20 NEW PMI-RMP Multi-Response Free Questions and Answers (Part - 2)

 

This is in continuation of the earlier series of questions for the mutlti-response or multi-answer questions for the PMI-RMP® examination. I call them multi-response, multi-choice quesitons.

I'd strongly suggest that you take both the parts together when you try to attempt the questions. That way you will get a feel of questions and how to answer them. Do note that these are not verbatim  questions from PMI-RMP exam, however, these questions covers the areas needed for the exam. These questions are taken from the following courses and book:

• RMP Live Lessons – Guaranteed Pass or Your Money Back
• RMP 30/40 Contact Hours – Full Moneyback Guarantee
• I Want To Be A RMP, 2nd Edition, 2022 updated with latest exam pattern 

Again do note that the PMBOK 7th edition is a reference for the new RMP exam. It's explicitly listed in the exam content outline (RMP-ECO). 

The RMP Live Lessons course also comes with a dedicated  full-length question for this purpose (PMBOK7 and ECO).

In this part, we will have final 10 multi-answer/response questions. I hope you are able to do most of the questions on your own! If not, do send a mail as noted below.

[This series - Part - 1]

Subscribe to the site (top-right corner) for fresh updates.

*********

Question – 11: For a project, the risk manager has all the planning related work, implementing the risk responses and currently monitoring the risks. For certain risks, while monitoring, the plan is to trigger a response based on analysis. Which of the following can be used (choose two)?

A. Affinity diagrams.

B. Contingency planning.

C. Variance analysis.

D. Residual impact analysis.

E. Trend analysis.

Question – 12: Which of the following are not correct about reserve analysis (choose two)?

A. Informs the amount of reserves remaining to the amount of risk remaining at any time in the project.

B. Use in both Perform Quantitative Risk Analysis and Monitor Risks process.

C. Can be plotted with a cause-and-effect diagram.

D. Burndown charts can be used to represent the reserve remaining.

E. Tells if the remaining reserve is adequate.

Question – 13: For a project, a number of risk related activities, but conditions ones, are added with changes to the project schedule. These have been approved and integrated, which in result in updates to (choose two):

A. Project schedule.

B. Project schedule management plan.

C. Project management plan.

D. Project schedule baseline.

E. Project resource management.

Question – 14: A planning session is ongoing in order to build a common understanding of the risk approach between stakeholders and to gain agreement for managing risks in a project, which will be part of the portfolio. The output of this meeting can have which of the following (choose two):

A. Introduction, Portfolio description, Stakeholder risk appetites.

B. Identified risks, Risk owners, Risk Response Owners.

C. Project description, Criteria for success, Thresholds and corresponding definitions.

D. Communications management plan, Risk breakdown structure, Contingency plans.

E. Risk management organization, Roles, responsibilities, and authority, Risk management techniques and guidelines for use.

Question – 15: Risk identification is about all of the following, except (choose two):

A. Develop a comprehensive list of all known uncertainties that could project objectives.

B. Use various tools and techniques such as variance analysis and trend analysis to identify new risks.

C. Write the risk statements in a three-part statement for clarity.

D. Use matrix method-based techniques such as analytical hierarchical process (AHP) to identify risks.

E. Remove biases and an array of human behavior patterns stand in the way of identifying unknown risks.

Question – 16: An example of unknown-known can be all of the followings, but (choose two):

A. A known fact.

B. A hidden assumption.

C. A hidden fact.

D. An unknowable.

E. An ignored assumption.

Question – 17: Delphi technique is one of the core techniques used to identify various uncertainties in a project and hence, associated risks. However, one of the key stakeholders opposes and outlines a number of reasons about its drawbacks. Why can this stakeholder be right (choose two)?

A. Limited to technical risks.

B. Iterative and hence gets unnecessarily refined.

C. Removes sources of bias.

D. Dependent on actual expertise of experts.

E. Can't be used for reserve estimation.

Question – 18: A project is getting closed. The risk manager and team members have tried to manage the risks to a large extent possible, but still some of the risks remained. As the project draws to a closure, what should be done with these risks, except (choose two)?

