The ascent of risk

risk and the Guide to the project management body of knowledge (PMBOK guide), 1987-1996-2000-2004


This paper traces the evolution of the discipline of risk management within the Project Management Institute's (PMI®) Guide to the Project Management Body of Knowledge (PMBOK® Guide) from 1987 to 2004. Risk management is illustrated by the author's recent trekking experience in the Solu Khumbu (Mt. Everest) region of the Himalayas.


Roger Goodman PMP® is Principal Instructor of Management Concepts Asia-Pacific, and former Vice-President of PMI New Zealand. He is a charter member of the New Zealand Society of Risk Management.


The Project Management Institute (PMI®) was founded in 1969 to establish: a professional body for practising project managers: project management standards: ongoing professional development programmes.

Background to the Guide to the Project Management Body of Knowledge (PMBOK® Guide)

In 1987 the first attempt at describing the knowledge and processes of project management was published as “The Project Management Body of Knowledge”. This document was promulgated by PMI as representing core competencies for project managers and became the basis of a professional certification standard, the Project Management Professional (PMP®) introduced in 1984.

Evolution: Since 1987 the disciplines of project management have evolved more and more into a profession in its own right and the membership of the PMI actively engage in the addition of knowledge and processes through contributions to the PMI‘s monthly publications, PM Network, PMI Today, the quarterly research publication Project Management Journal, annual conference proceedings and participation on various standards committees.

Ascent of Risk

The PMBOK® Guide of 1987 described 8 knowledge areas in terms of their functions. Of these knowledge areas risk management was a minor component in relation to the triple constraints of scope, time, and cost. Risk management was described in terms of identification, analysis and response.

1996 brought a major revision of The PMBOK® Guide including its renaming “A Guide to the Project Management Body of Knowledge (PMBOK® Guide) to reflect that it was not the sum total of knowledge on project management. Function areas were replaced with Knowledge areas and the classification of the 5 process groups were added to the PM Context chapters. The knowledge areas represented 37 project management processes. Risk Management, as a knowledge area, comprised four processes: identification, quantification, response development and response control. Risk response was defined in terms of acceptance mitigation and avoidance.

The 1996 Risk Management Chapter

The 1996 Risk Management Chapter

The 2000 Risk Management Chapter

The 2000 Risk Management Chapter

In 2000, after extensive consultation with PMI members (the draft was released in 1998), A Guide to the Project Management Body of Knowledge (PMBOK® Guide) 2000ed was released. The knowledge areas were expanded from eight to nine with the inclusion of integration and the processes expanded to 39. Risk management was completely rewritten being expanded from 4 process areas to six and from 40 to 80 paragraphs. In addition to a whole new treatment of quantification, qualitative followed by quantitative, risk response planning now added transfer as a strategy.

A Guide to the Project Management Body of Knowledge (PMBOK® Guide) 2000ed was released and acknowledged by the American National Standards Institute (ANSI) as the standard for project management.

Coincidentally the Project Management Professional (PMP®) certification process gained ISO 9000 accreditation. This greatly strengthened PMI‘s ability to set standards and to be recognised internationally as a world class project management body.

2004 PMBOK® Guide Project Risk Management Changes

The 2004 Third Edition has placed more emphasis on the project management processes, which have expanded to 44. Seven processes have been added, thirteen renamed, and two deleted for a net gain of five processes.

Structural Changes

Chapter 3 is renamed “Project Management Processes for a Project” and has been moved from Section I to a new Section II, which is now called “The Standard for Project Management of a Project.” As part of this change, Chapter 3 has been extensively revised to clearly indicate that the processes, inputs, and outputs called out in the chapter are the basis of the standard for project management of a single project.

Process Name Changes

The names of processes in the various chapters of the PMBOK® Guide – 2000 Edition are in different formats and styles. As an example, the processes in the Scope Knowledge Area are Initiation, Scope Planning, Scope Definition, Scope Verification, and Scope Change Control. Some of these are active voice; some are present participles. The effect of these different styles is that readers are unable, at a glance, to determine whether a term is an activity (a process) or a deliverable (a work-product or artefact). The project team proposed a wholesale change of all process names to the verb-object format in the PMBOK® Guide – Third Edition. However, PMI authorized only an incremental change to include only those approved new processes and a small number of other processes; so confusion continues!

