Risk management questions check how you spot, size and respond to project risks before they become problems.
Below are 60 Risk Management questions with the correct answer and a short explanation, grouped from fresher to experienced level. Try each one before you open the answer.
A company buys a cyber insurance policy that pays for ransomware recovery costs. Which risk treatment is this?
Answer: A. Transfer
Risk transfer shifts the financial impact to another party, such as an insurer or a contractor. The attack can still happen, so the company still needs controls. Avoidance would mean stopping the risky activity altogether.
Which is an example of a positive risk (opportunity) on a project?
Answer: C. A supplier may offer a 10% bulk discount
Opportunities are uncertain events that would help objectives if they happened, such as a cost saving. The other options are threats.
Which set of fields belongs in a basic risk register?
Answer: B. Description, probability, impact, owner, response
A risk register records each risk, its assessment, who owns it and the planned response, plus status. The other sets describe a schedule, a traceability matrix and a stakeholder register.
A risk has a 20% chance of causing a ₹10 lakh loss. What is its expected monetary value (EMV)?
Answer: D. −₹2 lakh
EMV = probability × impact = 0.2 × ₹10 lakh = ₹2 lakh, shown as negative because it is a threat. EMV helps compare risks and size reserves, though no single outcome equals it.
A new, untested payment library may crash at launch. The team switches to a proven library already used in production. Which response is this?
Answer: B. Avoid
Avoiding removes the threat or protects the project from its impact entirely, often by changing the plan. Switching libraries eliminates the specific risk rather than reducing it.
A team draws a diagram with "late delivery" at the head and branches for people, process, tools and suppliers. What is it?
Answer: D. A fishbone diagram
The Ishikawa or fishbone diagram groups possible causes of an effect into categories. It helps teams find risk causes in a structured way.
On a construction site in Dubai, what is the difference between a hazard and a risk?
Answer: B. A hazard can cause harm; risk is its likelihood and severity
A hazard is a source of potential harm, like working at height. Risk combines how likely harm is and how bad it would be, which is what controls aim to reduce.
In a SWOT analysis used for risk identification, which quadrants mainly point to threats?
Answer: C. Weaknesses and threats
Internal weaknesses and external threats suggest negative risks. Strengths and opportunities can point to positive risks the project could exploit.
How does multi-factor authentication (MFA) mainly change account takeover risk?
Answer: D. It lowers the likelihood that a stolen password works
With MFA, a stolen password alone is not enough to log in, so the chance of takeover falls sharply. It is a preventive control; impact if an attacker does get in stays similar.
A two-year fixed-price service contract in India may be hit if the GST rate on the service changes. What type of risk is this?
Answer: A. Regulatory risk
Changes in tax law are external regulatory risks. Contracts often handle them with a clause saying taxes are charged at the rate in force on the invoice date.
Why does delivering a product in small increments usually lower project risk?
Answer: B. Problems surface early, while they are cheap to fix
Each increment gets real feedback and tests real assumptions. Mistakes are found after weeks, not at the end of a long project, which limits the damage.
An Indian importer must pay €50,000 in six months and fears the rupee will weaken. Which tool fixes the rate now?
Answer: A. A forward contract with a bank
A forward contract locks in an exchange rate for a future date, removing uncertainty about the rupee cost. It gives up any gain if the rupee strengthens.
The UAE introduced a federal corporate tax of 9% on taxable profits above AED 375,000 for financial years from June 2023. For a company's five-year plan made in 2020, what risk type did this represent?
Answer: A. Regulatory risk
Changes in tax and other laws are regulatory risks from the external environment. Plans should watch for announced changes and model their effect on profits and pricing.
The risk register has not changed in three months, although the project has moved through design and build. What does this suggest?
Answer: A. Risks are not being actively managed
Risks change as a project moves through phases. A register that never changes is a sign it has become a formality instead of a working tool.
A threat could cost ₹50,000 if it happens. The only response would cost ₹3 lakh. What is usually best?
Answer: A. Accept it and monitor
When a response costs more than the possible loss, acceptance is usually wiser. The risk is still recorded and watched in case it grows.
How does enterprise risk management (ERM) differ from project risk management?
Answer: D. ERM covers risks to the whole organisation's goals
ERM looks at risks across the organisation, such as strategic, financial and operational ones. Project risk management focuses on one project's objectives but should feed into ERM when risks are large.
An e-commerce company stops all non-urgent releases in the two weeks before its big Diwali sale. Why?
Answer: A. To cut the chance of outages at peak traffic
During peak periods, an outage costs the most. A change freeze reduces the number of changes, and so the chance of a failure, when the impact would be highest.