A. Include a summary of any risks or issues encountered on the project and how they were addressed.

B. Check the risk register and close all the risk before closing the phase.

C. Move the content of the risk register into the lessons learned register.

D. Hand-over the remaining risks into the next phase of the project.

E. Check the risk report in order to see the status of high-priority risks.

Question – 19: For a multi-geographical project under a satellite program, a project manager is currently collecting the performance information. In addition to it, which of the following can be done, except (choose two)?

A. Checking the status of the risks that have already been identified.

B. Evaluating whether or not the impact can be contained within the limits of the project budget.

C. Verifying whether any known risk has not occurred or is not about to occur.

D. Monitoring the status of all actions implemented to respond to the detection or occurrence of a risk.

E. Adding additional activities or work packages to update the project’s baselines or product backlog.

Question – 20: For a project, the risk owner has been monitoring the actions to determine the effectiveness and to identify if any secondary risks have arisen. The risk action owners while informing the status of response actions say that the undertaken actions are closed. What should the risk owner do next (choose two)?

A. Check if the risk has been effectively dealt with.

B. Inform the project manager about it and close the risk.

C. Determine if any additional actions need to be planned and implemented.

D. Keep the risk in the register and manage the risk through subsequent risk management processes.

E. Immediately perform an audit of this risk to determine the effectiveness of response.

[This series - Part - 1]

Subscribe to the site (top-right corner) for fresh updates. 

*********

The question set is available in the embedded document below. The answers are also part of this document. You can scroll to see the content. 

For all answers, subscribe to this site and send a mail (from your GMail id) to managementyogi@gmail.com.

RMP Live Lessons - Guaranteed Pass:

• RMP Live Lessons Course - Guaranteed Pass or Your Money Back

RMP 30/40 Contact Hours Online:

• RMP 30/40 Contact Hours Online - Full Moneyabacl Guarantee

Book for RMP Exam:

• New Book for RMP Exam Prep: I Want To Be A RMP, 2nd Edition

20 NEW PMI-RMP Multi-Response Free Questions and Answers (Part - 1)

The Risk Management Professional (RMP®) exam from PMI® has various types of questions, including the multi-response questions. Indeed, if you are appearing for the latest RMP exam in 2024 and beyond, then you will face both multi-choice and multi-response questions. There is a subtle difference between the two.

Multi-choice questions: There will be four radio-button choices. ONLY one of the choices will be correct. I call it single-response, multi-choice question. These questions are relatively not that difficult. But considering PMI, the standard will be high. 

Multi-response questions: There will be usually five choices with check-boxes on the left, where you can select the right answers. In this case, there will be more than one correct answer. I call these multi-response, multi-choice questions. These are also called mutli-answer questions. These questions, compared to multi-choice questions, will be relatively difficult. 

These questions are taken from the following courses and book:

• RMP Live Lessons – Guaranteed Pass or Your Money Back
• RMP 30/40 Contact Hours – Full Moneyback Guarantee
• I Want To Be A RMP, 2nd Edition, 2022 updated with latest exam pattern 

To answer these questions, you need to have:

• Understanding of the Standard for Risk Management in Portfolios, Programs and Project. This is the main reference for the RMP exam.
• Understanding on the concepts of uncertainties, complexties, ambiguities and risks from both PMBOK Guide 7th edition and PMBOK 6th edition. Yes, PMBOK 7th edition is an explicit reference for the latest RMP exam!
• Ability to apply your understanding in the real-world in a varieties of situations and scenarios.
• Good understanding of the PMI-RMP exam content outline (ECO), the latest one released in March/April 2022.

In this part, we will have 10 such multi-answer/response (or multi-response, multi-choice) questions. 

You will be seeing such questions for the first time. As noted earlier, RMP exam takers are already facing such questions. 

I hope you enjoy doing the questions and it helps in your PMI-RMP exam.

[This series - Part - 2]

Subscribe to the site (top-right corner) for fresh updates. 

