RiskRegister

Revision as of 16:39, 15 February 2021

Abstract

Identifying risk in a project is always important in order to understand potential consequences related to given tasks and/or decision made within a project. Uncertainty and opportunities will always be present, and hence it is important to accommodate and grasp important factors, that might influence the outcome of a project and hence its success.

As the risk register tool presented in the PRINCE2 standard is a way of documenting and registering risk, it builds on other methods in order to locate more cryptic risks as well as how to deal with them. Hence he risk register is used as a risk management tool. However, more straight forward and easily identified risk are also added to the risk register and can be done so by the project manager, once updating or maintaining the document. In this document the risks are summarised, creating an overview of potential threats, risks and also opportunities.

Once risks are identified, the project manager can use the risk register tool to establish an overview of risk and potential threats or opportunities to the projects in a structured way. By filling in important information on the impact of the risk, the probability of the risk, how to handle the risk, amongst others, the project manager can locate and assign scores, indicating the importance of that risk being handled. Here manages should keep in mind, that assigned scores are based of the perception of the risk when added to the document and hence the quality of the risk register relies on an iterative and ongoing evaluation of registered risks. Noting down whether a risk has been handled or not is also an ongoing process that likewise is important in order to assure the quality of the risk register. Because of its simple structure the risk register can be reevaluated and adjusted on a day-to-day basis, by filling in the relevant information in the risk register document. This therefore makes it a simple yet effective tool in order to handle risks in a project.

Big Idea

The purpose of including a risk register in a project, as described in PRINCE2, is to record identified risks, that might have occurred in the begging or during the undertaking of the project. Here the risks history along with relevant information such as its impact and probability are captured and stored in a document of the project managers choice. By doing so, the project manager can use the risk register as identification of potential threats and opportunities related to the project. (CITE PRINCE2 side 329)

The risk register is a tool that the project manager can use in the beginning as well as throughout the lifetime of a project. As uncertainty will inevitably be bigger in the beginning of a project, as explained in “the paradox of project planning” (REF) the risk register is an important tool to an secure overview as well as a structured approach to coming risk, opportunities and uncertainties. The risk register can take many forms and can be both a document, a spreadsheet and other. The important part is here that the structure of such a document provides a detailed yet simple and easy overview of the discovered risks. If the document is created in such a way, the project manager will be able to track and accommodate for certain risks throughout the lifetime of a project. An example of how to setup the document will be given in the following section. Here it is important to mention, that the risk register is not a way of identifying risk and threats to a project, but rather a way of registering these risks. However, by using the risk register its overview and structure, might actually help the project manager see other potential risk. This way less cryptic risks can actually be identified as a consequence of applying the risk register, even if this is not its intended purpose.

As risk and uncertainties can appear throughout the lifetime of a project, the manager will be using a risk register be able to track which risk or opportunities that are currently present in the project. The manager should keep track of which risks that has been dealt with and which are yet to be handled and how. Therefore, this indicates that there for such a risk register is a certain need for detail. The project manager will not only have to identify risk and list them, but also weigh their importance to the project. The risk must therefore be scored on different parameters, that indicates their importance of being handled. How these risks are handled should also appear in the risk register. This way the project manager will be able to for example contact given employers ahead of time in case a risk related to their work is in need of being handled.

Application

When applying the risk register it is as mentioned important to create a simple yet detailed overview. By doing so the project manager will be allowed to keep track of important risks and opportunities related to the project.

A way of doing this is therefore to set up a table, that contains the needed information. The project manager should record the categories by PRINCE2 that the project manager finds most important:

• Risk identifier: Provides a unique reference for every risk entered into the risk register. It will typically be a numeric or alphanumeric value-Risk author
• Risk author: The person who raised the risk-Risk category
• Date registered: The date the risk was identified
• Risk category: The type of risk in terms of the project’s chosen categories (e.g. schedule, quality, legal)
• Risk description: Describes the risk in terms of the cause, event (threat or opportunity) and effect (in words of the impact)
• Probability, impact and expected value: I t is helpful to estimate the inherent values (pre-response action) and residual values (post-response action). These should be recorded in accordance with the project’s chosen scales
• Proximity: This would typically state how close to the present time the risk event is anticipated to happen (e.g. imminent, within the management stage, within the project, beyond the project). Proximity should be recorded in accordance with the project’s chosen scales
• Risk response categories: How the project will treat the risk in terms of the project’s chosen categories. For example:

1. for threats: avoid, reduce, transfer, share, accept, prepare contingent plans
2. for opportunities: exploit, enhance, transfer, share, accept, prepare contingent plans

• Risk response: Actions to be taken to resolve the risk. These actions should be aligned with the chosen response categories. Note that more than one risk response may apply to a risk
• Risk status: Typically described in terms of whether the risk is active or closed
• Risk owner: The person responsible for managing the risk (there should be only one risk owner per risk)
• Risk actionee: The person(s) who will implement the action(s) described in the risk response. This may or may not be the same person as the risk owner.

Upon assigning the impact and probability of a risk the project manager can choose to either assign numerical values or alphabetical values. Their individual scores are of course important, but really it is the link between the impact and its probability that determines in threat to a project. A risk such as risk number 2 in the table that has a very low impact as well as a low probability should not be prioritised over risk that either have a high impact and probability. Risk with high impact and high probabilities should therefore have the highest focus, as they are both most likely to occur as well as heavily impacting the project. In this case the project manager can use a summarizing risk profile to assist the risk register, plotting the impact and probability, allows the manager to visually see which risk that should be given attention. For further analysis the project manager could use the ARTA,TARA,etc. to determine further steps taken towards these risk. (ARTA is Avoid, Reduce, Transfer & Accept) (https://thecimastudent.com/2016/10/21/cima-e2-risk-management/)