According to the PMBOK® Guide (Project Management Body of Knowledge), specifically within the Project Risk Management knowledge area and the Plan Risk Responses process, risks are categorized based on their relationship to the response strategies:

Secondary Risk (Option D): This is defined by PMI as a risk that arises as a direct result of implementing a risk response. For example, if a project team decides to mitigate the risk of a schedule delay by hiring an outside contractor, a " secondary risk " might emerge regarding the contractor ' s lack of familiarity with internal company standards. These risks must be identified and planned for just like primary risks.

Residual Risk (Option B): This is a risk that is expected to remain after the planned risk response has been implemented. It is the " leftover " risk that the project team decides to accept because it falls within acceptable risk thresholds.

Contingent Risk (Option A): This refers to a " Contingency Response Strategy, " which is a risk response that is executed only if certain predefined trigger conditions occur (also known as " fallback plans " ).

Potential Risk (Option C): This is a general term for any identified risk that has not yet occurred; it is not a technical classification within the PMI risk response framework.

In the PMI framework, the Plan Risk Responses process is iterative. When a response is chosen, the project manager must evaluate whether that response introduces new secondary risks or leaves behind residual risks that require further monitoring or a contingency reserve.