Elimination of Facilitating and Core Process Designations

The terms “Facilitating Processes” and “Core Processes” are no longer used, to ensure that all project management processes have the same level of importance. The project management processes are still grouped within 5 Process Groups; Initiating; Planning; Executing; Monitoring and Controlling; and Closing. The 44 project management processes are mapped into both the Project Management Process Groups and the Knowledge Areas.

Writing Styles

A Style Guide was developed and used by the project team to create and finalize the input. Attention was focused on using active voice language and content consistency throughout the document to prevent an occurrence of different writing styles.

Chapter 11 has been updated to increase focus on opportunities (versus threats). It includes options based on project complexity, enhances Risk Management Planning activities, adds the risk register, and provides closer integration with other processes. The chapter headings remain unchanged.

Risk identification has been reworked with the new concept of the “Risk Breakdown Structure” (RBS) replacing the WBS, and an enhancement of the risk register as an output of the planning process to become primary inputs to risk identification.

A major difference between the draft version of the 2004 PMBOK® Guide and the final 3rd Edition was the dropping of the Project Charter as a key input in risk planning and risk identification

The whole of Risk Response Planning has been enhanced to emphasise the positive (opportunities) as well as the negative (threats) aspects of risk.

Risk response planning now consists of four components.

  • Negative risk response: avoid, mitigate, transfer and accept.
  • Positive risk response: exploit, share and enhance.
  • Threats and Opportunities response: acceptance with a contingency reserve (time, money or both).
  • Contingent response: a response plan which is shelved and is dependent on a trigger.

Risk monitoring and control now includes new concepts, work performance information, risk reassessment, risk audits, and reserve management.

Whilst there are still six risk process areas, the number of paragraphs is now 58 and the whole chapter is greatly expanded.

These changes represent a major revamp of PMI‘s risk management thinking and draws its influence from main stream risk management e.g. insurance and corporate governance business risk as well as the College of Performance Measurement, now a close affiliate of the PMI.

Risk now has a “meta-language” to assist in risk identification; cause, event, impact, rather like the English construct of subject, verb, object.

As an enhancement to the regular chapter boxes, at the beginning of each chapter there is a detailed flow chart showing the process and data flows from and to, the various Risk management components.

The 2004 Risk Management Chapter

The 2004 Risk Management Chapter

The 2004 Risk Management process relations

The 2004 Risk Management process relations

The Project Charter:

To have a team of people of diverse, ages, skills and cultural backgrounds, experience the beauty and grandeur of the Everest region in partnership with the Sherpa people and celebrate the 50th anniversary of Sir Edmund Hillary’s first ascent on May 29th 1953.

To work as a team to achieve their personal goals and thrive in a dangerous and harsh environment.

Using the sophisticated technique of sorting through my “Outlook Address Book” searching for likely candidates, I set up a group e-mail to some 50 friends and acquaintances who, at some time or another, had expressed an interest in the Himalayas and the possibility of “trekking” in the foothills, to Mt Everest Base Camp, at about 18,000 ft. As the number of “wannabees” gradually diminished over the next 6 months, we were left with a core of 15 trekkers ranging in age from 25 to 85!

The Project Plan:

  • Over a ten day period, to ascend in stages from 2,500 metres and cross a high pass at 5,500 meters.
  • Ascend no more than 1000 metres in a day
  • To use local Sherpa Sirdar and porters
  • Trek 10-15 kilometres per day
  • To stay in lodges
  • To stay fit and well

Statement of Risk:

Sudden sustained exposure to high altitude, in excess of 3,000 metres, may cause pulmonary oedema and cerebral oedema, leading to pulmonary distress, disorientation and failure of cognitive function resulting in DEATH.

The Route

The Route

High Altitude Pulmonary Oedema (HAPE) and High Altitude Cerebral Oedema (HACE) are the end stages of Acute Mountain Sickness (AMS) the commonest form of death in mountainous regions for non-acclimatised humans (and I suppose other animals). HAPE and HACE kill more people each year than avalanches or mountaineering disasters, their onset maybe insidious to the patient who often succumbs from the loss of ability to reason.