A team runs its app in two cloud availability zones instead of one. Which risk does this mainly address?
Answer: C. An outage of a single data centre
Availability zones are separate data centres. Running in more than one means a failure in one zone does not take the whole service down, though it does not protect against code bugs.
What is the main goal of a weekly CS risk review meeting?
Answer: A. Agree actions and owners for the accounts most at risk
A short, regular review keeps at-risk accounts moving: what changed, what is the plan, who owns it and whether help from other teams is needed. Without it, risks sit in a list with no action.
What is the main output of a fraud risk assessment for a business process?
Answer: C. A list of ways fraud could happen, rated, and mapped to controls that address them
A fraud risk assessment identifies schemes and scenarios, rates their likelihood and impact, and checks whether existing controls address them. Gaps lead to new controls or monitoring. It is about schemes, not about labelling individual people.
There is a risk that your hardware supplier will deliver late. You arrange a second supplier who can deliver part of the order if needed. Which risk response is this?
Answer: B. Mitigate
Mitigation reduces the probability or impact of a risk; a backup supplier reduces the impact of a delay. Avoiding would remove the risk entirely, for example by changing the design. Transferring moves the impact to someone else, such as through insurance or contract penalties.
What is the difference between risk appetite and risk tolerance?
Answer: A. Appetite is the broad level accepted; tolerance is the acceptable variation
Risk appetite is the amount and type of risk an organisation is willing to pursue for its goals. Tolerance sets measurable limits around a specific objective, such as "no more than 10% over budget".
Which is the best-written risk statement?
Answer: A. As the API vendor is a startup, it may fold, forcing a rebuild
A cause-risk-effect statement names the fact (cause), the uncertain event (risk) and the impact on objectives (effect). This makes it possible to assess and respond to it precisely.
When should a team move from qualitative to quantitative risk analysis?
Answer: C. For top risks or overall outcomes on big projects
Qualitative analysis ranks all risks quickly. Quantitative analysis, such as Monte Carlo simulation, costs more and is used for top risks or overall project uncertainty where the decision justifies the effort.
In an FMEA, a failure mode has severity 8, occurrence 4 and detection 5. What is its risk priority number (RPN)?
Answer: D. 160
RPN = severity × occurrence × detection = 8 × 4 × 5 = 160. Higher RPNs get attention first, though many teams also check high-severity items regardless of RPN.
Two risks have the same score. One could happen next week; the other only in six months. How should this affect priority?
Answer: B. The nearer one usually needs action first
Proximity (or urgency) shows how soon a risk may occur or how soon a response must start. Near-term risks get attention first, while later ones are tracked.
A Monte Carlo cost S-curve shows ₹4.2 crore at P50 and ₹4.8 crore at P80. The base estimate is ₹4.0 crore. To fund at P80, how much contingency is needed?
Answer: B. ₹0.8 crore
Funding at P80 means a budget of ₹4.8 crore. Against a base of ₹4.0 crore, contingency is ₹0.8 crore. P50 would need only ₹0.2 crore but fails half the time.
What does a risk audit check?
Answer: C. Whether the risk process is followed and works
A risk audit reviews how well the risk management process is applied and whether responses are effective. It may be done by the PMO or an independent reviewer.
What is the difference between a business continuity plan (BCP) and a disaster recovery (DR) plan?
Answer: C. BCP keeps the business running; DR restores IT systems
A BCP covers how critical business functions continue during a disruption, including people, sites and suppliers. DR is a part of it focused on restoring technology and data.
How does a key risk indicator (KRI) differ from a KPI?
Answer: B. A KRI warns of rising risk; a KPI tracks performance
KRIs are early warning metrics, such as staff turnover or overdue patches, that signal growing exposure. KPIs measure how well objectives are being met.
In a risk workshop, the director says first, "This risk is maybe 10%." Everyone then rates it 10–15%. What should the facilitator have done?
Answer: B. Collected individual ratings before any discussion
The first number heard anchors later estimates, especially from a senior person. Silent individual estimates, then discussion of differences, reduce anchoring.
After a recent fire in a nearby building, the team rates fire as the top risk and ignores slow data corruption. Which bias is this?
Answer: B. Availability bias
Availability bias makes vivid or recent events feel more likely. Teams counter it by using data and structured scales rather than gut feel.
You ask an engineer for a three-point estimate. They give "about 10 days" and then tight bounds of 9 and 11. What elicitation practice helps get a more honest range?
Answer: C. Ask for the extremes first, then the likely value
Starting with the most likely value anchors the bounds close to it, so ranges come out too narrow. Asking first "What is the worst case? The best?" and then the most likely value widens ranges to reflect real uncertainty.
