CIMA P3: Risk Management
Every strategy carries risk, and the organisations that endure are those that anticipate it. P3, Risk Management, is the Strategic-level paper devoted to identifying, evaluating, and managing the risks that could derail an organisation's plans, from enterprise-wide exposures and governance failures to the fast-growing threat of cyberattack. It equips the finance professional to protect value as deliberately as they help to create it, and it opens the door to careers in risk, internal audit, and senior finance.
What is CIMA P3?
P3, Risk Management, is the Performance-pillar subject at the Strategic level of the CGMA Professional Qualification. Following the strategic context established in E3, it turns to the risks that threaten strategy and the controls that contain them: enterprise and strategic risk, the internal control environment, and cyber risk. It is largely applied and conceptual, though it carries an element of risk quantification, and together with E3 and F3 it forms the assumed knowledge examined in the Strategic Case Study.
The paper is marked on CIMA's scaled scoring system to a maximum of 150, with 100 the pass standard, ensuring comparability across the question sets that candidates receive. P3 sits in the middle of the Strategic level for difficulty, with a pass rate of around 63%, below E3 but above the more computational F3. It is delivered on demand at Pearson VUE test centres and online, and may be booked up to 48 hours in advance. The questions are heavily scenario-based, with longer stems than the earlier levels, and they are pitched increasingly at analysis and evaluation. P3 rewards applied judgement above all: the ability to take a specific business situation and recommend the risk response or control that genuinely fits it.
In one line: P3 teaches you to identify, quantify, and respond to enterprise, strategic, control, and cyber risk — recommending a specific TARA response that fits the scenario, not a generic description of the threat.
Who P3 is for
P3 develops the risk and control expertise that senior finance professionals are trusted to provide. These are the competencies that keep an organisation resilient and its strategy on course, and they sit at the heart of the risk, audit, and advisory roles that a CGMA is equipped to hold.
- The ability to identify, quantify, and prioritise the risks facing an organisation.
- A command of the major risk and control frameworks, and the judgement to apply the right response.
- An understanding of governance, internal audit, and the increasingly critical field of cyber risk.
P3 suits anyone at Strategic level after E3 — and anyone who needs to protect value as deliberately as they help to create it, before F3 and the Strategic Case Study.
Syllabus & topics covered
The syllabus comprises four content areas, each carrying an equal share of the marks, so no single area can be safely prioritised over another. The equal weighting is the syllabus's clearest instruction: prepare across all four, because a weakness in any one is costly.
Enterprise risk
25% of the paper. Sources and types of risk, quantifying exposure by likelihood and impact, and managing risk through the TARA framework within risk appetite and tolerance, drawing on COSO ERM and ISO 31000.
Strategic risk
25% of the paper. Risks inherent in formulating strategy, reputational risk, stress testing and scenario planning, and the governance failures that threaten strategy.
Internal controls
25% of the paper. Designing preventive and detective controls, segregation of duties, the COSO Internal Control framework, and the role and process of internal audit.
Cyber risk
25% of the paper. Threats and vulnerabilities, ISO 27001 controls, penetration testing, safeguards, and cyber risk reporting to the board.
Because every area carries equal marks, balanced preparation is essential, with particular care for the frameworks and for the less familiar cyber content. Do not treat risk as purely negative — P3 examines risk appetite, tolerance, and the upside of well-judged risk-taking. The Strategic blueprint follows the CGMA syllabus released in May 2025, so candidates should confirm the current examinable content and frameworks for their sitting.
P3 exam format
P3 is a 90-minute computer-based objective test of 60 compulsory questions, available on demand at Pearson VUE or online. It may be booked up to 48 hours in advance.
The longer stems consume time quickly, so rehearse reading at pace and deciding with confidence. The exam rewards a specific, justified response — transfer, avoid, reduce, or accept — matched to the scenario, not a general account of what the risk is.
Where P3 fits in the CIMA pathway
P3 is the Performance-pillar paper at Strategic level, following the strategic context established in E3. With E3 and F3 it forms the assumed knowledge examined in the Strategic Case Study.
P3 is the paper that turns the finance professional into a guardian of strategy, equipping them to see risk clearly, weigh it soundly, and respond to it decisively. A confident pass prepares you for the Strategic Case Study and the senior roles beyond it.
How to prepare for P3
P3 rewards the applied use of risk frameworks and the judgement to recommend a specific response. Learn the frameworks, practise recommending specific responses, and give cyber risk its due.
- Prepare across all four areas evenly. With each worth a quarter of the marks, a neglected area puts the whole result at risk.
- Learn the frameworks by purpose. Know precisely what COSO ERM, ISO 31000, the COSO Internal Control framework, and ISO 27001 each address, and when each applies. Misattributing one for another is a frequent and avoidable error.
- Recommend specific responses. Practise selecting and justifying a transfer, avoid, reduce, or accept (TARA) response tied to the particular scenario, not a generic description of the risk.
- Engage properly with cyber risk. Do not let its technical flavour deter you; it is a full quarter of the paper, entirely learnable, and grows in prominence each year.
- Master the quantification. Be comfortable with expected values, likelihood and impact, and the use of the provided reference tables.
- Practise scenarios under timed conditions. The longer stems consume time quickly, so rehearse reading at pace and deciding with confidence. Remember that P3 also examines the upside of well-judged risk-taking, not only downside.
Study P3 with Vertex
Structured lessons across enterprise, strategic, control, and cyber risk, reinforced by scenario-based questions and full mock examinations aligned to the current blueprint — trusted by students across 88 countries.
- Clear lessons on COSO, ISO, and the TARA framework
- Scenario practice on risk responses and cyber risk
- Full mock examinations aligned to the current blueprint
- One-to-one tutor support