Risk Practice

The correct answer is: A threat

In PRINCE2 7, risk management uses specific terminology to distinguish between different types of uncertain events. A threat is defined as an uncertain event that, should it occur, would have a negative effect on one or more project objectives. This is a fundamental concept in PRINCE2's approach to risk management.

PRINCE2 categorizes uncertain events into two main types:
- Threats: uncertain events with negative impacts
- Opportunities: uncertain events with positive impacts

Both threats and opportunities are types of risks, as risk in PRINCE2 encompasses both negative and positive uncertainties.

Why the other answers are incorrect:

A risk exposure factor is not a standard PRINCE2 term. Risk exposure relates to the combination of probability and impact, but this terminology doesn't describe the uncertain event itself.

An issue is fundamentally different from a threat. In PRINCE2, an issue is a relevant event that has already happened, is happening, or is certain to happen - it's not uncertain. Issues require management action and may need escalation, but they are not uncertain events. The question specifically asks about uncertain events.

A constraint is a restriction or limitation that affects the project (such as fixed deadlines, limited budgets, or specific regulations). Constraints are typically known factors that must be worked within, not uncertain events that may or may not occur. While constraints may limit response options, they don't describe uncertain events with potential negative impacts.

The correct answer is Avoid.

In PRINCE2 7, risk response types for threats include Avoid, Reduce, Transfer, and Accept. The question specifically asks about a response that involves changing the project plan to either remove the threat's conditions or shield the project objectives from its potential impact.

Why this is correct:
Avoid is the risk response that involves taking proactive action to eliminate the threat entirely or to protect the project objectives so that the threat cannot affect them. This is achieved by modifying the project plan, changing the approach, or removing the conditions that give rise to the threat. For example, if a supplier is unreliable, you might avoid the risk by choosing a different, more reliable supplier.

Why the other options are incorrect:

Transfer involves shifting the ownership and responsibility for managing the threat to a third party, such as through insurance or outsourcing. The threat still exists, but another party deals with its consequences. This doesn't involve changing the project plan to remove the threat's conditions.

Reduce (also known as Mitigate) involves taking actions to reduce either the probability of the threat occurring or its impact if it does occur. The threat remains, but its effects are minimized through preventive or contingency actions. This differs from avoiding because the threat's conditions aren't completely removed.

Accept means acknowledging the threat exists and deciding to continue with the project without taking specific action to address it. This is appropriate when the cost of response exceeds the potential impact, or when the threat is unavoidable. This clearly doesn't involve changing plans to remove the threat.

The correct answer is: 'To capture and maintain information about identified threats and opportunities'

This is the precise definition of the Risk Register's purpose in PRINCE2 7. The Risk Register is a key management product that serves as the central repository for recording and tracking all identified risks throughout the project lifecycle. In PRINCE2, risks are defined as uncertain events or sets of events that, should they occur, will have an effect on the achievement of objectives. These risks can be either:
- Threats (negative risks that could harm the project)
- Opportunities (positive risks that could benefit the project)

The Risk Register captures essential information about each risk including its description, probability, impact, proximity, risk owner, and planned risk responses.

Why the other answers are incorrect:

The answer mentioning stakeholder concerns and escalation pathways confuses the Risk Register with the Issue Register and stakeholder management documentation. While stakeholder concerns may lead to risks being identified, the Risk Register itself does not track general stakeholder concerns or their escalation pathways - this is handled through other mechanisms.

The answer about project issues requiring resolution by the Project Manager describes the purpose of the Issue Register, not the Risk Register. Issues are problems or questions that have already occurred and require management action, whereas risks are uncertain future events. These are two distinct management products in PRINCE2.

The answer that adds 'budget allocations' to threats and opportunities is incorrect because the Risk Register does not track budget allocations. While risk responses may have budget implications that are managed through the project budget, the Risk Register itself focuses on capturing risk information such as probability, impact, and response actions - not specific budget allocations.