The Risk Environment:

  • At sea level air pressure is 760 mm Hg
  • At 3,000 metres air pressure is 540 mm Hg
  • At 6,000 metres air pressure is 370 mm Hg


  • At 3,000 meters O2 saturation in the blood falls from 99% to 75-80%
  • 90% O2 is the lower limit of normal (say after holding your breath for 1-2 minutes)

Ascent has two effects, a decrease in temperature (approximately 6.5°C per 1000 metres) and a decrease in air pressure. The decrease in air pressure was the most significant factor as the ascent from sea level to 3,000 metres was accomplished in less than two days and all team members experienced mild symptoms of AMS, headache and nausea in the first 24 hours. These symptoms recurred at different times for various individuals as the rate of ascent varied.

Risk Triggers:

  • Sudden ascent
  • Sustained exercise at high altitude
  • Prior exposure to HAPE and HACE
  • Prior experience of Acute Mountain Sickness (AMS)

There is no accurate predictor of who will suffer AMS, except those who have shown themselves susceptible from prior exposure to high altitudes. Several well known mountaineers, the most famous being Sir Edmund Hillary the first man to summit Mt Everest (8,848 meters) in 1953, are now unable to sustain heights over 2,500 metres.

Risk Response Plan:


  • The use of acetazolamide (Diamox) to prevent the onset of HAPE and HACE
  • Ascend no more than 300 metres per day
  • Rest for 2 nights every 1,000 metres
  • Don't go

Risk avoidance is changing the project plan to eliminate the risk or condition or to protect the project objectives from its impact. Although the project team can never eliminate all risk events, some specific risks may be avoided.

All team members carried Diamox and most took it prophylacticly, and all who experienced moderate AMS used it to combat the symptoms. In addition the PM, who experienced HAPE, took Dexamethasone to prevent HACE.


  • To whom?
  • The body's homeostatic mechanisms
    • Haemopoetic effect
    • ↓ plasma volume ↓ extracellular fluid volume
    • Erythropoietic effect

Risk transfer is seeking to shift the consequence of a risk to a third party together with ownership of the response. Transferring the risk simply gives another party responsibility for its management; it does not eliminate it.

The decrease in body fluid has the effect of concentrating the blood to increase its oxygen carrying capacity. With increased viscosity comes the risk of stroke and pulmonary embolus as well as pulmonary hypertension. The haemopoetic effect is twofold, the release of red blood cells from the spleen and the production of more red cells from bone marrow, causing a further concentration of the blood (and viscosity) to increase its oxygen carrying capacity.


  • Prior acclimatisation
    • Breathing reduced O2 at sea level

      ▪ One hour per day 5 days a week for three weeks 3 months in advance

      ▪ Sustained reduction of O2 to 70%

  • Increased fitness – cardiac and pulmonary output
    • Exercise program 6 months in advance

      ▪ Rugged terrain hikes of 10-20 Km.’s each weekend

      ▪ 2x hikes per weekend in the last month

Risk mitigation seeks to reduce the probability and/or consequences of an adverse risk event to an acceptable threshold.

By the time team members had ascended to altitude more than 50% had completed all their fitness training. Those who experienced physical difficulty in the first 3 days were allocated to the “low altitude” team and did not ascend above 4,000 metres.


  • Descend as fast and safely as possible
  • Provide bottled O2
  • Dexamethasone 10mg qid
  • Identify medical help
  • Provide alternate transport (horse)
  • Evacuate by helicopter to <3,000 metres

Active Risk acceptance may include developing a contingency plan to execute, should a risk occur. Passive acceptance requires no action, leaving the project team to deal with the risks as they occur.

When the symptoms of acute AMS occurred i.e. when the PM suffered HAPE the team descended as rapidly as possible from 5,500 metres to 4,200 metres in less than a day.

Oxygen was brought in and used within 24 hours of the onset of symptoms. Within 48 hours the two teams were evacuated to 1,500 meters.

