If you’re staring down the CIMA P3 exam, here’s the short version: it’s a risk management paper, it sits at strategic level, and despite its tough reputation, the pass rate has been climbing steadily — recent figures show 63%. That doesn’t mean P3 is easy. It means it’s passable when you prepare properly, and this guide walks you through how to do that.
Below: the full syllabus breakdown from CIMA’s 2026–2027 blueprint, what the exam actually tests, how P3 pass rates have moved over time, and where students typically lose marks.
P3 — Risk Management — is one of three objective tests at CIMA’s strategic level, alongside E3 (Strategic Management) and F3 (Financial Strategy). Together with the Strategic Case Study (SCS), they make up the final stage of the CGMA Professional Qualification.
P3 sits the candidate in the shoes of a Senior Finance Manager whose job is to identify, evaluate and manage the risks that could derail an organisation’s strategy. That includes strategic risk, operational risk, cyber risk and the internal control environment that holds it all together. The paper is heavy on scenario-based questions and longer reading passages — more than any operational or management-level paper.
Like every other CIMA objective test, P3 runs for 90 minutes and contains 60 questions. All questions carry equal weight. There’s no partial marking — if a question asks you to select more than one answer, you need to get all of them right or you score zero for that question.
The pass mark is a scaled score of 100 out of 150. That’s not the same as 67% of questions correct: scaled scoring adjusts for question difficulty, so a harder paper isn’t penalised. (We cover this in detail in our guide to
Read our full breakdown of CIMA scaled scoring if you want to understand exactly how your result is calculated.
You can sit P3 on demand at any Pearson VUE test centre or online — there are no fixed exam windows for objective tests.
CIMA’s 2026–2027 blueprint splits P3 into four equally weighted content areas, each worth 25% of the exam:
Sources and types of risk, risk exposure, risk tolerance, appetite and capacity, COSO ERM and ISO 31000 frameworks, risk registers and assurance maps.
Risks in formulating strategy, stress testing, reputational risk, governance risks — the role of the board, audit committee and non-executive directors.
Designing and recommending internal controls, the COSO Internal Control framework, the role of internal audit, compliance failures, segregation of duties.
Cybersecurity threats, malware, web application attacks, ISO27001 controls, penetration testing, cyber risk reporting frameworks for board and stakeholders.
Each area is tested across Bloom’s levels 1 through 4 — meaning you need to remember definitions, apply frameworks, analyse scenarios and (in the higher-marked questions) evaluate options.
P3 has historically been seen as one of the trickier strategic-level papers — but the data tells a more positive story than students often expect.
Up ~10 percentage points in five years
| Reporting period | P3 pass rate |
|---|---|
| ~2021 (five-year average) | ~53% |
| Nov 2022 – Nov 2023 | 59% |
| Nov 2023 – Nov 2024 | 63% |
| 2024 – 2025 (latest) | 63% |
Sources: CIMA exam pass rate publications via PQ Magazine; PTA historical analysis.
That’s roughly a 10 percentage point lift in five years. Part of this reflects students becoming more comfortable with computer-based assessment; part of it reflects CIMA refreshing the question bank. Either way, the recent trend puts P3 in a respectable bracket — better than P1 (54%) and similar to F3 (58%).
The takeaway: P3 isn’t the hardest CIMA exam, but it isn’t a soft option either. Six in ten candidates pass — and the difference between the four in ten who don’t and the six who do almost always comes down to question practice, not raw knowledge.
If you want to see how our P3 question bank, video lectures and mock exams come together, the full PTA P3 study package is designed to take you from “I’ve read the textbook” to exam-ready.
CIMA’s official recommended order at strategic level is E3 → P3 → F3. That recommendation is in the 2026–2027 blueprint, and the logic is sound: E3 gives you the strategic context (the “what”), P3 covers the risks that can derail strategy (the “what could go wrong”), and F3 brings in the financial decisions that fund and value the strategy (the “how do we pay for it and what’s it worth”).
Studying in that order means by the time you reach the Strategic Case Study, you’ve built up the strategy → risk → finance flow in the same sequence the case study will ask you to think through.
