PMP Risk Management: Responses, Reserves, and Risk vs Issue

Where risk appears in the 2026 PMP outline

Risk is spread across three places in PMI's 2026 Exam Content Outline (revised August 11, 2026, as checked on October 27, 2026):

• Business Environment task 5, plan and manage risk. The full cycle, from planning and identification through a maintained risk register to responses and reporting. The outline's own examples mention poor IT security and sustainability risks.
• Business Environment task 4, impediments and issues. Among other things, it asks you to recognize the point where a risk has become an issue.
• Process task 6, finance. Quantifying financial allocations for risk and contingency, and managing reserves.

Business Environment task 1 matters too, because it sets the governance escalation paths and thresholds a risk decision may have to follow. Business Environment is 26% of the exam, up from 8% before July 2026.

Risk vs issue on the PMP, and which log each one belongs in

The ECO does not define the two words, so this page uses the U.S. Department of Defense Risk, Issue, and Opportunity Management Guide (September 2023). It defines a risk as a potential future event or condition that may hurt cost, schedule or performance, an issue as a negative event that has occurred or is certain to occur, and an opportunity as a potential future benefit. It adds two points worth remembering for the exam: an issue can arrive with no risk ever having been logged, and an issue can create new risks.

When a risk occurs, a sound sequence is to carry out the response already planned for it, record the issue, update the risk entry, and tell the people the plan says need to know. Questions often hide the transition in one word: "may" signals a risk, while "has announced" or "confirmed" signals an issue. Distinctions like this one are good material for short daily recall, such as the Business Environment flashcards planned for full PMP prep.

PMP response options for threats and opportunities, with original examples

The U.S. Department of Energy's Risk Management Guide (DOE G 413.3-7A, change 2, 2021) uses the same response names PMP candidates study: accept, avoid, transfer and mitigate for threats, and accept, exploit, share and enhance for opportunities. The examples below are invented.

Two notes keep these honest. First, accepting a risk is not ignoring it. DOE says acceptance should be a deliberate decision documented in the risk register, and DoD tells programs to keep tracking an accepted risk as a watch item. Second, transferring a risk does not erase it. DOE advises checking that a transfer has not created new risks, and a seller who takes on cost risk usually prices it in.

PMP preparation courses also teach an escalate response, used when a threat or opportunity sits outside the project's scope or the project manager's authority and belongs to a program, portfolio or other owner. That ties back to the escalation paths in Business Environment task 1. The ECO does not rank any of these responses. A question rewards the one that fits the facts in the stem.

Contingency reserve vs management reserve on the PMP

The ECO asks you to quantify risk and contingency allocations and manage reserves, but it does not define the reserve types. A paper in PMI's Learning Library, citing PMI's own guidance, draws the line this way:

• Contingency reserve covers "known unknowns": risks in the risk register that have planned responses. The project manager is typically authorized to spend it as those risks occur and is accountable for its use.
• Management reserve covers "unknown unknowns": risks nobody identified. Upper management typically sets it, and the cost baseline plus the management reserve make up the cost budget, so it sits outside the baseline.

A simple worked example, with invented numbers: a project team identifies two threats. One has a 20% chance of causing $100,000 of rework, an expected value of $20,000. The other has a 40% chance of a $50,000 penalty, also $20,000. A $40,000 contingency reserve covers their combined expected value. With $500,000 of estimated work, the cost baseline is $540,000. If management adds a $25,000 management reserve, the cost budget is $565,000. Real programs usually size contingency with quantitative analysis instead of simply adding single expected values. The PMI paper mentions the Monte Carlo method, and DOE's guide uses Monte Carlo analysis of cost risk.

Be careful with outside sources. GAO's Cost Estimating and Assessment Guide uses the two words almost the other way around: management reserve for known unknowns held by the contractor, contingency for unknown unknowns held by the government office. GAO itself says other organizations may use the terms differently. For the PMP, learn the PMI convention above and read each stem for which kind of risk is involved.

After working the reserve example, try it with a third threat of your own. Risk sits in Business Environment, and the PMP page lists the 741 Business Environment questions planned for launch alongside the other two domains.

Security and sustainability risks the 2026 outline names

The 2026 ECO uses security and sustainability as its examples in the risk task, and lists both again as compliance requirements in Business Environment task 2. Two invented examples show how they can appear:

• Security. A team plans to store customer feedback in a new cloud tool that has not passed the company's access-control review. The threat is a data exposure. Mitigate by finishing the review before any live data moves, or avoid by using the already approved tool.
• Sustainability. A warehouse retrofit depends on outdoor work during a summer with forecast extreme-heat days, and the client has a target to cut construction waste. Mitigate the heat risk by scheduling heavy outdoor work for early mornings, and enhance the waste-reduction opportunity by contracting a recycler for offcuts.

A PMP risk scenario worked through

This scenario is invented. A hybrid project's risk register lists a threat that Maya, the only analyst who knows how the payroll system maps tax tables, may be reassigned. The planned response was to pair a second analyst with her and record her mapping steps. This week her manager confirms she moves to another program in four weeks.

1. Classify it. The reassignment is confirmed, so it is now an issue, not a risk.
2. Act on the plan. Speed up the pairing and documentation already agreed as the response. That also serves People task 7, knowledge transfer.
3. Update the records. Log the issue, update the risk entry, and check whether the change creates new risks, such as the second analyst's own work falling behind.
4. Communicate. Report the change and its effect on the plan to the sponsor through the usual status channel.

Running a new risk workshop first, or asking for management reserve before using the planned response, both skip the plan the team already made. For the domain around this task, see the PMP Business Environment domain overview. The money side of reserves connects to the PMP earned value guide, and the PMP scenario-question method shows how to read the stem before choosing. When you can classify risks and issues quickly, check your reasoning on new stems, starting with the Business Environment items in the free PMP practice questions. Once full prep opens, it is planned to keep a Fix It list of the questions you miss until you get them right.