Risk Monitoring & Control:

  • BP and O2 saturation readings tds.
  • Daily health checks
    • Use of a standardised assessment method for acute mountain sickness (AMS)
    • Subjective judgement
    • Cognitive function testing
    • Invoke Risk response plan

The Lake Louise self-assessment protocol was used on a daily basis providing a standardised methodology for assessment of AMS. Regular checking of blood pressure and oxygen saturation levels both at rest and under exertion provided additional diagnostic evidence of emerging HAPE. It was interesting to note that a fit young Sherpa, well acclimatised recorded the highest resting blood pressure of 185 mm Hg. There was no difference in oxygen saturation between Sherpas and trekkers although the Sherpas evidenced sustained stamina, possibly due to long term changes in their skeletal musculature.

Modify the Project:

  • Two teams
    • High altitude team to 5,500 metres
      • Ages from 23 to 63
    • Not so high altitude team to 4,000
      • Ages form 42 to 86
    • Two Sirdars, porters and backup personnel

A preliminary plan to split the party into two teams was activated on day three with the members self selecting.

The Results:

  • Only the PM experienced the RISK because he triggered it!!
  • All aspects of the RISK response strategy worked
  • Other goals of the project achieved

After a strenuous day of trekking which ascended some 300 metres the PM and a colleague, feeling “good” and bored with sitting around after lunch, decided to climb a nearby peak approximately 250 metres higher, to watch the sunset.

They achieved their goal, returning in total darkness and feeling quite exhausted, The mountainside had been steep with loose shale and boulders which made climbing difficult. That night the PM experienced some breathing discomfort with evidence of Cheyne-Stokes breathing and frank snoring. The next day, during the ascent of the next 450 metres to cross the high pass, the PM found himself trailing at the back of the team with little energy. At the pass the PM‘s oxygen saturation was just over 60% and, even with hyperventilating and Valsalva manoeuvres, his oxygen saturation did not rise above 80%. The other team members were at around 90%. Descent as fast as possible, given that it is not always down, was achieved with some risk as the trek had to be extended into the dark to accomplish two days distance to gain the descent required. This may have had a self limiting effect, further debilitating the muscles. All team members were helicoptered out from 3,800 metres to 3,000 metres and then, the same day, flown to 1,500 metres where symptoms rapidly dissipated.


Project Management Institute. (1996) A guide to the project management body of knowledge PMI Standards Committee. Upper Darby, PA: Project Management Institute.

Project Management Institute. (2000) A guide to the project management body of knowledge (PMBOK®) (2000 ed.). Newtown Square, PA: Project Management Institute.

Project Management Institute. (2004) A guide to the project management body of knowledge (PMBOK®) (Third Edition.). Newtown Square, PA: Project Management Institute.

Ward MP, Milledge JS, & West JB (2000) High Altitude Medicine and Physiology. 3rd Edition. London Great Britain. Arnold, a member of the Hodder Headline Group


© 2005, Roger K Goodman
Originally published as a part of 2005 PMI Global Congress Proceedings – Singapore



Related Content

  • Project Management Journal

    Narratives of Project Risk Management member content locked

    By Green, Stuart D. | Dikmen, Irem The dominant narrative of project risk management pays homage to scientific rationality while conceptualizing risk as objective fact.

  • Project Management Journal

    Identifying Subjective Perspectives on Managing Underground Risks at Schiphol Airport member content locked

    By Biersteker, Erwin | van Marrewijk, Alfons | Koppenjan, Joop Drawing on Renn’s model and following a Q methodology, we identify four risk management approaches among asset managers and project managers working at the Dutch Schiphol Airport.

  • Project Management Journal

    Collective Mindfulness member content locked

    By Wang, Linzhuo | Müller, Ralf | Zhu, Fangwei | Yang, Xiaotian We investigated the mechanisms of collective mindfulness for megaproject organizational resilience prior to, during, and after recovery from crises.

  • PMI Case Study

    Saudi Aramco member content open

    This in-depth case study outlines a project to increase productivity with Saudi Arabian public petroleum and natural gas company, Saudi Aramco.

  • PM Network

    A certeza da incerteza member content open

    By Fewell, Jesse Por mais que ansiamos por um retorno pré-pandêmico, é ingênuo pensar que as velhas formas de trabalho um dia voltarão - mesmo para o ágil.