Skip to Main Content

What exactly is a Risk Breakdown Structure? PMP question!

Quote

I'm studying for the PMP and came across the term "Risk Breakdown Structure" in the PMBOK. I kind of get that it's like a WBS but for risks? But I'm not really sure how it's used, or how detailed I need to know it for the exam. Can someone explain what a Risk Breakdown Structure actually is, and when you’d use one?

Quote

Great question — and yes, the Risk Breakdown Structure (RBS) can definitely feel a little fuzzy at first, especially when you're trying to cram in so many other project management terms and tools for the PMP exam. But once you get a handle on it, the RBS becomes a really helpful way to think about risk — and it might even show up on the exam in a question about risk identification or planning.

Let’s walk through what it is, how it works, how it compares to the WBS, and what you need to know for the exam (and for real-world projects too, if you're going that route!).


What is a Risk Breakdown Structure?

A Risk Breakdown Structure is basically a hierarchical chart or diagram that breaks down project risks into categories and subcategories. Think of it like a WBS (Work Breakdown Structure) — except instead of organizing work, you're organizing risks.

It’s part of the Project Risk Management knowledge area and typically shows up during the Identify Risks process. The goal of using a Risk Breakdown Structure is to help teams look at risk in a more structured and comprehensive way — instead of just listing individual risks randomly, the RBS helps group them by source or category.


The Structure of an RBS (How It’s Organized)

A typical Risk Breakdown Structure starts with broad risk categories at the top level, then breaks those down into more specific subcategories as you move down the chart.

Here’s a simple example:

Level 1 – High-level Categories

  • Technical

  • External

  • Organizational

  • Project Management

Level 2 – Subcategories Under Technical, for example, you might see:

  • Requirements risks

  • Design risks

  • Technology risks

Under External, you could have:

  • Regulatory risks

  • Market risks

  • Supplier risks

And so on.

Each of these can even be broken down further if needed. The idea is to create a visual structure of where your risks might come from, making it easier to identify them during risk planning.


Why Use a Risk Breakdown Structure?

So, why go through the trouble of building out an RBS instead of just making a list of risks?

Here are a few solid reasons:

  1. It helps uncover risks you might overlook.
    By organizing risks by source or category, you’re less likely to miss important areas — like external threats, legal issues, or internal process failures.

  2. It supports a more thorough risk identification process.
    When your team sees a visual breakdown of potential risk categories, it encourages broader thinking and collaboration during brainstorming sessions.

  3. It makes it easier to communicate with stakeholders.
    Some stakeholders might not want to dig into every single individual risk, but they’ll appreciate seeing the “big picture” of where your project’s vulnerabilities lie.

  4. It can improve how you prioritize risks later.
    After you identify and assess risks, having them grouped in an RBS can help you see which categories are most problematic and where to focus your risk response strategies.


RBS vs WBS: What's the Difference?

This is a common source of confusion on the PMP exam, so it's worth being really clear.

Work Breakdown Structure (WBS) Risk Breakdown Structure (RBS)
Organizes work into manageable chunks Organizes risks into categories
Helps with scope definition and schedule planning Helps with risk identification and analysis
Focused on deliverables Focused on sources of risk

If a question on the PMP mentions analyzing or categorizing deliverables, it’s probably referring to the WBS. If it’s about identifying or organizing risks, it’s pointing to the RBS.


What Should You Know for the PMP Exam?

While you don’t need to memorize a specific RBS chart, you should definitely understand:

  • What a Risk Breakdown Structure is

  • When it’s used (during the Identify Risks process)

  • Why it’s helpful (better risk identification and categorization)

  • How it’s structured (hierarchical, organized by categories and subcategories)

The exam might give you a scenario where a team is struggling to identify all the potential risks in a project and is missing external or organizational threats. The correct answer in that case could be something like:

“Use a Risk Breakdown Structure to categorize and identify additional risks.”


Example of an RBS in Action (PMP Style)

Let’s say you’re working on a software implementation project. During risk planning, your team uses a Risk Breakdown Structure that includes these top-level categories:

  • Technical risks

  • External risks

  • Organizational risks

You dig into each of these areas:

  • Under Technical risks, you identify concerns about new APIs not integrating smoothly.

  • Under External risks, you flag potential supply chain issues due to overseas vendors.

  • Under Organizational risks, you uncover that the team lacks formal training in the new system, which could delay adoption.

Without the RBS, you might have focused only on technical concerns and missed the broader picture. This is exactly why it’s such a useful tool — and why PMI wants you to know about it for the exam.


How Do You Create an RBS?

You don’t need to build one from scratch for the exam, but knowing how it’s typically created can help you understand how it works:

  1. Start with broad categories based on past project data, industry standards, or organizational templates.

  2. Break each category down into more detailed subcategories (e.g., from “External” to “Regulatory” to “New legislation risk”).

  3. Use it as a guide during risk identification meetings or brainstorming sessions.

  4. Update it as you go — risk categories may evolve as the project unfolds.

Some companies or industries already have RBS templates you can use as a starting point. Others build one custom for each project, especially for large or high-risk initiatives.


Final Thoughts: Why RBS Matters

The Risk Breakdown Structure may not be the flashiest tool in your PMP toolkit, but it’s a really practical one. It adds structure to what can often feel like a chaotic or subjective process — identifying all the ways a project could go off the rails.

Here’s your key takeaway:

A Risk Breakdown Structure helps project managers identify and organize risks based on their sources. It’s used during the risk planning phase and supports more effective risk identification and response planning.

On the PMP exam, remember:

  • It’s not used to plan the work (that’s the WBS).

  • It is used to categorize and structure risk identification efforts.

  • It can help teams think more clearly and holistically about risk — which is exactly what PMI wants to see.

You’ve got this — and if a Risk Breakdown Structure question comes up, now you’ll know exactly what it’s about!