Risk, Quality & Procurement
These three knowledge areas operate across the entire project lifecycle. Risk management is proactive — identifying and responding to uncertainty before it impacts the project. Quality focuses on delivering what was promised. Procurement governs external work and supplier relationships.
Exam Weight: Risk, quality, and procurement questions appear throughout all three PMP domains (People, Process, Business Environment). Risk questions alone account for a significant portion — especially scenario-based questions about which response strategy is most appropriate in a given situation.
Risk = uncertainty that matters. Threats have negative impact; opportunities have positive impact. Both require active management. EMV = Probability × Impact. Contingency reserve covers identified risks; management reserve covers the unknown unknowns.
Quality = conformance to requirements. Cost of Quality separates prevention/appraisal (conformance) from failure costs (non-conformance). QA improves processes; QC inspects deliverables. The 7 quality tools provide the analytical backbone.
Procurement = structured buying. Contract type selection determines who bears financial risk. Fixed Price = seller's risk. Cost Reimbursable = buyer's risk. T&M is the hybrid. Make-or-buy analysis precedes any procurement decision.
| Type | Strategy | Description | Example |
|---|---|---|---|
| Threats | Avoid | Eliminate the threat by changing the plan | Drop a risky feature from scope |
| Transfer | Shift impact to a third party (cost still exists) | Purchase insurance; use fixed-price contract | |
| Mitigate | Reduce probability or impact below threshold | Add redundant systems; prototype early | |
| Accept | Acknowledge and deal with it if it occurs (active = contingency plan; passive = log and monitor) | Small-impact risk; no cost-effective response | |
| Opportunities | Exploit | Ensure the opportunity definitely occurs | Assign best team to guarantee early delivery |
| Share | Partner with another party to capture the opportunity | Joint venture to access a new market | |
| Enhance | Increase probability or positive impact | Add resources to accelerate a promising feature | |
| Accept | Take advantage if it occurs, but don't actively pursue | Minor benefit; not worth special investment |
Risk Management
Effective risk management is proactive, not reactive. The risk management process flows from planning through identification, analysis (qualitative then quantitative), response planning, and monitoring throughout the project.
The Risk Register is the primary risk management artifact. It is created during risk identification and updated continuously throughout the project.
| Field | Description |
|---|---|
| Risk ID | Unique identifier (e.g., R-001) |
| Risk Description | "If [cause], then [risk event] may occur, resulting in [impact]" |
| Category | Technical, schedule, cost, external, organizational |
| Probability | Likelihood of occurrence (0–1 or %) |
| Impact | Effect on objectives if it occurs ($, days, quality) |
| Risk Score | Probability × Impact (for prioritization) |
| Response Strategy | Avoid / Transfer / Mitigate / Accept (or Exploit / Share / Enhance) |
| Risk Owner | Person responsible for monitoring and responding |
| Residual Risk | Risk remaining after response is implemented |
| Secondary Risk | New risk created by implementing the response |
Residual vs Secondary Risk: Residual risk is what remains after a response — the response wasn't 100% effective. Secondary risk is a brand-new risk created by the response itself. For example, hiring a new vendor to mitigate one vendor's delay (primary response) creates a new integration risk with the replacement vendor (secondary risk).
Brainstorming: Open team session; widely used. Produces large list, needs prioritization.
Delphi Technique: Anonymous expert consensus through iterative rounds. Removes groupthink bias. Time-consuming but high-quality.
SWOT Analysis: Strengths/Weaknesses (internal) + Opportunities/Threats (external). Ensures both opportunities and threats are captured.
Assumption and Constraint Analysis: Challenges each planning assumption — what if it's wrong?
Qualitative risk analysis quickly prioritizes risks using expert judgment — no detailed quantitative data needed. Each risk gets a probability rating and an impact rating; the product determines the risk score and zone.
↑ Probability · → Impact · ■ Critical ■ High ■ Medium ■ Low
Expected Monetary Value (EMV) quantifies the financial impact of a risk by weighting its outcome by its probability.
Decision Tree Example — Build vs Buy
Monte Carlo Simulation runs thousands of iterations of the project schedule or budget, randomly sampling each activity's duration or cost from a probability distribution. The output is a probability distribution of possible project end dates or total costs.
Key outputs: S-curve showing probability of completing by a given date or within a given cost; P80 date (80% confidence of meeting that date); sensitivity analysis (tornado diagram) identifying which activities have the most impact on schedule/cost uncertainty.
When to use: Large, complex projects where qualitative analysis is insufficient for management decisions — especially for determining contingency reserve amounts.
