What are assigned risk ratings based upon?

Question

Options

• ARoot cause analysis
• BAssessed probability and impact
• CExpert judgment
• DRisk Identification

• A
  3% (1)
• B
  85% (34)
• C
  10% (4)
• D
  3% (1)

Explanation

Assigned risk ratings are based on assessed probability and impact (B) because a risk's severity is determined by combining how likely it is to occur with how significant its consequences would be - this two-factor evaluation is the foundation of quantitative and qualitative risk analysis in frameworks like PMBOK and ISO 31000.

Why the distractors are wrong:

• A (Root cause analysis) identifies why a risk exists, not how severe it is - it's a diagnostic tool, not a rating mechanism.
• C (Expert judgment) may inform the assessment process but is not the basis for the rating itself; it's an input, not the formula.
• D (Risk identification) is the earlier step of discovering risks - you must identify risks before you can rate them, but identification alone doesn't assign a rating.

Memory tip: Think of a risk rating as a simple equation - P × I = Risk Rating (Probability × Impact). If you see "rating" or "scoring" on the exam, that formula points straight to B.

No community discussion yet for this question.