Advanced Risk Management: Secondary and Residual Risks on the PMP Exam

Beyond Basic Risk Identification

Most PMP candidates feel comfortable with the fundamentals of risk management: identify risks, perform qualitative and quantitative analysis, plan responses, and monitor risks. But the PMP exam goes deeper. It tests your understanding of the risks that emerge from risk responses, the risks that remain after risk responses, and the advanced strategies needed to manage them. This is where many candidates stumble.

Secondary Risks Explained

A secondary risk is a new risk that arises as a direct result of implementing a risk response. It does not exist independently of the response action. If the response were not implemented, the secondary risk would not exist.

Example

Your project faces the risk of a key team member leaving mid-project. You respond by cross-training a backup team member. The secondary risk? The cross-training takes time away from current deliverables, potentially causing a schedule delay. The cross-training itself created a new risk that did not previously exist.

Secondary risks must be identified, analyzed, and managed just like primary risks. They need their own risk responses, which could in turn generate additional secondary risks. This cascading nature makes thorough risk analysis essential.

How the PMP Exam Tests Secondary Risks

Expect questions structured as: "After implementing a risk response, a new risk has emerged. What type of risk is this?" The answer is secondary risk. Also expect scenario questions where you must identify the secondary risk in a described situation and determine the appropriate next step, which is typically to analyze the secondary risk and plan a response for it.

Residual Risks Explained

A residual risk is the risk that remains after a risk response has been implemented. No risk response eliminates risk entirely (except avoidance, which eliminates the specific risk by changing the project plan). Every other response strategy leaves some residual exposure.

Example

Your project faces the risk of software defects in a critical module. You respond by adding code reviews and additional testing. After implementing these responses, some residual risk of defects remains because no amount of testing catches every defect. That remaining exposure is residual risk.

Managing Residual Risks

Residual risks are documented and communicated to stakeholders. They are typically managed through:

• Contingency reserves: Time and cost buffers allocated specifically to address residual risks if they materialize
• Workarounds: Unplanned responses implemented when residual risks actually occur
• Acceptance: Explicit acknowledgment that some level of risk will persist, documented in the risk register

The Relationship Between Secondary and Residual Risks

These two concepts are often confused, but they are distinct:

1. Secondary risks are new risks caused by a risk response
2. Residual risks are remaining risks after a risk response is applied to an existing risk

Both exist because of risk responses, but they differ in origin. Secondary risks are entirely new. Residual risks are the leftover portion of an original risk. The PMP exam tests whether you can distinguish between them in scenario questions.

Advanced Risk Response Strategies

Risk Response Strategies for Threats

Beyond the basic strategies of avoid, mitigate, transfer, and accept, advanced risk management involves:

• Escalate: When a risk falls outside the project's scope or authority, escalate it to the program, portfolio, or organizational level. This is a relatively recent addition to PMI's framework and is tested on the current PMP exam.
• Combination responses: Applying multiple strategies to a single risk. For example, mitigating a risk to reduce its probability while also transferring some financial impact through insurance.

Risk Response Strategies for Opportunities

Opportunities have parallel strategies: exploit, enhance, share, accept, and escalate. The exam tests whether you can match the correct strategy to the scenario, especially for opportunities, which candidates often study less thoroughly than threats.

Contingency Reserves vs. Management Reserves

This distinction frequently appears on the PMP exam:

• Contingency reserves are allocated for identified risks (known unknowns). The project manager controls these reserves and uses them when identified risks materialize.
• Management reserves are allocated for unidentified risks (unknown unknowns). These are controlled by management and require a formal process to access.

When a residual risk materializes, the project manager draws from contingency reserves. When something completely unexpected happens, management reserves are the backstop.

Exam Preparation Strategy

Risk management questions on the PMP exam are among the most nuanced. They reward candidates who understand the interconnected nature of risks, responses, and the new risks that responses create. Build your confidence by working through layered risk scenarios in the PMPprep practice exam simulator and reviewing the risk management cheat sheets for quick-reference formulas and definitions.

Pay special attention to questions that present a chain of events: risk identified, response implemented, new issue emerged. Your job is to classify the new issue correctly and determine the appropriate next action within the risk management process.