A new project manager discovered a change in tax policy that created a 25% cost overrun risk. The manager updated the risk register and continued the project. Later the CEO said the project might be cancelled because acceptable cost overrun is only 20%, which surprised the manager. What should the project manager have done to avoid this situation?

The correct answer is to ensure the company's risk tolerance was properly understood and documented. The project manager was surprised by the 20% acceptable cost overrun, indicating a misunderstanding of the organization's risk tolerance. Knowing this threshold upfront would have prompted a different response to the 25% overrun risk, potentially involving escalation or a more aggressive mitigation strategy. Implementing the communications management plan properly might have ensured the CEO was informed, but it wouldn't have addressed the underlying misunderstanding of risk tolerance. Implementing the stakeholder engagement plan correctly is too broad; while the CEO is a stakeholder, the core issue was the lack of understanding of organizational risk tolerance, not just engagement. Providing an appropriate risk response is what the project manager should have done once the risk was identified, but the problem was not knowing what response was appropriate given the company's limits.