Levels of Risk Probability and Impact in Project Risk Management

PMBOK v8 Definition

Risk probability and impact levels are definitions specific to the project context that reflect the risk appetite and thresholds of the organization and key stakeholders. These levels are used when assessing and prioritizing individual project risks. The number of levels reflects the degree of detail required for the risk process, with more levels used for a detailed risk approach (typically five levels) and fewer for a simple process (usually three levels).

Risk probability assessments consider the likelihood that a specific risk will occur, while risk impact assessments consider the potential effect on one or more project objectives such as schedule, cost, quality, or performance. Impacts are negative for threats and positive for opportunities.

Why It Matters for the Exam

This concept appears frequently in PMI exam questions about the Plan Risk Management and Perform Qualitative Risk Analysis processes. You will encounter questions testing your understanding of how risk appetite and thresholds inform the definition of probability and impact levels, as well as how the number of levels (3 vs. 5) affects risk analysis detail. Expect scenario-based questions where you must determine the appropriate number of levels or interpret how stakeholder risk appetite shapes these definitions.

Key Points to Remember (for the exam)

• Main Input: Risk management plan (contains definitions of risk probability and impact levels)
• Key Tool: Risk probability and impact assessment (performed in interviews or meetings)
• Common Confusion: Risk probability levels are NOT the same as risk urgency; probability assesses likelihood, urgency assesses time sensitivity
• Critical Rule: Definitions are specific to the project context and reflect stakeholder risk appetite and thresholds
• Number of Levels: Five levels for detailed risk approach; three levels for simple process
• Assessment Method: Conducted in interviews or meetings with project team members and knowledgeable persons external to the project
• Watch List: Risks with low probability and impact may be included in the risk register as part of a watch list for future monitoring

Typical PMI Exam Example

A project manager is planning risk management for a complex aerospace project with high stakeholder risk aversion. The organization's standard risk framework uses three probability levels. However, key stakeholders require more granularity for critical safety risks. What should the project manager recommend? → Use five probability and impact levels to achieve the required detail for this complex project context.

PMI Exam Traps

• Trap: Assuming risk probability and impact levels are standardized across all projects

• Reality: Definitions are specific to the project context and reflect stakeholder risk appetite and thresholds

• Trap: Confusing risk probability with risk urgency

• Reality: Probability assesses likelihood of occurrence; urgency assesses how quickly the risk needs a response

• Trap: Thinking low probability and impact risks are removed from the risk register

• Reality: They may be included as part of a watch list for future monitoring

• Trap: Believing probability and impact assessments are done individually by the project manager

• Reality: Assessments involve interviews or meetings with project team members and knowledgeable persons external to the project

Important PMI Connections

Quick Review Questions

1. What determines whether a project should use three versus five levels of risk probability and impact?

2. During a risk assessment meeting, two stakeholders disagree on the probability level of a specific risk. What should the project team do?

3. Where in the project management plan are the definitions of risk probability and impact levels documented?

4. How do stakeholder risk appetite and thresholds influence the definitions of risk probability and impact levels?

5. What is the appropriate treatment for individual project risks assessed with low probability and low impact?

PMBOK v8 Reference

Section 11.1 - Plan Risk Management (Definitions of risk probability and impacts) Section 11.3 - Perform Qualitative Risk Analysis (Risk probability and impact assessment)