CSP risk management domain, explained

Last checked October 25, 2026 against BCSP's CSP11 blueprint (V.2024.04.24) and the current eCFR text.

In short

• Weight: Risk Management is Domain 3 of the BCSP® CSP exam and is worth 15%. BCSP's change notes say it saw a small decrease when CSP11 replaced CSP10 on August 1, 2025.
• Four tasks: the risk evaluation process, hazard analysis and controls, financial risk strategies, and ranking and monitoring specific risks.
• What it rewards: knowing which method fits which situation, and which control or strategy comes first. Most of it is judgment, with a little matrix and probability work.
• Where it overlaps: fault trees and FMEA are listed under Domain 2 (Program Management), and design-stage controls run through Domain 1. Study them together.

The four tasks at a glance

The left column is BCSP's wording, shortened. The other columns are where the answers actually come from.

Task 1: the risk evaluation process

BCSP's verbs (identifying, analyzing, evaluating, monitoring and communicating) follow the process in ISO 31000:2018, Risk management — Guidelines. ISO describes the standard as an approach to "identifying, analyzing, evaluating, treating, monitoring and communicating risks across an organization." In clause 6 of the standard, the steps run:

1. Communication and consultation, throughout, not only at the end.
2. Scope, context and criteria: decide what you are assessing and what level of risk is acceptable before you score anything.
3. Risk assessment, which has three parts: identification (what can happen), analysis (how likely, how bad) and evaluation (compare the result with your criteria to decide whether to act).
4. Risk treatment: choose and apply the options (see Task 3).
5. Monitoring and review.
6. Recording and reporting.

The trap on exam questions is mixing up analysis and evaluation. Analysis produces the likelihood and consequence rating. Evaluation compares that rating with the criteria and leads to a decision.

Task 2: hazard analysis and controls

Job hazard analysis (JHA)

OSHA 3071 describes a job hazard analysis as a technique that "focuses on job tasks as a way to identify hazards before they occur." You watch the job, break it into steps, and for each step ask what can go wrong, what the consequences are, how it could happen, what else contributes and how likely it is.

OSHA says to give priority to:

• jobs with the highest injury or illness rates
• jobs that could cause severe or disabling harm, even with no accident history
• jobs where one simple human error could lead to a severe injury
• jobs that are new or have changed
• jobs complex enough to need written instructions

Two exam points: involve the workers who do the job, and review the JHA periodically, even if the job hasn't changed, and especially after an injury or illness on that job.

Process hazard analysis (PHA)

A PHA is required by OSHA's process safety management standard for covered processes. Under 29 CFR 1910.119(e):

• Methods: what-if, checklist, what-if/checklist, HAZOP, FMEA, fault tree analysis, or an appropriate equivalent. The method must be appropriate to the complexity of the process.
• Priority order for the initial PHAs is based on the extent of the process hazards, the number of potentially affected employees, the age of the process and its operating history.
• What it must address includes previous incidents with likely catastrophic potential, the consequences of control failure, facility siting and human factors.
• Team: expertise in engineering and process operations, at least one employee experienced in the process being evaluated, and one member who knows the PHA method being used.
• Follow-up: a system to promptly resolve findings, with a written schedule.
• Revalidation at least every 5 years, and the PHA is kept for the life of the process.

So a question about a covered chemical process points to a PHA, while a question about one worker's task points to a JHA.

Hierarchy of controls

NIOSH ranks controls by general effectiveness: elimination, substitution, engineering controls, administrative controls, then PPE. NIOSH notes that elimination and substitution work best at the design or development stage, and that PPE should not be relied on alone when other effective options exist.

OSHA 3071's older appendix lists three levels (engineering, administrative, PPE) and folds elimination and substitution into engineering. If a question lists all five, use the NIOSH order.

A worked risk matrix example

Most risk-ranking questions use a severity-by-probability matrix. A free, public example is the one in the military system safety standard, MIL-STD-882E. Its Table I rates severity 1 Catastrophic, 2 Critical, 3 Marginal and 4 Negligible. Its Table II rates probability A Frequent, B Probable, C Occasional, D Remote, E Improbable and F Eliminated. A Risk Assessment Code (RAC) combines the two, such as 1C.

Source: MIL-STD-882E, Table III. Level F (Eliminated) is used only when the hazard is gone.

Scenario. A warehouse has forklifts and pedestrians sharing aisles. The worst credible outcome is a fatality, so severity is 1. Near misses happen, so you rate it Occasional (C). The RAC is 1C, which is High.

