August 25, 2026 · 6 min read
TL;DR: Probability and impact scores exist to drive a decision, not to sit in a matrix. The exam tests whether you multiply them correctly (expected monetary value), act on the risk register instead of reacting fresh, and re-score risk continuously instead of once at planning.
The exam tests what happens after a probability and impact score exists: whether you use it to size a reserve, whether you act on a predetermined plan instead of improvising, and whether you keep the score current as the project moves.
Most candidates know the matrix itself — score probability, score impact, plot the risk, call it high or low. That part is rarely where the exam catches you.
Risk moved into the Business Environment domain under the July 2026 ECO, and this is now the largest single task in that domain by question count in this site's bank. A lot of study material still files it under Process, from before the exam changed — the concept didn't change, but where it's tested did.
Expected monetary value (EMV) — probability multiplied by impact — is the number the exam wants for a reserve calculation, the same plug-in-the-numbers discipline it expects for earned value management. Candidates who skip straight to guessing usually miss it.
Take a bank scenario: a technical risk has a 20% probability of occurring and an $80,000 cost impact if it does. The team decides to accept the risk. What's the defensible reserve?
| Approach | Amount | Why it's wrong (or right) |
|---|---|---|
| Full impact, "covered no matter what" | $80,000 | Ignores probability entirely — treats a 1-in-5 risk like a certainty |
| Expected monetary value | $16,000 | Correct: 0.20 × $80,000, adjusted as more information arrives |
| Flat 10% of project budget | Policy amount | Ignores the specific risk's own probability and impact |
| No reserve, request funds if it occurs | $0 | Skips planning entirely — reactive, not proactive |
Common trap: the bank's wrong answers on EMV questions almost always offer the full impact figure as an option, betting that candidates who remember "impact matters" but forget to multiply by probability will pick the bigger, safer-looking number. $80,000 sounds more responsible than $16,000. It's still wrong — a reserve sized for certainty is a reserve sized for the wrong risk.
The other trap runs the opposite direction: a risk the team already scored and planned for actually happens, and the scenario tempts you into a fresh, in-the-moment response instead of the one that's already documented.
One bank question puts a supplier quality problem in front of the PM — a risk that had already been identified earlier in the project. The tempting answers are all active-sounding: call an urgent team meeting, demand a full audit, draft an urgent message to the supplier. The correct answer is quieter: refer to the risk register for the predetermined mitigation action. If the risk was scored and planned for, the plan is the answer. Improvising from scratch throws away the planning work that already happened.
Because risk changes as the project moves — a score taken once at planning and never revisited is a snapshot, not a management practice.
The bank tests this directly: a project nears completion and several risks originally scored low-probability, low-impact have grown into real problems that blindsided the team. The lesson isn't "score risk better the first time." It's continuous reassessment throughout the project life cycle — not a scheduled monthly check-in, not a one-time planning exercise.
Severity (probability × impact) also drives sequencing, not just prioritization on a chart. When a team scores risks and multiplies for severity, the highest-severity items get scheduled earlier in the project, specifically so their potential impact has less schedule left to damage. A risk register that's accurate but never influences the schedule isn't doing its job.
Risk questions in this bank explain why the reactive answer is wrong, not just which one is right — including the EMV traps and the risk-register-versus-improvise pattern above. All 2,141 questions are re-certified against PMBOK 8 and the July 2026 ECO. Start the free 20-question sample — no card, no signup required to try it.
Is risk management still part of the Process domain?
No — the July 2026 ECO moved risk into Business Environment. It's now the largest single task in that domain by bank question count. Candidates studying older material may still expect it under Process.
What's the difference between a contingency reserve and a management reserve?
A contingency reserve covers identified risks already scored in the risk register — sized from expected monetary value, and the project manager can draw on it directly. A management reserve covers unidentified risk (unknown unknowns) and typically needs sponsor approval to release.
Do I need to memorize the EMV formula?
Yes. Expected monetary value is probability multiplied by impact. It's the standard the exam expects you to use to size a contingency reserve, and the bank's wrong answers usually offer the full impact amount or a flat percentage instead of the calculated figure.