Portfolio Risk Management: Find the Risk Shared by Projects

Portfolio risk management keeps the risk across every project, programme and operation in a portfolio consistent with the organisation's risk appetite, the amount of risk it is willing to carry to pursue its strategy. PMI's outline describes it as balancing and managing portfolio risk against that appetite so that decisions can be made.

A component is any project, programme or operational work item inside the portfolio. The governance board is the senior group that approves portfolio decisions. Portfolio risk differs from project risk in what it protects and who acts on it:

The register, reserve and dependency rows follow Domain 4 of PMI's PfMP® outline (Tasks 3, 4 and 6). The last row is our recommendation.

Project registers record each project's chance of loss separately, so they hide whether the losses share a cause. In our model of eight identical projects, the expected overrun is the same ₹3.6 crore either way, yet a shared cause raises the chance of losing ₹12 crore or more from 2.1% to 15%.

The model is ours, not an official figure. Each project has a ₹10 crore budget (₹1 crore is ₹10 million, so the portfolio is ₹80 crore) and a 15% chance of a ₹3 crore overrun. We compared two cases and ran 200,000 simulated trials of each, then checked the results by formula:

In the shared case, one event, such as the loss of a supplier team that staffs all eight projects, produces all eight overruns together: a 15% chance of ₹24 crore. A ₹3.6 crore reserve built from the project contingencies is then short by ₹20.4 crore whenever the event happens. Each project register still shows a 15% risk of ₹3 crore.

This is tail risk: a rare, very large loss that an average hides. Real portfolios sit between the two columns, because causes are rarely shared by every component. Treat the shared column as the upper bound for any one driver.

The concentration test is five checks run across every project register, each looking for a team, supplier, date, platform or risk wording that recurs in three or more registers. Any failure becomes one entry in the portfolio register, with exposure counted once across all affected components. We use three as the trigger because two projects sharing a cause can be settled between two project managers; this threshold is our recommendation.

How do you test whether the same people or team sit in several projects?

Search the resource and dependency fields of all registers for names.

• Fail: the same person or team appears in three or more registers.
• Pass: none does, or each has a portfolio register entry with a named owner.

How do you test whether one supplier supports several projects?

List every vendor and contract named in the registers.

• Fail: one vendor or contract supports three or more components.
• Pass: no vendor does, or each one that does has a portfolio register entry.

How do you test whether several projects depend on one fixed date?

List regulatory deadlines, audit windows, the 31 March financial year-end and go-live slots.

• Fail: three or more components depend on the same date.
• Pass: no date is shared that widely, or each shared date has a portfolio register entry.

How do you test whether one platform change touches several projects?

List the systems, data centres and cloud migrations each component touches.

• Fail: one platform change touches three or more components.
• Pass: none does, or each has a portfolio register entry.

How do you test whether a "low" risk repeats across registers?

Search for risk wording that recurs, whatever its rating.

• Fail: the same risk is rated Low or Medium in three or more registers.
• Pass: no risk recurs that widely, or each recurring risk has been rescored.

Rescoring means recording the exposure if the driver hits all affected components, as in the model above, and flagging the entry as tail risk when the probability is low but the exposure is large.

A portfolio risk register holds one row per risk to strategic goals or business value, whether it was escalated from a component or found by the concentration test. Each row needs a cause, a count of affected components, a ₹ exposure for one hit and for all hits, a probability, a named owner and a trigger.

A filled example from the model: Because one supplier team staffs all eight projects, losing the team delays delivery and overruns budgets, threatening this year's delivery objective. Components: 8. Driver: supplier team. Once: ₹3 crore. All: ₹24 crore. Probability: 15% (assumed). Expected loss: ₹3.6 crore. Tail flag: yes. Response: contract a second team; trigger: notice of any change to the team.

The columns follow the dependency analysis, register and reserve tasks in the outline. That outline asks the portfolio manager to recommend a portfolio management reserve, and obtain approval for it, based on aggregate portfolio risk exposure. Our recommendation is to size it from the combined distribution, as the model does, and agree the percentile with the governance board. Summing project contingencies gives only the expected figure, ₹3.6 crore in the example, against a ₹24 crore tail.

The governance board sets the acceptable level of risk for the whole portfolio, and a component escalates a risk when that risk exceeds the component's share of it. The outline lists setting this level, from organisational and stakeholder tolerances, as the first task of the domain.

Risk tolerance is the acceptable variation around one objective, such as a 10% budget overrun. A threshold is the point at which a risk must go up a level. Our recommendation is that the PMO divides the board's appetite across components, giving more to those that contribute more strategic value, which is the logic in our portfolio strategic alignment framework.

Our escalation test, also a recommendation: escalate when a component's exposure exceeds its allocated share of the board's appetite, or when its risk names a shared driver already in the portfolio register. Our guide to when a programme should escalate a risk adds criteria for programme level.

PMI's outline gives Portfolio Risk Management 15% of exam items across six tasks: set the acceptable risk level, write the risk plan, analyse dependencies, keep the portfolio register, build shared ownership, and recommend a reserve from aggregate exposure. The outline states 170 questions: 150 scored and 20 unscored pretest items.

All six tasks are about the portfolio as a whole. When one answer option fixes a single project and leaves the shared driver untouched, we treat it as incomplete; this is our advice, not a rule from PMI. Check PMI's PfMP® page for the current outline and requirements, and read what PfMP® certification covers for the full scope of the credential. PMI awards the credential.

Our PfMP® training covers the PMI Standard for Portfolio Management and the exam content outline across portfolio strategy, governance, performance and risk. Our founder, Sanjeev Kumar, has over 20 years in project, programme and portfolio management.

PfMP® preparation comes in live-online, self-paced and personal mentoring formats. These are the routes:

• PfMP® Self-Paced Program (US$549): studio-recorded video modules, recorded Q&A sessions, application guidance, 1,000+ exam-preparation questions with detailed explanations, and mind maps.
• PfMP® Fast Track Program (US$1,100): focused group mentoring that guides professionals preparing for the PMI PfMP® certification.
• PfMP® Application Writing and Review Support (US$199): help to prepare, structure and review your application before submission to PMI, until it is approved.

As of October 2026, the PfMP® Self-Paced Program costs US$549, the PfMP® Fast Track Program US$1,100 and PfMP® Application Writing and Review Support US$199, each per enrolment. Pricing varies by programme and market, and groups of three or more can receive discounts of up to 20%.

Across the 6,000+ professionals we have mentored, our first-attempt success rate is 98.5% as of October 2026. That figure covers all our PMI certification mentoring, not PfMP® alone, and our first-attempt claim methodology defines the cohort. Digital products are non-refundable, so book the free discovery or eligibility consultation first, then choose a programme in our course store.