That said, this is CIMA’s recommendation, not a rule. If your work experience is heavier on risk or treasury, you might find P3 or F3 a more natural starting point. Pick the paper you’ll engage with hardest — momentum matters more than sequence.
After watching thousands of students take this paper, the same handful of habits separate first-time passes from re-sits.
CIMA provides the following on-screen during the exam: a present value table, a cumulative present value table and a normal distribution table. You’ll also have access to a built-in calculator (or you can use your own if it’s on the CIMA-approved list), an on-screen whiteboard for working, and a scratch pad.
There’s a 15-minute tutorial before the exam starts. Use it. Even if you’ve sat objective tests before, the test driver layout is worth refreshing.
For the official guidance, see the CIMA strategic level examination blueprint — it covers P3 alongside E3 and F3 in full detail.
You need a scaled score of 100 out of 150 to pass CIMA P3. The scale runs from 0 to 150, and 100 is the independently set pass threshold. Because scaled scoring adjusts for question difficulty, 100 isn't the same as getting 67% of questions correct — but in practice, candidates who consistently get around two-thirds of questions right in timed mocks tend to pass.
CIMA P3 is 90 minutes long and contains 60 questions, giving you about 90 seconds per question on average. All questions carry equal marks and there's no partial credit — every part of a multi-part question must be correct for the question to score.
By pass rate, P3 sits in the middle of the strategic level. Recent figures put P3 at around 63%, F3 at 58% and E3 at 76%. So statistically, E3 is the highest-passing strategic paper, P3 is in the middle, and F3 is the lowest. Difficulty is also subjective — many students find P3 conceptually easier than F3 (which is numbers-heavy) but harder than E3 (which is more discursive).
Yes. You must pass all three strategic-level objective tests (E3, P3 and F3) — or hold relevant exemptions — before you can sit the Strategic Case Study (SCS).
CIMA recommends studying in the order E3 → P3 → F3, with the Strategic Case Study last. The logic is that E3 sets the strategic context, P3 covers the risks to that strategy, and F3 handles the financial decisions. You're free to take them in any order, but most students benefit from following CIMA's suggested sequence.
Per the 2026–2027 blueprint, all four content areas carry equal weight at 25% each: Enterprise risk, Strategic risk, Internal controls, and Cyber risk. There's no "main" topic — neglecting any one of them puts your overall result at meaningful risk.
You need a scaled score of 100 out of 150 to pass CIMA P3. The scale runs from 0 to 150, and 100 is the independently set pass threshold. Because scaled scoring adjusts for question difficulty, 100 isn't the same as getting 67% of questions correct — but in practice, candidates who consistently get around two-thirds of questions right in timed mocks tend to pass.
CIMA P3 is 90 minutes long and contains 60 questions, giving you about 90 seconds per question on average. All questions carry equal marks and there's no partial credit — every part of a multi-part question must be correct for the question to score.
By pass rate, P3 sits in the middle of the strategic level. Recent figures put P3 at around 63%, F3 at 58% and E3 at 76%. So statistically, E3 is the highest-passing strategic paper, P3 is in the middle, and F3 is the lowest. Difficulty is also subjective — many students find P3 conceptually easier than F3 (which is numbers-heavy) but harder than E3 (which is more discursive).
Yes. You must pass all three strategic-level objective tests (E3, P3 and F3) — or hold relevant exemptions — before you can sit the Strategic Case Study (SCS).
CIMA recommends studying in the order E3 → P3 → F3, with the Strategic Case Study last. The logic is that E3 sets the strategic context, P3 covers the risks to that strategy, and F3 handles the financial decisions. You're free to take them in any order, but most students benefit from following CIMA's suggested sequence.
Per the 2026–2027 blueprint, all four content areas carry equal weight at 25% each: Enterprise risk, Strategic risk, Internal controls, and Cyber risk. There's no "main" topic — neglecting any one of them puts your overall result at meaningful risk.
Practise with question banks, mock exams and video lectures built specifically for CIMA P3 — including the scenario-based question types that decide who passes and who doesn't.
→ Explore PTA's CIMA P3 Package Sign up for our weekly newsletter to receive expert guidance, study resources, career tips, the latest discounts, and more.
We have designed free packages for you.
