NIGP Certified Procurement Professional (CPP) Module A Practice Exam

In procurement, risk management is about identifying potential events that could affect the project's objectives, assessing how likely they are and how big an impact they could have, and then prioritizing those risks so you can focus mitigation where it matters most. The best basis for rating and prioritizing risks is the solicitation criteria because those criteria define what matters for the project: the requirements, constraints, evaluation factors, and compliance obligations. When you align risk scoring with the solicitation criteria, you target risks that could prevent meeting the advertised goals—such as technical feasibility, supplier capability, schedule, and cost—and allocate effort to the most significant threats. A properly kept risk register supports this process as a living document that records each identified risk, its owner, likelihood, impact, priority, and planned mitigations. It should be used throughout the procurement lifecycle, not only after award. Relying on external auditors’ reprimands as a basis for risk priorities isn’t appropriate, since those findings do not define the specific risks relevant to the procurement objectives.