At SAFe PI Planning, risks are "ROAMed". What does ROAM stand for?
Answer: D. Resolved, Owned, Accepted, Mitigated
Each program risk is placed into one of four groups: Resolved (no longer a concern), Owned (someone takes it), Accepted (nothing more can be done) or Mitigated (a plan exists). This makes risk handling visible to the whole train.
How does an agile team build a risk-adjusted backlog?
Answer: D. Add risk responses as backlog items, ordered with features
Risk responses such as spikes or extra tests become backlog items. Ordering them alongside features, often early, reduces uncertainty before too much is built on it.
A team builds heavily on one cloud provider's proprietary services. What is the main risk, and a typical mitigation?
Answer: B. Lock-in; use open standards and plan an exit
Lock-in makes switching costly if prices rise or service declines. Using portable technologies where it matters, and planning an exit strategy, keeps options open.
A three-year construction contract in India includes a price variation clause linked to a cement price index. What risk does this address?
Answer: C. Input cost inflation over the contract
A price variation or escalation clause adjusts the contract price when a named index moves. It shares inflation risk instead of leaving it all with the contractor.
Under the Basel framework, what is operational risk?
Answer: A. Loss from failed processes, people, systems or external events
Basel defines operational risk as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but not strategic or reputational risk.
How should risks be presented to a busy executive committee?
Answer: B. Top few risks, with trend, owner and ask
Executives need focus: the most significant risks, whether they are rising or falling, who owns them and what is needed from leaders. Full detail stays available for those who want it.
In a fraud risk workshop for the payroll process, which question is most useful?
Answer: A. How could someone in this role add, change or inflate pay and hide it?
Good fraud risk assessments think through specific schemes: what could be done, by whom, using what access, and how it would be concealed. That leads straight to testing whether controls would stop or detect each scenario. Targeting individuals by rating or tenure is not a risk assessment.
Launch is tomorrow. QA finds a bug affecting about 2% of users in an edge case, with an easy workaround and no data loss or security risk. Marketing is ready. What do you do?
Answer: A. Assess the risk, launch behind a feature flag with monitoring, share the known issue and workaround with support, and schedule the fix
Not every bug is a launch blocker. When severity is low and a workaround exists, launching with monitoring, support briefing and a planned fix balances quality and business needs. Data loss, security or payment bugs would be a different decision.
Your critical path is 60 days. A second path is 58 days long and full of uncertain tasks. What is the best way to manage it?
Answer: B. Manage the near-critical path closely too, because a small slip makes it critical, and use schedule risk analysis to see the real chance of finishing on time
With only 2 days of float and high uncertainty, the second path may well become the one that decides the end date. Focusing only on today's critical path gives false comfort. Monte Carlo or similar analysis shows how often each path ends up driving the finish.
Buying a tool costs a certain $120,000. Building it costs $80,000 with a 70% chance, but a 30% chance of overruns bringing the total to $180,000. Based on expected monetary value, what should you choose?
Answer: B. Build, with an expected cost of $110,000
Expected cost of building = 0.7 x 80,000 + 0.3 x 180,000 = 56,000 + 54,000 = 110,000, which is lower than 120,000 for buying. EMV favours building. In practice, a risk-averse organisation might still buy to avoid the 30% chance of a $180,000 outcome, so state that trade-off.
To avoid a vendor delay you bring the work in-house, but this creates a new risk that your team lacks experience. What is this new risk called?
Answer: C. A secondary risk
A secondary risk is caused directly by carrying out a risk response. A residual risk is what remains of the original risk after the response. Both should be recorded in the risk register with their own owners.
After compression, a schedule has four parallel critical paths of equal length. How does this affect the chance of finishing on time?
Answer: C. It falls, because a delay on any one path delays the end
With one critical path, only that chain has to go well. With four, all four must finish on time, so the joint probability of hitting the date is lower. Compression that creates many critical paths adds risk even when the date looks the same.
A path has a PERT mean of 40 days and a standard deviation of 4 days. Assuming a normal distribution, roughly what is the chance of finishing within 44 days?
Answer: D. About 84%
44 days is one standard deviation above the mean. About 50% of outcomes are below the mean and about 34% lie between the mean and +1σ, so roughly 84% finish within 44 days. The 68% figure is for the range mean ± 1σ.
Two activities in series have PERT standard deviations of 3 days and 4 days. Treating them as independent, what is the standard deviation of the path?
Answer: B. 5 days
Variances add, not standard deviations. Path variance = 3² + 4² = 9 + 16 = 25, so path σ = √25 = 5 days. Adding the σ values directly (7 days) overstates the spread.
