The buyer faces the most risk under a cost-plus percentage of cost (CPPC) contract because the seller's fee is a percentage of actual costs. That structure creates a perverse incentive: if costs rise, the seller's profit rises too-so the buyer has the greatest exposure to overruns and the weakest built-in cost-control motivation on the seller side. Procurement guidance commonly flags CPPC as especially risky for buyers for exactly this reason.
By comparison, cost-plus-fixed-fee (CPFF) still leaves the buyer paying allowable costs, but the seller's fee is fixed (less incentive to inflate costs). Cost-plus-incentive fee (CPIF) ties part of the fee to performance/cost targets, sharing risk and encouraging cost control. Finally, firm fixed-price (FFP) places the cost overrun risk primarily on the seller, because the price is set unless scope changes. PMI's contract overview notes fixed- price provides the buyer defined cost (assuming scope is well-defined), which reduces buyer risk relative to cost-reimbursable models.
Therefore, among the options, CPPC is the clearest "highest buyer risk" contract type.