Exam Tip: Monte Carlo is the only quantitative technique that produces a probability distribution of outcomes. EMV produces a single point estimate. Know when each is used.
Escalate: A ninth strategy for both threats and opportunities that are outside the PM's authority or scope — escalate to program manager, portfolio manager, or sponsor.
Quality Management
Quality management ensures the project delivers what it promised — on the first attempt, not through rework. Prevention over inspection is the guiding principle: it is always cheaper to build quality in than to find and fix defects later.
Cost of Quality captures all costs incurred to achieve (or fail to achieve) quality. Every project has CoQ — the question is whether you spend it on prevention upfront or pay much more in failures later.
- Prevention costs — training, process documentation, equipment maintenance, quality planning
- Appraisal costs — testing, inspections, audits, peer reviews, destructive testing
- Internal failure — rework, scrap, re-testing, schedule delay (found before delivery)
- External failure — warranty claims, liability, lost customers, recalls (found after delivery)
Key principle: Investing more in prevention reduces total CoQ. External failure costs are the most expensive — they include reputational damage and customer loss on top of the direct fix cost. Prevention is always cheaper than appraisal, which is always cheaper than failure.
Control charts distinguish between common cause variation (inherent to the process — expected, normal) and special cause variation (assignable cause — something specific changed — requires investigation).
Control limits (UCL/LCL) are set at ±3 standard deviations from the mean. They are not specification limits (customer requirements) — they are statistically derived from the process itself.
Rule of Seven (7-point rule): Even if all points are within control limits, seven consecutive data points trending in one direction OR on the same side of the mean indicates a non-random pattern — the process is considered out of control and must be investigated.
| Signal | Meaning | Action |
|---|---|---|
| Point above UCL | Out of control (special cause) | Stop; investigate immediately |
| Point below LCL | Out of control (special cause) | Stop; investigate immediately |
| 7 consecutive points one side of mean | Non-random pattern (out of control) | Investigate root cause |
| 7 consecutive points trending up/down | Non-random trend | Investigate root cause |
| Points within control limits, random | In control (common cause only) | No action required |
| Points outside specification limits | Defective (may still be in control) | Address customer requirement |
| Dimension | Manage Quality (QA) | Control Quality (QC) |
|---|---|---|
| Focus | Process improvement — are we using the right processes? | Product inspection — does the deliverable meet requirements? |
| When | Throughout the project (ongoing) | When deliverables are produced |
| Tools | Process audits, quality audits, benchmarking, root cause analysis | Inspections, testing, statistical sampling, control charts |
| Output | Change requests, process improvements, updated plans | Verified deliverables, defect reports, test results |
| Sequence | Happens throughout execution | Typically before Scope Validation |
| Analogy | Reviewing the recipe while cooking | Tasting the dish when it's done |
Procurement Management
Procurement management governs how the project acquires goods and services from outside the organization. The most exam-critical skill is knowing which contract type is appropriate — and who bears the financial risk under each.
Risk Rule of Thumb: Fixed Price = seller bears cost overrun risk. Cost Reimbursable = buyer bears cost overrun risk. T&M = buyer bears risk of scope growth (but NTE clause limits exposure). When scope is well-defined → FFP. When scope is uncertain → Cost Reimbursable. Short-term staff → T&M.
| Document | Used When | Seller Responds With |
|---|---|---|
| RFP — Request for Proposal | Scope complex / not fully defined; buyer evaluates approach + price | Proposal (technical approach + price + team) |
| RFQ — Request for Quotation | Scope well-defined; buyer primarily evaluating price | Quotation (price only) |
| RFI — Request for Information | Early market research; not yet soliciting bids | Capability information (no binding offer) |
| IFB — Invitation for Bid | Construction / government; scope fully defined; lowest price wins | Sealed bid (price only) |
| SOW — Statement of Work | Included in all procurement documents | Describes the work the seller must perform |
Before any procurement, the PM performs a make-or-buy analysis to determine whether work should be done internally or outsourced. This is the first step in the Plan Procurement Management process.
Factors favouring Make (in-house): idle internal capacity; proprietary technology; need for direct control; cost savings; confidentiality concerns.
Factors favouring Buy (outsource): specialized expertise not available internally; capacity constraints; risk transfer possible; one-time need not worth building internal capability; cost competitive.
Lease vs Buy decision: When equipment is needed, lease if the need is short-term or the lease cost per period × number of periods < purchase price. Buy if long-term need justifies the capital expense.
Centralized vs Decentralized Contracting: Centralized = one procurement department handles all contracts (expertise, consistency, career path for procurement staff). Decentralized = each project has its own procurement officer (more responsive, but inconsistent practices).