The base cost estimate is ₹5.0 crore. A Monte Carlo cost model gives P50 = ₹5.4 crore and P80 = ₹5.9 crore. The sponsor wants 80% confidence. How much contingency should be added to the base?
Answer: D. ₹0.9 crore
To fund the project at P80, the budget should be ₹5.9 crore. Contingency = P80 − base = ₹5.9 crore − ₹5.0 crore = ₹0.9 crore. The P50 − base gap (₹0.4 crore) would give only about even odds.
A threat has a 40% chance of a ₹50 lakh loss. A mitigation costs ₹6 lakh and cuts the chance to 10%. What is the net benefit of mitigating?
Answer: D. ₹9 lakh
EMV before = 0.4 × 50 = ₹20 lakh; after = 0.1 × 50 = ₹5 lakh. Risk reduction is ₹15 lakh, minus the ₹6 lakh cost gives a net benefit of ₹9 lakh, so the mitigation pays off.
In the IIA Three Lines Model, who provides the "third line" role?
Answer: D. Internal audit, giving independent assurance
First-line roles own and manage risk in daily operations; second-line roles such as risk and compliance give expertise and challenge; internal audit is the third line, giving independent assurance to the governing body.
Leadership asks how to manage rare, extreme events nobody can predict, like a pandemic. What is the most useful approach?
Answer: B. Build resilience, such as buffers and flexible plans
Black swans are by nature hard to forecast. Rather than predicting them, organisations build resilience: spare capacity, diversified suppliers, tested continuity plans and the ability to adapt fast.
Team members who report risks in a company are often blamed for "being negative", and fewer risks are now raised. What is the biggest danger?
Answer: A. Risks stay hidden until they become costly issues
When raising risks is punished, people stay silent, so the organisation loses early warning. Leaders should thank those who raise risks and treat transparency as a strength.
A programme plots total risk exposure (sum of EMVs) each month. It falls from ₹2 crore to ₹1.2 crore, then rises to ₹1.6 crore. What does the rise most likely mean?
Answer: C. New risks were found or existing ones grew
A risk burndown tracks how exposure falls as risks are retired. A rise shows new or growing risks, which leaders should look into, for example a new dependency or a supplier problem.
Your payroll vendor hosts its system on a cloud provider you have no contract with. What is this exposure called?
Answer: C. Fourth-party risk
Fourth parties are your vendors' vendors. You depend on them but have no direct control, so due diligence should ask how the vendor manages its own suppliers.
A programme has 60 small risks, each rated "low", all tied to one overloaded vendor. What does looking at them only one by one miss?
Answer: A. Their combined effect from a common cause may be high
Risks that share a cause can happen together and add up. Grouping risks by root cause or source reveals concentrations that single ratings hide, and a single response can address many of them.
The risk "the regulator may change licensing rules" is assigned to a junior analyst as owner. What is the main problem?
Answer: B. They lack the authority to manage the risk
A risk owner must have enough authority and resources to make sure responses happen, here likely a compliance head. An analyst may help with monitoring as an action owner.
At 25% complete, a project's cost performance index (CPI) is 0.85. What does research on earned value suggest?
Answer: B. CPI rarely improves much, so expect an overrun
Studies of many projects found CPI tends to stabilise early and rarely improves much after about 20% complete. A CPI of 0.85 is an early warning that the budget will likely be exceeded unless something changes.
A fire would cost a small factory ₹2 crore with a 0.5% yearly chance (EMV ₹1 lakh). Insurance costs ₹1.5 lakh a year. Why might buying it still be wise?
Answer: B. A ₹2 crore loss could ruin the firm
Expected value ignores the firm's ability to survive a loss. Paying a premium above EMV is rational when the loss would be ruinous, which is why risk-averse businesses insure.
A team adds approvals, reviews and sign-offs for every small change to avoid any risk. Release time grows from 2 days to 3 weeks. What is the main lesson?
Answer: C. Controls have costs; match them to the risk level
Excess control can create new risks, such as slow fixes and lost market chances. Proportionate controls, stronger for high-risk changes and lighter for small ones, balance safety and speed.
After all planned responses, a risk's residual level is still above the organisation's appetite. What should happen?
Answer: C. Escalate for a decision: act more, accept formally, or change
If residual risk exceeds appetite, someone with the right authority must decide whether to invest in more responses, change the plan, or formally accept the exposure. It should not be left silently.
Take a 15-question Risk Management MCQ test with a score at the end, or practise the full Risk Management question bank and earn points on the leaderboard.