*********

Question – 1: One of the principles of risk management is to foster a culture to embrace risk management. Such a culture: (choose two)

A. Identifies threats rather than ignoring them.

B. Identifies opportunities rather than ignoring them.

C. Identifies opportunities by cultivating a positive mindset within an organization.

D. Identifies both threats and opportunities by allocating the right resources.

E. Focuses on most impactful risks first.

Question – 2: Which of the following are not correct about risk attitude (choose two)?

A. Driven by perception and evidenced by observable behavior.

B. Must range from risk seeking to risk averse.

C. Individuals will have inconsistent attitudes towards risks.

D. Not always stable or homogenous.

E. It's the degree to which an individual accepts risks in anticipation of reward.

Question – 3: A risk manager and team members are identifying various sources of uncertainties at the individual project task level and also overall project level. While doing so, they are currently focusing on the quantitative assessment of various project constraints such as cost, schedule, scope, quality among others. Which of the following cannot be inputs for this purpose (choose two)?

A. Cost estimates.

B. Duration estimates.

C. Requirement estimates.

D. Resource estimates.

E. Resource requirements.

Question – 4: Risk management planning process is not only important from the process perspective, but also strategy perspectives. Which of the following are not the purposes of this process (choose two)?

A. Gain a better understanding of individual risks. 

B. Have a numerical estimate of the overall effect of risk on the objectives.

C. Develop the overall risk management strategy.

D. Decide how the risk management processes will be executed. 

E. Integrate risk management with all other activities.

Question – 5: Considering team members are new to the project and risk management is quite new, which of the following are the key success factors for risk identification (choose two)?

A. Risks linked to objectives.

B. Agreed upon definition of risk terms.

C. Complete risk statement.

D. Appropriate risk data model. 

E. Available resources, budget and schedule for responses.

Question – 6: Considering risk owner and risk action owner, which are not correct? (choose two)

A. Risk owner is responsible for monitoring the risk.

B. Risk owner is responsible for selecting and implementing an appropriate risk response strategy.

C. Risk action owner reports the risk owner about the status of the risk response actions.

D. Risk action owner is responsible for finding out the effectiveness of a response.

E. Risk action owner owns the response actions, whereas risk response owner owns the response.

Question – 7: A project has been following the project management body of knowledge (PMBOK) guide's process group model of initiating to closing to manage a project, of which risk management is an integral part. Considering the planning process group of the five process groups, which of the following are considered?

A. Understanding of high-level risks that might impact project objectives.

B. Selection of overall risk management approach for the project.

C. Risk management integration with quality management and execution of stakeholder engagement strategies.

D. Risk management being part of every process in the planning process group.

E. Handing over the remaining known risks prior to closure of the project.

Question – 8: A risk manager is evaluating the effectiveness of risk management processes as documented in the risk management plan. The purposes of the audit can be (choose two):

A. Risk management rules are being carried out as specified.

B. Residual risks response planning is properly taken. 

C. Risk management strategy is iterative and integrative.

D. Risk management related lessons are documented properly. 

E. Risk management rules are adequate for monitoring and controlling the work.

Question – 9: The risk breakdown structure (RBS) is a hierarchical framework of potential sources of risk and used in risk identification. RBS can be used for all of the following situations, except (choose two):

A. Can be used in association with brainstorming.

B. Ensures coverage of all types of risk. 

C. Lowest level of RBS is known as the risk package.

D. Tests for blind spots or emissions.

E. Used for evaluating current risks as well as identifying new risks.

Question – 10: In a meeting for risk identification, the risk manager wants to allow all participants to speak their mind and contribute to the discussion. This is to identify as many risks as possible and to stimulate creativity. Which of the following tools and/techniques will help the risk manager the most (choose two)?

A. Brainstorming.

B. Checklist.

C. Prompt list.

D. Document analysis.

E. Delphi technique.

[This series - Part - 2]

Subscribe to the site (top-right corner) for fresh updates. 

*********

The question set is available in the embedded document below. The answers are also part of this document. You can scroll to see the content. 