Integration
Risk, quality, and procurement are interconnected throughout the project. Risk drives procurement strategy. Quality requirements shape contract SOWs. Risk responses often involve procurement decisions.
| Risk Situation | Procurement Response | Logic |
|---|---|---|
| Buyer wants to transfer cost overrun risk | Use FFP contract | Seller bears all overruns under fixed price |
| Scope is unclear; buyer needs flexibility | Use CPFF or CPIF | Cost reimbursable accommodates undefined scope |
| Seller performance uncertainty is high | Use FPIF or CPIF | Incentive fee motivates seller performance |
| New technology; R&D work | Use CPAF or CPFF | Can't define scope or measure performance objectively upfront |
| Key vendor identified as project risk | Dual-source / backup vendor | Risk mitigation through vendor redundancy |
Quality prevention activities are also risk mitigation strategies. A risk identified as "technical defects may delay delivery" is mitigated by investing in design reviews, code reviews, and testing — all quality prevention and appraisal activities.
CoQ and Risk: The contingency reserve is sized partly based on the cost of non-conformance risks. Projects that under-invest in prevention face higher failure costs — which should be captured in risk register as quantified threats.
Quality audits (QA) can identify whether risk responses are being executed as planned. If a mitigation action (e.g., code review process) is not being followed, a quality audit surfaces the gap before it becomes a defect or delay.
Quality requirements for vendor deliverables must be specified in the SOW and evaluated during source selection. Key mechanisms:
- Acceptance criteria in SOW define measurable quality standards the vendor must meet
- Inspection & audits of vendor work (may be a contract right)
- Warranty provisions transfer defect-correction responsibility post-delivery
- Procurement audits at close review the entire process for lessons learned
| Term | Definition |
|---|---|
| Risk Appetite | Overall degree of uncertainty an organization is willing to accept in pursuit of rewards (strategic, broad) |
| Risk Tolerance | Specific range of acceptable variation around an objective (tactical — e.g., "±10% budget variance is acceptable") |
| Risk Threshold | The specific point at which a risk becomes unacceptable and must be escalated or responded to |
| Residual Risk | Risk remaining after a response has been implemented — what you still live with |
| Secondary Risk | New risk created by implementing a risk response |
| Workaround | Unplanned response to an unidentified risk that has occurred (reactive) |
| Trigger Condition | Early warning sign that a risk is about to occur or has occurred |
| Gold Plating (Quality) | Adding features beyond agreed requirements — prohibited even if well-intentioned |
| Prevention over Inspection | PMI quality principle: build quality in from the start rather than inspect it in at the end |
| Privity of Contract | Legal relationship directly between contracting parties only — PM has no direct relationship with subcontractors of vendor |
Practice Quiz
10 questions covering risk responses, EMV calculations, quality tools, control charts, and contract types. Select an answer to reveal the explanation.
Review the explanations above for any missed questions.
Memory Hooks & Advisor
Mnemonics and patterns to lock in risk responses, CoQ categories, contract types, and quality tools before exam day.
EMV Formula
EMV = Probability × Impact
Threat = negative · Opportunity = positive
Residual vs Secondary Risk
Residual = risk remaining after response
Secondary = new risk created BY the response
Control Chart Rule of Seven
7 consecutive points on one side of mean (or trending) = out of control, even within UCL/LCL
Which contract = most risk on BUYER?
Cost Reimbursable (CPFF, CPIF, CPAF)
Buyer pays all allowable costs regardless
Which quality tool uses the 80/20 rule?
Pareto chart — 80% of defects from 20% of causes. Ranked bar chart with cumulative % overlay.
Opportunity equivalent of "Avoid"
Exploit — ensure the opportunity definitely occurs. Mirror of Avoid (which eliminates the threat).
Most expensive cost of quality category
External failure costs — defects found after delivery. Includes warranty, liability, recall, reputation damage.
Use RFP vs RFQ — when?
RFP: scope unclear, evaluating approach + price
RFQ: scope defined, evaluating price only
⚠️ Risk Identification & Analysis
- Risk register is created during risk identification and updated throughout the project — it's a living document, not a one-time deliverable.
- Qualitative analysis (P-I matrix) prioritizes risks quickly without detailed data. Always done first. Outputs: ranked risk list, watch list, risks requiring quantitative analysis.
- Quantitative analysis uses numerical models — EMV for single decisions, Monte Carlo for full distributions. Not all risks need quantitative analysis; only high-priority ones identified in qualitative analysis.
