Risk Classification: Known-Known, Known-Unknown, Unknown-Unknown, Unknown-Known
PMBOK v8 Definition
Risk classification categorizes knowledge about uncertainty into four quadrants based on what is known or unknown to the project team versus what is known or unknown in the broader community. Known-Known represents facts and requirements managed as part of scope—this is not a risk. Known-Unknown describes classic risks where knowledge exists to identify probability and impact. Unknown-Unknown refers to emergent risks where knowledge does not exist within the sphere of influence. Unknown-Known represents hidden facts where knowledge exists in the community but not with the entity working on the endeavor.
This concept appears in Section 2 – Project Management Performance Domains, specifically within the risk classification framework (Figure 2-46).
Why It Matters for the Exam
The PMI exam frequently tests your ability to distinguish genuine risks from non-risks. Understanding these four classifications is critical because exam questions often present scenarios where you must determine whether something is a risk, an issue, or part of normal scope management. Questions appear in situational judgment format, requiring you to classify project uncertainties correctly.
Key Points to Remember (for the exam)
- Known-Known: Managed as part of scope. Not a risk. These are facts and requirements already understood.
- Known-Unknown: Classic risk. Knowledge exists to identify probability and impact. This is the standard risk requiring analysis and response planning.
- Unknown-Unknown: Emergent risk. Knowledge does not exist within the sphere of influence. Cannot be proactively identified; requires contingency reserves and agile adaptability.
- Unknown-Known: Hidden fact. Knowledge exists in the community but not with the project entity. Represents information the team does not possess but others have.
- Overall risk vs. individual risk: Overall risk is the effect of uncertainty on the project as a whole, including all individual risks combined. Responses apply to the entire project, not specific events.
- Risk vs. Issue: Risks are potential future problems that have not yet occurred. Issues are current conditions or situations that have already occurred and may require immediate action.
- Risk appetite: The degree of uncertainty an organization or individual is willing to accept in anticipation of a reward, often quantified through a risk threshold.
Typical PMI Exam Example
Your project team identifies a requirement for a new software feature that is fully understood and documented. The team has implemented similar features before. According to PMBOK v8 risk classification, this is a Known-Known item. How should it be managed?
Correct answer: Managed as part of scope. It is not a risk.
PMI Exam Traps
-
Trap: Treating Known-Known items as risks to be added to the risk register
- Reality: Known-Known items are managed as part of scope. They are not risks.
-
Trap: Confusing Unknown-Unknown risks with Known-Unknown risks
- Reality: Unknown-Unknown risks have no knowledge to identify probability or impact (emergent). Known-Unknown risks have sufficient knowledge to assess probability and impact (classic).
-
Trap: Treating Unknown-Known as a risk when it is actually a hidden fact
- Reality: Unknown-Known represents knowledge existing elsewhere but not with the team. This is a knowledge gap, not necessarily a risk.
-
Trap: Confusing overall project risk with individual risks
- Reality: Overall risk is the effect of uncertainty on the project as a whole. Individual risks are specific uncertain events. Responses differ: overall risk responses apply to the entire project.
Important PMI Connections
| Related Concept | Relationship Type | Exam Attention Point |
|---|---|---|
| Issue | Distinction | Issues have already occurred; risks are potential future problems. An issue may arise from a poorly managed risk. |
| Risk Register | Output of Identify Risks | Contains risks described in "cause, event, and consequence" structure. Known-Unknown risks are documented here. |
| Plan Risk Management | Input process | Defines how risk classification will be applied. Includes expert judgment, data gathering, and stakeholder analysis. |
| Risk Appetite / Risk Threshold | Quantification | Risk appetite is the willingness to accept uncertainty. Risk threshold quantifies this appetite. Both influence how risks are classified and managed. |
Quick Review Questions
-
A project team discovers that a competitor has already solved a technical challenge the team is currently facing. The team was unaware of this solution. According to PMBOK v8, which risk classification does this scenario represent?
-
Your project sponsor asks why you are not adding all known requirements to the risk register. What is your correct response based on PMBOK v8 risk classification?
-
During project planning, you identify a potential supplier delay. Historical data allows you to estimate a 30% probability and a $50,000 impact. Which risk classification applies?
-
A new regulation is announced that no one in the industry anticipated. There is no data to assess probability or impact. How should this be classified?
-
What is the key difference between overall project risk and an individual risk regarding how responses are applied?
PMBOK v8 Reference
Section 2 – Project Management Performance Domains, Figure 2-46: Risk Classification