For all answers, subscribe to this site and send a mail (from your GMail id) to managementyogi@gmail.com.

RMP Live Lessons - Guaranteed Pass:

• RMP Live Lessons Course - Guaranteed Pass or Your Money Back

RMP 30/40 Contact Hours Online:

• RMP 30/40 Contact Hours Online - Full Moneyabacl Guarantee

Book for RMP Exam:

• New Book for RMP Exam Prep: I Want To Be A RMP, 2nd Edition

Unknowable-unknowns Vs. Unknown-unknowns in Risk Management with Emergent Risks and Novel Risks

Want to master Risk Management? Become a RMP, a specialized PMI certification.

Course at a very low cost: RMP Live Lessons Course - Guaranteed Pass or Money Back  [samples]

The guarantee has no hidden T&Cs—just take the exam!

The free article follows. 

--

As I frequently interact with project and risk management practitioners, the below two questions on unknowable-unknowns and unknown-unknowns come up. They are quite confusing for many. The existing literature doesn’t help as they are written with complicated language and/or complex explanations. The questions are:

• What are the differences between Unknowable-unknowns and Unknown-unknowns? 
• Where does emergent risk actually fit in (in the above context)?

To understand, let’s simplify. 

The Fundamentals

First, let’s understand, what is the difference between unknowable and unknown?

• Unknown: You really don’t know. It’s definitive. 
• Unknowable: You are not likely (or unlikely) to know. It’s probabilistic. 

When we say definitive, it’s certain that you don’t know. For example, it’s possible you don’t know some new technologies, design or frameworks.

When we say probabilistic, a chance factor comes in. There is a chance (usually high) that you don’t know. For example, when disruptive technologies start to pervade, you are unlikely to know the impact. 

Simply put:

• When we say unknown, it means there is a lack of knowledge or untapped knowledge.
• When we say unknowable, it means there is not only lack of knowledge, but also exploration is not probable. In this case, it’s untappable knowledge. 

Now, let’s see what are emergent risks and novel risks? 

Emergent Risks

As per PMI’s Standard for Risks in Portfolios, Programs and Projects, this is the definition of emergent risks:

“A risk that arises which could not have been identified earlier on.”

I agree with this definition, but not the subsequent explanation of PMI on emergent risks in the context of the unknowable, though I’ve adopted them in my books and courses. In this case, one can say these risks could not be identified because they were unknown at that time, but later on, the risks emerged.

When one says “emerge”, a pattern is forming, but not clear. It’ll emerge. 

Novel Risks

I provide this definition for novel risks:

“A risk that arises which was not probable (improbable) to be identified earlier on.”

Here you can say, these risks were improbable to be determined and later it came-up unexpectedly, hence the term “novel” or completely new – not emerging! 

When one says “novel”, there is no pattern formation at all. It is completely new. 

Also, did you notice the distinction in the definitions?

For an emergent risk, we could not have identified earlier, which can be due to many factors such as lack of knowledge, understanding or considering various scenarios. 

For a novel risk, we have a probability factor coming into play. It was improbable to be identified earlier because exploration of such a risk was improbable. 

Unknown-unknowns Vs. Unknowable-unknowns

Now, let’s see the difference between these two:

• Unknown-unknowns: You don’t know that you don’t know. This is pure ignorance. Knowledge wise, it’s untapped knowledge. It’s part of the Complex domain.
• Unknowable-unknowns: You are unlikely to know that you don’t know. This is not pure ignorance. Knowledge wise, it’s untappable knowledge. It’s part of the Chaos domain.

The emergent risks are actually unknown-unknown risks or simply unknown risks, whereas novel risks are actually unknowable-unknown risks or simply unknowable risks. Again, do note that my explanation differs from many, including PMI. The figurative representation is shown below.

