Association for Project Management Qualification (APM PMQ) Risk, Issue and Change Management Syllabus

What is 'residual risk'?

The level of risk that remains after a risk response has been implemented; the portion of the original risk exposure not removed by the chosen action.

What is a risk owner?

The individual responsible for managing a specific risk, including monitoring it and ensuring the agreed response actions are carried out and reported on.

What is a risk actionee?

The person assigned to carry out a specific risk response action on behalf of, and reporting to, the risk owner.

What is the purpose of the risk register?

A document that records identified risks, their assessment (probability/impact), proximity, chosen responses, owners/actionees and current status; the central tool for capturing and tracking risk information.

List typical fields contained in a risk register.

Risk ID, description (cause-event-effect), category, probability, impact, risk score/exposure, proximity, response strategy and actions, owner/actionee, and status.

What does 'proximity' mean in the context of risk?

How close in time a risk event is to occurring (i.e. when it might happen). It helps prioritise responses by indicating which risks need attention soonest, independent of probability/impact.

Why is writing risks as 'cause, event, effect' (risk metalanguage) useful?

It separates the source/condition (cause) from the uncertain event (risk) and its consequence (effect), giving clarity, avoiding confusing facts with risks, and aiding accurate assessment and response.

State four benefits of effective risk management.

Increased likelihood of meeting objectives; fewer surprises; better-informed decision making; improved stakeholder confidence; more efficient use of resources/contingency; and capture of opportunities.

How does risk management support better decision making?

By providing objective, structured information on uncertainty and exposure, it allows decisions (e.g. go/no-go, contingency, prioritisation) to be made with greater confidence rather than on gut feel.

Define an 'issue' in project management.

A problem, event or matter that is now occurring (has happened or is certain to happen) and threatens project objectives, requiring management action and resolution because it cannot be managed by the team within delegated authority.

What is the key distinction between a risk and an issue?

A risk is uncertain — it may or may not occur in the future; an issue is certain — it is happening now (or a risk that has materialised) and must be resolved through formal management action.

Can a risk become an issue? Explain.

Yes. When a risk event actually occurs, the uncertainty is gone and it becomes an issue requiring resolution; the risk register entry is closed and the matter is transferred to issue management.

What is the issue management process?

A structured process to identify/capture, assess, escalate (if needed), decide on and implement a resolution, then monitor and close issues — ensuring problems are dealt with promptly and consistently.

List the typical steps in handling an issue.

1) Identify and log the issue, 2) Assess its impact and urgency, 3) Determine options/recommend action, 4) Escalate or decide within authority, 5) Implement resolution, 6) Review and close (update issue register).

What is the purpose of the issue register (issue log)?

A document used to capture and track all issues, recording their description, impact, priority, owner, actions, escalation status and resolution, ensuring no issue is lost and progress is monitored.

What information is typically recorded in an issue register?

Issue ID, date raised, raised by, description, impact/severity, priority, owner, agreed actions, escalation route/status, target resolution date, and current status.

What is an escalation route in issue management?

A predefined path for raising an issue to a higher level of authority (e.g. project manager to sponsor/steering group) when it falls outside the current manager's delegated tolerance or authority to resolve.

Why are escalation routes important for issue management?

They ensure issues exceeding a manager's delegated authority/tolerance are passed promptly to those who can decide and act, preventing delay and ensuring decisions are taken at the right level.

What role does the project manager play in managing issues?

Owns the issue management process, ensures issues are logged and assessed, resolves those within their authority, escalates those beyond it, and reports issue status to the sponsor and stakeholders.

What role does the sponsor play in managing issues?

Takes decisions on escalated issues that exceed the project manager's authority or tolerances, provides direction and resources, and owns the business case affected by major issues.

Define change control.

The process through which all requests to change the baseline scope, deliverables, time or cost of a project are captured, evaluated, approved or rejected, and (if approved) implemented in a controlled way.

Why is change control necessary on a project?

To prevent uncontrolled change (scope creep), ensure changes are properly assessed for impact on the business case/objectives, maintain baseline integrity, and ensure decisions are authorised and documented.

List the typical steps of the change control process.

1) Request/capture change, 2) Log it, 3) Assess impact (cost, time, scope, quality, risk), 4) Recommend, 5) Decision (approve/reject/defer) by the appropriate authority, 6) Implement and update baseline/plans, 7) Review and close.

What is a change request?

A formal proposal to alter the project, documenting what change is sought, the reason/justification, and originator details, submitted for assessment and a decision through the change control process.

What is the change log (change register)?

A document that records all change requests and their status — including description, impact assessment, decision (approved/rejected/deferred), date and owner — providing an audit trail of changes.

Who typically authorises changes in change control?

The change authority — within delegated tolerances this may be the project manager; changes exceeding those tolerances (e.g. affecting the business case) are decided by the sponsor or a change control board.

What is a change control board (change authority)?

A group or nominated individual with delegated authority to review change requests and decide whether to approve, reject or defer them, especially those beyond the project manager's tolerance.

What is the project manager's role in change control?

To operate the process: ensure changes are logged and impact-assessed, approve changes within delegated authority, escalate larger changes to the sponsor/board, and update baselines and plans for approved changes.

Define configuration management.

The technical and administrative process of identifying, documenting, controlling, tracking the status of, and verifying the project's products (configuration items) and their versions throughout the life cycle.

List the main activities of configuration management.

Planning, identification (of configuration items), control (of versions/changes), status accounting (recording state), and verification/audit (confirming items match records).

What is a configuration item?

A product, deliverable or component (or a coherent group) that is treated as a single entity for configuration management purposes, with its own identification, baseline and version control.

What is 'status accounting' in configuration management?

Recording and reporting the current and historical state of each configuration item — its version, baseline and change history — so the status of all products is known at any time.

What is a configuration audit/verification?

A check that the actual configuration items match their records/specifications and that all changes have been properly authorised and recorded, ensuring integrity of the products.

What is the relationship between change control and configuration management?

Change control authorises whether a change happens; configuration management tracks and records the products and their versions affected by that change. Configuration management maintains the baseline that change control protects and updates.

How do change control and configuration management work together when a change is approved?

Change control approves the change, then configuration management updates the version/baseline of the affected configuration items and records the new status, keeping product records accurate and traceable.

What is a 'baseline' in this context?

A reference version of a plan, deliverable or configuration item that is fixed and agreed at a point in time, against which progress and any subsequent changes are measured and controlled.

Why must risk, issue and change processes be linked?

Because they overlap: a materialised risk becomes an issue, and resolving an issue or risk often requires a change. Linking them ensures consistent tracking, accountability and impact assessment across the project.

What is 'risk appetite' versus 'risk tolerance'?

Risk appetite is the amount of risk an organisation is willing to seek or accept in pursuit of objectives; risk tolerance is the threshold/boundary of acceptable variation around objectives before action or escalation is required.

Give two reasons issues should be escalated rather than resolved locally.

The issue exceeds the project manager's delegated authority or tolerance, or it requires resources, decisions or business-case changes that only the sponsor/governance board can authorise.