When a risk has materialized and become an issue despite preventive actions, the next logical step is to implement the pre-established risk response plan. This plan is designed specifically to address the risk if it occurs, ensuring that the project can quickly and effectively manage the issue. According to PMI ' s risk management guidelines, implementing the risk response plan is a critical step once a risk has been triggered, as it provides a structured approach to resolving the issue with minimal impact on the project​.

Assumptions made during planning need to be reviewed to understand deviations in actual results. PMBOK® Guide states:

" Reviewing project assumptions is key to understanding variances between planned and actual performance, as invalid or changed assumptions often cause project deviations. "

— PMBOK® Guide, 6th Edition, Section 11.2

Risk impact assessment involves calculating the impact of identified risks. Risk analysis is the process of examining, estimating, and evaluating the impact of risks, which helps in calculating the impact (Reference: PMBOK Guide, 6th Edition, p. 417)

Risk analysis is the process of assessing the likelihood and impact of the identified risks on the program objectives. It helps to calculate the impact of the risks by using qualitative or quantitative methods. Risk analysis can provide useful information for risk prioritization, risk response planning, and risk reporting. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 67; PMI, The Standard for Program Management, Fourth Edition, 2017, p. 113.

According to the PMBOK Guide, 6th edition, Section 11.4.3.1, Risk Thresholds, risk thresholds are the level of risk exposure above which risks are addressed and below which risks may be accepted. Risk thresholds are determined by the organization’s risk appetite, which is the degree of uncertainty that an organization is willing to accept in pursuit of its goals. Therefore, when the project manager is informed by the risk owner that the exposure from two high-impact risks are hitting the risk thresholds, the project manager should complete an assessment and confirm the response with the sponsors, who are the key stakeholders for the project and have a low risk appetite. The project manager should not update the project management plan, perform an assumptions and constraints analysis, or implement mitigation measures without first consulting with the sponsors and obtaining their approval. References: PMBOK Guide, 6th edition, Section 11.4.3.1, Risk Thresholds

 A SWOT analysis is a risk identification technique that helps to identify high-level and strategic project risks by examining the internal and external factors that may affect the project objectives. A SWOT analysis involves listing the strengths, weaknesses, opportunities, and threats of the project, and then analyzing how they may impact the project positively or negatively. A SWOT analysis can help to uncover potential risks that may not be obvious from other techniques, such as prompt lists, interviews, or brainstorming12

 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 10 2: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Seventh Edition, page 11.2.2.1

The correct answer is C. Implement the risk response plan.

This scenario clearly states that the subcontractor delay risk was already identified and planned for during the project planning phase . That means the risk has already gone through the appropriate risk management steps: identification, assessment, and response planning. Since the risk is now showing signs of increasing likelihood, the most appropriate action is to execute the preplanned response .

In standard project risk management practice, once a known risk begins to materialize or its probability increases to a trigger level, the risk manager should apply the agreed response actions rather than starting over with unnecessary escalation or emergency action. The sponsor’s statement also supports this, because it confirms that the issue is a known risk and will be handled according to plan.

Why the other options are incorrect:

A. Call an emergency meeting This is not the best first action because the risk is not new or unexpected. It was already identified and planned for. Emergency meetings are more appropriate for sudden, unplanned, or crisis-level issues requiring immediate coordination outside normal response procedures.

B. Reinforce the customer relationship Stakeholder communication is important, but it does not directly address the risk event itself. The main responsibility here is to take the planned risk action, not merely reassure the customer.

D. Escalate risk to the owner Escalation is appropriate when a risk is beyond the authority, threshold, or control capacity of the project team or designated risk owner. In this case, the risk is already known and presumably assigned and planned, so escalation is not the primary next step unless the response plan specifically requires it.

Best-practice reasoning:

A previously identified risk with an approved treatment plan should be managed through the implemented response strategy once warning signs or trigger conditions appear. This reflects disciplined risk management and shows that risk planning is being used as intended.

Reference-aligned basis:

This answer is consistent with standard project risk management guidance that emphasizes:

identified risks should have planned responses,

response plans should be executed when risk triggers occur or probability/impact increases,

escalation is used only when a risk exceeds assigned authority or thresholds.

In a company undergoing significant cultural and organizational change, it ' s essential for the risk manager to engage with the appropriate stakeholders when planning risk management activities. Leveraging the project manager ' s stakeholder analysis provides a comprehensive understanding of individuals and groups affected by or capable of influencing the project. This analysis identifies stakeholders ' interests, influence, and potential impact on project success, enabling the risk manager to tailor risk management activities effectively. Collaborating with the project manager ensures alignment in stakeholder engagement strategies, fostering a cohesive approach to managing risks associated with organizational changes.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Preparation Study Guide emphasizes the importance of stakeholder analysis in risk management, highlighting how understanding stakeholder interests and influences is crucial for effective risk planning and response.

When stakeholders express concerns about financial risks, the risk manager ' s first step should be to gather and reconcile project risk report data. This involves reviewing the existing risk data, ensuring that it is accurate, up-to-date, and reflects the current status of the project. By reconciling this data, the risk manager can provide stakeholders with a clear and evidence-based picture of the project ' s risk profile, demonstrating that the risks are within a tolerable threshold.

This approach aligns with PMI’s risk management processes, which emphasize the importance of accurate and transparent reporting to manage stakeholder expectations and concerns effectively​​.

The Delphi technique is a structured communication process designed to build consensus among a group of experts and stakeholders when opinions differ and a quantitative assessment is needed. It uses rounds of anonymous input and feedback, allowing experts to refine their views based on others ' anonymous contributions. This approach is especially useful when stakeholders are in disagreement and objective quantification of risk is required.

PMBOK® Guide Extract:

“The Delphi technique is a way to reach a consensus of experts. Project risk experts participate in this technique anonymously. A facilitator uses a questionnaire to solicit ideas about the important project risks. The responses are summarized and recirculated to the experts for further comment. Consensus may be reached in a few rounds of this process. The Delphi technique helps reduce bias in the data and keeps any one person from having undue influence on the outcome.”

— PMBOK® Guide, 6th Edition, Section 11.2.2.4

ISO 31000 Reference:

“Facilitated workshops and expert elicitation techniques, such as the Delphi method, can help achieve an objective and consensus-based understanding of complex risks.”

— ISO 31000:2018, Section 6.4.2

In this scenario, since the stakeholders are in disagreement and the project involves complex, location-specific disaster recovery requirements, the Delphi technique (Option D) is the officially recommended approach to achieving consensus and quantifying risk.

The project manager should add the assumptions and constraints to the assumption log to track and analyze their impact on the project. The assumption log is a project document that records all project assumptions and constraints throughout the project life cycle. (Reference: PMBOK Guide, 6th Edition, p. 89)

The project manager should add the assumptions and constraints to the assumption log, which is a project document that records the assumptions and constraints that affect the project scope, schedule, cost, and quality. The assumption log can help the project manager to identify and analyze the risks that may arise from the validity of the assumptions and the impact of the constraints. The assumption log can also be used as an input for the Identify Risks process, where the project manager can determine the risk impact of the assumptions and constraints and add them to the risk register accordingly. References: PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Sixth Edition, 2017, p. 38, 397.