I’d also strongly recommend that, you read the followings articles:

Cynefin Framework, Risks and Agile: Known-unknowns, Unknown-unknowns, and Unknowable-unknowns

Risk Classification: Known-knowns, Known-unknowns, Unknown-unknowns, and Unknown-unknowns

Conclusion

Combining all that I've explained:

• Known-known is conscious knowledge or facts. You know that you know.
• Known-unknown is conscious ignorance. You know that you don't know.
• Unknown-unknown means unconscious ignorance. You don't know that you don't know.
• Unknowable-unknown means unexplorable and unconscious ignorance. You are unlikely know that you don't know.

Another question that comes-up is this: How about Black Swans? Is it related to unknowable-unknowns or unknown-unknowns? To a certain extent, black swans are unknowable-unknowns. Because these result in chaos. More specifically, black swans are distinguisged with their very low probabilities, but catastrphic impact. In other words, black-swans comes with a chance factor (very low), but with tremendous effect (very very high).

If you have understood so far in this article, then you have understood the difference between unknowable-unknowns, unknown-unknowns and the associated risks such as emergent risks and novel risks. 

References: 

[1] RMP Live Lessons - Guaranteed Pass or Your Money Back, by Satya Narayan Dash

[2] RMP 30 Contact Hours, with Full Money Back Guarantee, by Satya Narayan Dash

[3] Book - I Want To Be A RMP: The Plain and Simple Way To Be A RMP, Second Edition, by Satya Narayan Dash 

[4] The Standard for Risk Management in Portfolios, Programs and Projects, by Project Management Institute

Strategizing for Project Threats and Opportunities in Risk Management

 

Over a decade ago, I was put in charge of a group of projects. One of the projects had been running for almost a year, but had never seen a single live release to the customer! I realized there were too many unresolved risks, and asked the concerned project manager to put risk management, a new concept in the organization, as a top priority. Post identification and qualification of risks, any risk above the risk threshold value had to be brought down. If that was not done, I advised him no one should be allowed to work on the concerned project tasks.

This touched a raw-nerve.

One day a senior executive dropped by and asked about the guidance I had given to the project manager. In his mind, risk identification, qualification, and addition of reserves et al are sufficient, and I should not have stopped people from working on tasks.

My response was: “When you know a cyclone is going to hit in five days, do you wait to act on the fifth day or do you start immediately working to mitigate the expected impact?”

To elaborate a bit more, if a cyclone is about to hit, will risk identification help? Will risk qualification help? You know it won’t do much, though needed. How about quantification and adding reserves – say various cyclone shelters, food stock, etc. – will those help? Yes, but not fully. What is most needed in such a situation is risk mitigation. We can’t change the probability of the cyclone, but the first act of mitigation would be the evacuation of people. Risk mitigation is one risk response strategy.

In this article, I’d like to explore various such strategies.
At this stage, it’s important to note that risk response strategies are applicable in cases of both negative risks (threats) and positive risks (opportunities). You can learn more on individual project threats and opportunities here.

Risk Response Planning
The Project Management Body of Knowledge (PMBOK®) guide from the Project Management Institute (PMI®) has a specific process to develop various risk response strategies. It’s called Plan Risk Responses, and it’s defined as follows:

Plan Risk Responses is the process of developing options, selecting strategies, and agreeing on actions to address overall project risk exposure, as well as to treat individual project risks.

The goal here is to develop risk response options, strategies, and actions for both individual project risks and overall project risk. In other words, you are planning to minimize the threats (negative risks) and enhance opportunities (positive risks). With this process, the project manager allocates resources and inserts items and activities within the documents and the project management plan, in order to address said risks.

Obviously, both the Risk Register and Risk Reports are needed as inputs to address such risks (along with the Risk Management Plan). Remember, we are addressing both individual risks and overall project risk. See this depicted in the below flow diagram, with the highlighted process of Plan Risk Responses.

As shown, once you have the risk response strategies and associated actions, both the Risk Register and Risk Report have to be updated. You can learn more about the above flow diagram in this article on risk management framework.

Risk Response Strategies – What Happens?
In the Plan Risk Responses process, for the negative risks, we are trying to move the High Probability and High Impact risks to be of Low Probability and Low Impact, by taking response actions. The reverse is also true.