• Option A: more training and signs. MIL-STD-882E says that for Catastrophic or Critical hazards, signage, procedures, training and PPE should not be the only risk reduction. It also says no amount of training, warnings or PPE can move a hazard to level F.
• Option B: separate the traffic with fixed barriers and dedicated pedestrian routes. That's an engineered feature, higher in the standard's design order of precedence. If it cuts the likelihood to Improbable (E), the RAC becomes 1E, which is Medium.

Notice that the severity stayed at 1. A control that makes the event less likely doesn't change how bad it would be if it happened, so only the probability letter moves. That one idea answers many matrix questions.

For combining probabilities in a fault tree, see the fault tree formulas and the free probability calculator.

Task 3: financial risk strategies

ISO 31000:2018, clause 6.5.2, lists the treatment options. Here they are matched to BCSP's six terms:

Two points that often decide the answer:

• Transfer and sharing move money, not hazards. After you buy insurance, the worker is exposed to the same hazard. That is why loss prevention and loss reduction still matter.
• Retention should be a decision. ISO's wording is retaining the risk "by informed decision," not ignoring it.

ISO 31000 groups sharing and transfer into one option. BCSP lists them separately, so read the scenario for whether the consequences are split or handed off.

Task 4: identifying, ranking and monitoring

BCSP's examples are disasters and emergency preparedness, fire prevention, occupational health, and hazardous materials and environmental compliance. The ranking logic is the same as the matrix: likelihood and severity first. OSHA 3071 says to rank hazardous jobs starting with those "most likely to occur and with the most severe consequences."

Monitoring means scheduled reviews. Several are written into OSHA rules. The two plan rules apply when another OSHA standard requires the plan:

• Emergency action plans (29 CFR 1910.38) must be reviewed with each employee when the plan is first developed or the employee is first assigned, when their responsibilities change, and when the plan changes.
• Fire prevention plans (29 CFR 1910.39) must list the major fire hazards, ignition sources and their control, and fire protection equipment, plus the name or job title of the people responsible for ignition-source equipment and for fuel source hazards. Employers must tell employees about the fire hazards they are exposed to when first assigned to a job.
• Both plans must be written, kept in the workplace and available to employees. An employer with 10 or fewer employees may communicate the plan orally.
• PHAs are updated and revalidated at least every 5 years (1910.119(e)(6)).
• JHAs are reviewed periodically and after an injury or illness on the job (OSHA 3071).

For hazmat and environmental scenarios, the hazmat and environmental compliance questions cover the related rules.

How to study Domain 3

1. Give it about 15% of your time. In the 12-week CSP study plan, that's weeks 6 and 7. The heavier domains, 1 and 2, get more.
2. Read the primary text once: 1910.119(e), OSHA 3071 and the NIOSH hierarchy page. They are free.
3. Practice the matrix until it's automatic. Rate the severity and probability, read the risk level, then re-rate after a control. Remember that a control which cuts likelihood moves only the probability letter.
4. Make a one-line card for each of the six financial terms with an example, because scenario questions describe them without naming them.
5. Study fault trees and FMEA with Domain 2. They appear in both places. The system safety analysis questions cover them.

For the full exam plan, see how to pass the CSP exam. To see where you stand on Risk Management before you start, take the free diagnostic, which scores each CSP domain.

FAQ

How much of the CSP exam is risk management?

15%. Risk Management is Domain 3 of BCSP's CSP11 blueprint. Only Advanced Application of Safety Principles and Program Management (25% each) are larger.

What is the difference between a JHA and a PHA?

A JHA looks at the steps of one job and the hazards in each step (OSHA 3071). A PHA is a required, team-based analysis of a covered chemical process under 29 CFR 1910.119(e), using methods such as HAZOP, what-if, FMEA or fault tree analysis. It is revalidated at least every 5 years.

Is buying insurance risk transfer or risk sharing?

BCSP lists both terms. ISO 31000:2018 puts insurance under "sharing the risk," together with contracts. Either way, insurance moves the financial consequences and leaves the hazard where it was.

Does a control change the severity or the probability in a risk matrix?

It depends on what it does. Barriers, guards and interlocks usually make the event less likely, so the probability letter moves and the severity stays the same. MIL-STD-882E also says training, warnings and PPE can never move a hazard to Eliminated (F).

Which risk matrix does the CSP use?

BCSP's blueprint doesn't name one. MIL-STD-882E is a public example whose Tables I to III are free to read, and the standard itself allows formally approved tailored matrices. Expect a question to give you the matrix if the answer depends on it.

Did Domain 3 change in CSP11?

Its weight went down slightly. BCSP's change notes say Risk Management and four other domains saw small decreases, while Advanced Application of Safety Principles and Program Management grew to 50% combined. CSP11 took effect August 1, 2025.