The correct answer is B. The new technology ' s impact on existing controls.
The scenario explains that a major technological change was introduced as part of a risk response, and that this change later caused GPS errors for customers. It also states that the issue had been recognized as high risk and that secondary risk identification was required but never completed . This means the missing step was evaluating how the new solution could affect the existing system, controls, or operating environment. In other words, the project failed to identify and assess the impact of the new technology on existing controls and related processes.
Secondary risks often arise when a response action, design change, or technology update introduces new vulnerabilities or weakens current safeguards. Proper identification would have examined how the update might interfere with accuracy, compatibility, validation, deployment controls, or downstream system performance.
Why the other options are incorrect:
A. The identification of the business driver. The business reason for making the update is not the key issue. The problem was not lack of purpose, but failure to identify and assess the new risk introduced by the technological change.
C. The risk management strategy quality assurance. This is too broad and indirect. The scenario points more specifically to missed secondary risk identification associated with the implemented change.
D. Project environmental factors. Environmental factors may influence risk, but the question specifically points to a missed evaluation related to the technology update itself and the need for secondary risk identification.
Best-practice reasoning:
When implementing risk responses involving significant technological change, the risk manager must assess how the new change affects existing controls, processes, interfaces, and users. Failure to do so can allow secondary risks to emerge and affect customers or operations.
Reference-aligned basis:
This answer is consistent with standard risk management guidance that emphasizes:
risk responses may introduce secondary risks,
major changes should be assessed for impacts on existing controls and systems,
secondary risks must be identified and managed as part of ongoing risk monitoring and response implementation.
[References:, PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Implement Risk Responses and Monitor Risks, PMI, Practice Standard for Project Risk Management, ISO 31000, risk treatment, change effects, and monitoring principles]
