The project manager should consult or review project contracts, lessons learned registers from
analogous projects, and the risk management plan to develop an effective risk planning for the
project.
According to the PMBOK® Guide, the risk management plan is one of the key inputs for the plan risk
management process, which is the first process in the project risk management knowledge area. The
risk management plan describes how risk management activities will be structured and performed
throughout the project. It includes information such as the methodology, roles and responsibilities,
budget, timing, risk categories, definitions of risk probability and impact, probability and impact
matrix, revised stakeholders’ risk tolerances, reporting formats, and tracking (page 409). Therefore,
option D is the correct answer.
The project contracts are also an important input for the plan risk management process, as they may
contain terms and conditions that can create or affect various project risks. For example, contracts
may include clauses related to penalties, incentives, warranties, intellectual property rights,
termination, force majeure, arbitration, indemnification, etc. The project manager should review the
project contracts to identify any potential sources of risk and plan appropriate responses (page 410).
Therefore, option A is the correct answer.
The lessons learned registers from analogous projects are another valuable input for the plan risk
management process, as they provide historical information and knowledge that can help the project
manager identify and analyze risks, as well as plan risk responses. The lessons learned registers may
contain information such as the risks that occurred, the root causes of the risks, the risk triggers, the
effectiveness of the risk responses, the residual and secondary risks, the risk owners, the risk ratings,
the risk trends, etc. The project manager should consult the lessons learned registers from similar or
comparable projects to learn from past experiences and avoid repeating mistakes (page 411).
Therefore, option B is the correct answer.
The risk register is not an input for the plan risk management process, but an output. The risk
register is a document that contains the list of identified risks, their causes, potential responses, and
other relevant information. The risk register is created during the identify risks process, which is the
second process in the project risk management knowledge area. The risk register is then updated
and refined throughout the project as more information becomes available and new risks emerge
(page 414). Therefore, option C is incorrect.
The code of regulations is not an input for the plan risk management process, but a type of
enterprise environmental factor. Enterprise environmental factors are the conditions, not under the
control of the project team, that influence, constrain, or direct the project. The code of regulations
refers to the rules and standards that govern the project’s industry, domain, or sector. The code of
regulations may affect the project’s scope, schedule, cost, quality, resources, communications,
procurement, and risk management. The project manager should consider the code of regulations
when planning risk management activities, but it is not an artifact that needs to be reviewed or
consulted (page 38). Therefore, option E is incorrect.
Reference: PMBOK® Guide, pages 38, 409-411, 4141