I’ve explained this in the below video [duration: 3m: 53s], the content of which has been taken from RMP Live Lessons, Guaranteed Pass. For the best experience, you may want to go full-screen in HD mode and plug-in your earphones.

Risk Response Strategies for Threats
Now, let’s look at various response strategies for individual negative risks or threats.

Escalate Response Strategy

The escalate response strategy is used when the project team or the project sponsor agrees that:

• The threat is outside the scope of the project.
• The project manager does not have the authority for the proposed response.

At this point, the risk is escalated to a program or portfolio or other suitable level. The project manager determines who should be notified. The escalated entity should be notified and the entity should also accept it. After escalation, the risk is not monitored by the team, but may be recorded in the Risk Register.

Example: A risk occurring in another project is impacting your project, so you escalate it to the level of a program or a portfolio.

Avoid Response Strategy
This response strategy is usually used for high priority risks, i.e., risks with high probability and a big negative impact. We can do two things here, either:

• Eliminate the risk completely, or,
• Protect the project from its impact.

Most of the time, the first (avoidance or elimination) is taken by changing the project management plan.

Example: You use a reliable technology platform for your project, instead of an unreliable, but cutting edge one.

Transfer Response Strategy *** UPDATED ***
Transfer of a risk is done by shifting the impact to a 3rd party, who will own the response. This method is usually best used for low impact risks. A risk premium has to be paid to the 3rd party.

Example: You go for an incentivized contract, such as Cost Plus Incentive Fee (CPIF), to transfer the risks to the buyer.

For more information about incentivized contracts, go to these articles of point of total assumption and range of incentive effectiveness. While the former is for Fixed Price Incentive Fee (FPIF) contract, the latter is for CPIF contracts. Do note that by transferring the risks, they are not gone! Rather, they will be addressed by the entity to which risks have been transferred.

Mitigate Response Strategy *** UPDATED ***
With a mitigate response strategy, you try to reduce the probability and/or impact of the risk. This is used for high priority risks (with high P and high I values). After reduction, the risk score should be within an acceptable threshold limit. You can learn more about the usage of risk threshold in this article on end-to-end risk management.

Example: You first build a prototype for a highly scalable product before going for full-fledged development.

Where mitigation is not possible due to probability, it’s best to look for mitigation responses which pull down the impact.

Accept Response Strategy *** UPDATED ***
In risk acceptance, no action is taken unless the risk occurs. Like transfer strategy, it’s used for low priority threats or used when it’s not possible to have a cost-effective solution which addresses the threat. The Project Management Plan is usually not changed in this case. A common risk acceptance strategy is to use contingency reserve.

Example: If there are frequent climate changes, you may accept such as a risk for your project.

Risk Response Strategies for Opportunities
Like threats, there also can be a number of risk response strategies for individual positive risks or opportunities.

Escalate Response Strategy
It’s very similar to the one we have seen earlier for negative risks, except that in this case it is for positive risks or opportunities. It’s used when the project team or the project sponsor agrees that the threat is outside the scope of the project and the project manager does not have the authority for proposed response.

Again, after escalation, the risk is not monitored by the team, but may be recorded in the Risk Register. This is another key distinction for this strategy compared to other strategies.

Example: A benefit occurring in another project has implications for your project and you escalate such to the level of a program.

Exploit Response Strategy
With this risk response strategy, you seek to eliminate uncertainty by ensuring that the opportunity is realized or that it definitely happens. It’s used for high priority opportunities.  A payment of a risk premium can be involved for the party taking on the opportunity.

Example: Using talented resources to complete work early with less cost.

Share Response Strategy
In this case, you allocate some or all of ownership of the opportunity to a third party. Because it’s a share response strategy, both sides benefit – the first owner and also the sharing owner. It can be considered the “mirror” part of transfer response strategy, which we have seen earlier for individual negative risks.

Unlike transfer, it is not completely handed over to another party. It is shared; however, risk sharing, like transfer response strategy, often involves premium payment.

