis prioritizes; quantitative analysis models numerical effects where useful. EMV = probability × financial impact, with sign conventions stated. When a risk occurs, activate the planned response and manage the resulting issue. Reassess rather than leaving the register frozen after kickoff.
AI tools may assist analysis and reporting, but protect sensitive inputs, check source evidence and retain human accountability. Generated forecasts or status narratives are not verified project facts.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Sponsor requests extra functionality | Assess impact and use the authorized change route. |
| Vendor failure is only a possibility | Risk with owner and response. |
| Vendor has already failed | Issue management and any triggered contingency. |
Traps
- A risk register is not an issue log.
- Transferring a risk does not mean it no longer needs monitoring.
Active recall
1. Residual versus secondary risk?
Risk remaining after a response versus new risk caused by the response.
2. What is EMV for 20% probability of a $10,000 loss?
An expected loss of $2,000, not a guaranteed actual loss.
3. Why define change authority?
To avoid unauthorized commitments and inconsistent baselines.
4. What happens when a risk occurs?
Execute relevant response and manage its realized impact as an issue.
5. Who is accountable for AI-assisted decisions?
The responsible people and governance structure, not the tool.