Monitor Residual and Secondary Risks

Domain IV introduced residual and secondary risk as a consequence of implementing a response; this task is about actually watching them over time rather than assuming they've been handled once the response is executed. Monitoring the risk response means documenting residual risk as it stands after the response — confirming how much of the original risk is genuinely still there — and separately watching for secondary risks the response itself may have introduced.

Both get assessed for their actual impact on project objectives, since a residual or secondary risk that looked minor when first identified can grow more significant as the project continues. Updating and communicating that impact to stakeholders keeps the risk register honest and current, rather than treating response implementation as the end of the story for a given risk.

Study focus: residual and secondary risk don't disappear from the risk manager's attention once a response is implemented — PMI tests ongoing monitoring of both as a distinct, continuing task, not a one-time check done right after implementation.