Example: Your organization forms a joint venture or partnership with another organization to execute the project considering the benefits involved for both.

Enhance Response Strategy
With this response strategy, you increase the probability and/or the impact of an opportunity. Early enhancement is considered more effective. If you cannot increase the probability, try to increase the impact.

Example: You add more features to a product to sell more products.

Accept Response Strategy *** UPDATED ***
In this case, if the opportunity arises, it will be taken advantage of, but not actively pursued. It’s usually considered for low priority opportunities or if no cost-effective solution is available.

Example: A new project will takes advantage of a tax break, if an expected legislation is passed.

A Real-World Example and Exercise
Now that we have reviewed various risk response strategies, let’s do an exercise.

Scenario: You are driving to reach your office and become aware of possible heavy traffic on your traveling route through a radio warning or via global positioning system (GPS). Regardless, you have to reach your destination to attend an important meeting. You have the following options available, outlined in the below table.

   

Can you tell, based on the situation presented, which risk response strategy will best fit? Do note that the scenarios presented are for negative risks, and your response should be one of the strategies for each question.
 
I would suggest that you try this exercise on your own first before checking the solution, but I’ve explained in the below video [duration: 7m: 20s], taken from my RMP Live Lessons course what I advise. This clip also addresses an additional question related to contingency reserve and how it’s used in our scenario.




Comparison
As we reach the end of this article, I’d like to draw a comparison between the risk response strategies for threats vs. opportunities in the below table:
  
   
 
Finally, it’s not that an individual threat will have a single response strategy. If a threat can’t be avoided, then a project manager can mitigate to a level where it becomes viable to accept or transfer it. Similarly, if an opportunity can’t be fully exploited, it can be enhanced to a level where it can be viable to accept or share it.

--

This article was first published by MPUG.com on 3rd May, 2022. This is an updated and refined version.

References:
[1] Course: RMP Live Lessons, Guaranteed Pass or Your Money Back, by Satya Narayan Dash

[2] Course: RMP 30 Contact Hours with Money Back Guarantee, by Satya Narayan Dash

[3] Book: I Want To Be A RMP, The Plain and Simple Way, Second Edition, by Satya Narayan Dash

Cynefin Framework, Risks and Agile: Known-Knowns, Known-Unknowns, Unknown-Unknowns and Unknowable-Unknowns

Want to master Risk Management? Become a RMP, a specialized PMI certification.

Course at a very low cost: RMP Live Lessons Course - Guaranteed Pass or Money Back  [samples]

The guarantee has no hidden T&Cs—just take the exam!

The free article follows. 

--

The Cynefin framework is important to know for both aspiring Risk Management Professionals (RMP) and aspiring Project Management Professionals (PMP).

First, it’s a complexity model and it helps making decisions in a complex environment. The Project Management Institute (PMI) defines complexity as noted below:

"Complexity is a characteristic of a program or project or its environment that is difficult to manage due to human behavior, system behavior, and ambiguity."

Simply put, a complex thing is difficult to manage. The sources of complexity can be human behavior, system behavior, ambiguity, uncertainty, among others. All of these sources and complexity itself can result in risks.

Before proceeding further, I’d suggest that you read the article related to risk classification to understand fundamentals of knowns and unknowns. 

Cynefin Framework and Five Contexts

The Cynefin Framework has five problem and decision-making contexts (or domains). This framework helps in detecting the cause and effect relationship, which in turn helps in decision-making. 

Now, let’s understand the five domains in this framework. The framework’s five contexts are shown in the below figure. Later, we will learn how to apply it in Risk Management.  

Obvious (Simple): 

• The cause and effect relationship is obvious. You know the questions and know the answers. Hence, little to no expertise is needed. 
• The approach used here is sense-categorize-respond. You sense the environment/context, categorize them and based on that you respond. 
• Best practices are applied to make decisions.

Complicated: 

• The cause and effect relationship is not obvious. You know the questions, but don’t know the answers and hence, seek expert knowledge to analyze and get a range of answers. 
• The approach used here is sense-analyze-respond. Unlike Obvious context, you use expert judgment to analyze after sensing. 
• Good practices are applied to make decisions.