- EMV = Probability × Impact. Threats are negative; opportunities positive. Sum all risk EMVs to find total expected impact for contingency reserve sizing.
- Monte Carlo simulation produces a probability distribution (S-curve) of outcomes. Use it to find the P80 date (80% confidence of finishing by then) and to identify which activities have the most schedule/cost uncertainty (tornado diagram).
- Risk appetite vs tolerance vs threshold: Appetite = overall attitude to risk (strategic). Tolerance = acceptable variation range (tactical). Threshold = the specific point at which a risk must be escalated or acted upon.
🛡️ Risk Responses
- Threats (ATMA+E): Avoid (eliminate), Transfer (insure/fixed-price contract), Mitigate (reduce P or I), Accept (active with contingency or passive), Escalate (outside PM authority).
- Opportunities (ESEA+E): Exploit (guarantee it), Share (partner), Enhance (increase P or I), Accept, Escalate.
- Transfer does not eliminate the risk — it shifts the financial consequence to a third party. The risk event can still occur (e.g., insured flood still happens; insurance pays the cost).
- Active acceptance = create a contingency plan in advance (documented response triggered by a specific condition). Passive acceptance = log it; take no action unless it occurs.
- Residual risk = what remains after a response. Secondary risk = new risk created by the response itself. Both must be added to the risk register and managed.
- Workaround = unplanned response to an unidentified risk. Workarounds often result in change requests and updates to the risk register.
✅ Quality Management
- Cost of Quality: Conformance = Prevention (training, documentation) + Appraisal (testing, inspection). Non-Conformance = Internal failure (rework, scrap) + External failure (warranty, recall). Prevention is cheapest per defect avoided.
- QA (Manage Quality) = process improvement, audits, benchmarking. Output: quality reports, change requests. QC (Control Quality) = inspect deliverables, statistical sampling, control charts. Output: verified deliverables.
- Control chart: UCL and LCL at ±3σ. Points outside = special cause = out of control. Rule of 7: seven consecutive points on one side of mean or trending = out of control even within limits.
- Pareto chart (80/20): focuses improvement on the vital few causes. Ishikawa/fishbone: identifies root causes (6Ms: Man, Machine, Method, Material, Measurement, Mother Nature).
- Scatter diagram: shows correlation between two variables — does not prove causation. Histogram: frequency distribution of a single variable. Check sheet: structured data tally.
- Prevention over inspection is PMI's quality principle: it is always less expensive to prevent defects than to find and fix them after the fact.
📄 Contract Types
- Fixed Price family: Seller bears cost overrun risk. FFP = most common, fixed total price. FPIF = fixed target + incentive fee if performance targets met (ceiling price protects buyer). FP-EPA = fixed price with inflation adjustment for long contracts.
- Cost Reimbursable family: Buyer reimburses all allowable costs. CPFF = fixed fee regardless of costs (seller has little efficiency incentive). CPIF = fee tied to performance targets (motivates seller). CPAF = discretionary award fee at buyer's judgment (R&D/innovative work).
- T&M (Time and Material): Hybrid — fixed rate per unit time + material reimbursement. No defined scope end — can grow indefinitely. Always add a not-to-exceed (NTE) clause to cap buyer exposure. Best for staff augmentation.
- Select contract type based on scope certainty: well-defined → FFP. Uncertain → CR. Short-term/evolving → T&M with NTE.
- Under FFP, if actual costs exceed the contract price, the seller absorbs the loss. This motivates cost efficiency but can lead to disputes if scope is unclear — sellers will pad estimates to cover risk.
- Privity of contract: legal relationship exists only between contracting parties. PM has no direct legal relationship with subcontractors of vendors — must work through the prime vendor.
📋 Procurement Process
- Make-or-buy analysis is the first step in planning procurement — determine whether to build internally or purchase before selecting contract type or issuing solicitation documents.
- RFP: complex/undefined scope; evaluate approach + price + team. RFQ: defined scope; price is primary criterion. IFB: fully defined scope (government/construction); lowest compliant bid wins. RFI: market research only; not a bid solicitation.
- Statement of Work (SOW) describes what the seller must deliver — scope, deliverables, location, schedule. Included in all procurement documents. Quality requirements and acceptance criteria belong in the SOW.
- Source selection criteria weight technical capability, experience, price, references, past performance, and management approach. Not solely price — especially for complex or risky procurements.
- Centralized contracting: one procurement department handles all contracts — expertise, consistency, career development for procurement staff. Decentralized: each PM has own procurement officer — more responsive, less consistent.
- Procurement audits at project close review the entire procurement process — what worked, what didn't, lessons learned to improve future procurements.