An unexpected risk has been identified in a project. Which of the following actions should the project manager perform FIRST?

The first essential step when an unexpected risk is identified is to formally document it by adding it to the risk register. This ensures the risk is officially recorded and becomes part of the project's ongoing risk management process before any further analysis or response planning can occur.

Updating the probability / impact matrix is part of qualitative risk analysis, which occurs after a risk has been identified and documented.

Submitting a change request might be necessary later if a risk response impacts the project baseline, but it is not the immediate first action upon initial risk identification.

Performing a risk qualitative analysis is a subsequent step in risk management, conducted after the risk has been identified and recorded in the risk register.