Complex: 

• There is no apparent (visible/demonstrable) cause and effect relationship. You don’t know the questions and don’t know the answers! In such a case, no amount of analysis will help. You have to first probe or experiment.
• One uses repeated cycles of probe-sense-respond as complex systems or environments change due to external stimulus. 
• Emergent practices (practices which are not completely known, but emerging or taking shape) are applied to make decisions.

Chaotic: 

• The cause and effect relationship is unclear. There is too much confusion. There is no point in searching for questions and answers, because the cause and effect relationship is impossible to determine and constantly shifting. The situation is too drastic or chaotic. 
• Your immediate and first step is to act or contain and then stabilize the situation. Hence, the approach used here is act-sense-respond. As you can see, you are first acting here, not sensing or probing. You are acting to stabilize. 
• Novel practices (completely new practice, never known to exist before) can be applied to make decisions.

Disorder: 

• This is the space in the middle as shown in the figure. In this case, you don’t even know where you are, hence disorder (not unordered).
• To understand, you have to break the environment/system into smaller parts and move into one of the other four zones or have contextual links with one of the other four zones of Obvious, Complicated, Complex and Chaos.

Cynefin Framework and Risk Management

Now, let’s see how this framework can be used in the context of Risk Management. 

Obvious (Simple) [Known-Knowns]: 

• In risk management parlance, this is the realm of known-knowns. You know the risk (known), and also the know the amount of work (known) needed. 
• In other words, these are actually not “risks”, but documented requirements and addressed as part of the scope management. 
• As noted before, best practices are applied here. Best practices by its very nature come from past practices.

Complicated [Known-Unknowns]: 

• In risk management parlance, this is the realm of known-unknowns. You know the risk (known), but don’t know the rework (unknown).
• These are classic risks or the “known risks” - the known risks with unknown or unforeseen work.
• You predominantly apply good practices of risk management in this context. Usually good practices are either known to you or known to someone within the community. 
•  The practices can be iterative processes for risk management, having contingency reserve, having contingency plans etc.

Complex [Unknown-Unknowns]: 

• In risk management parlance, this is the realm of unknown-unknowns. You don’t know the risk (unknown), and don’t know the rework (unknown).
• In other words, these are “unknown risks” - the unknown risks with unknown or unforeseen work. 
• As noted earlier, you apply emergent practices. Emergent practices are neither known to you or others because it's emerging based on the context. 

Chaotic [Unknowable-Unknowns or Unknowables]: 

• In risk management parlance, this is the realm of unknowable-unknowns or simply the unknowables. You don’t know the risk and exploration is also not possible (unknowable). And of course, you don’t know the rework (unknown).
• As noted earlier, you apply novel practices here. Novel practices are completely unseen and no one actually knows till the situation occurs and actions are taken.

Slightly modifying our previous figure, one can have the below figure. 

Cynefin Framework and Agile

Agile concepts and approaches are now part of both RMP and PMP exams. The Cynefin framework can also be used in Adaptive (or Agile) environments. 

• Obvious (or Simple) context: Go for a predictive or waterfall development approach.
• Complicated context: One can go either for an iterative or incremental development approach.
• Complex context: Here, one can use both iterative and incremental development. Agile is both iterative and incremental.
• Chaos Context: Agile development approach can’t be used here. You have to first sense some stability and respond by taking steps to get into the Complex zone. 

References: 

[1] RMP Live Lessons - Guaranteed Pass or Your Money Back, by Satya Narayan Dash

[2] RMP 30 Contact Hours, with Full Money Back Guarantee, by Satya Narayan Dash

[3] Book - I Want To Be A RMP: The Plain and Simple Way To Be A RMP, by Satya Narayan Dash 

[4] A Leader’s Framework for Decision Making, by David J. Snowden and Mary E. Boone

[5] A Guide to Project Management Body of Knowledge, 7th edition, by Project Management Institute (PMI)