RiskRegister

Abstract

Identifying risk in a project is always important in order to understand potential consequences related to given tasks and/or decision made within a project. Uncertainty and opportunities will always be present, and hence it is important to accommodate and grasp important factors, that might influence the outcome of a project and hence its success.

The risk register used in both Project Management Institute Body of Knowledge (PMBOK) and PRINCE2 standard is a document that contains relevant information on located risks and or possibilities. It enables the project manager to record and register risks and opportunities within a given project. As it is included in both of these standards, it is a widely recognised tool. It is a way of documenting and registering risk and builds on other methods in order to locate more cryptic risks as well as how to deal with them. Hence the risk register is used as a risk management tool. However, more straight forward and easily identified risk are potentially discovered once using the risk register and hence also added to the risk register. This is done by the project manager, once updating or maintaining the document. In this document the risks are summarized, creating an overview of potential threats, risks and also opportunities. The project manager can find assistance for this within the project support group, but the document should be kept in a secure place and only be accessed by certain people in order to secure its quality.

Once risks are identified, the project manager can use the risk register tool to establish an overview of risk and potential threats or opportunities to the projects in a structured way. By filling in important information on the impact of the risk, the probability of the risk, how to handle the risk, amongst others, the project manager can locate and assign scores, indicating the importance of that risk being handled. Here manages should keep in mind, that assigned scores are based on the perception of the risk when added to the document and hence the quality of the risk register relies on an iterative and ongoing evaluation of registered risks. Noting down whether a risk has been handled or not is also an ongoing process that likewise is important in order to assure the quality of the risk register. Because of its simple structure the risk register can be reevaluated and adjusted on a day-to-day basis, by filling in the relevant information in the risk register document. This therefore makes it a simple yet effective tool in order to handle risks in a project.

Big Idea

The risk register is both a part of the Project Management Institute Body of Knowledge (PMBOK) as well as PRINCE2 and hence a widely recognised tool to manage risk . The purpose of including a risk register in a project, as described in PRINCE2, is to record identified risks, that might have occurred in the beginning or during the undertaking of the project. Here, the risks history along with relevant information, such as its impact and probability are reported and stored in a document by the project managers choice. By doing so the project manager can use the risk register as identification of potential threats and opportunities related to the project.

This tool is a tool that the project manager can use in the beginning, as well as, throughout the lifetime of a project. As uncertainty will inevitably be bigger at the beginning of a project, as explained in “the paradox of project planning” (https://www-sciencedirect-com.proxy.findit.dtu.dk/science/article/pii/S0263786315000320), the risk register is an important tool to secure an overview and a structured approach to coming risk, opportunities and uncertainties. The risk register can take many forms and can be both a document, a spreadsheet or something similar. The important part is that the structure of such a document provides a detailed yet simple and easy overview of the discovered risks. If the document is created correctly, the project manager will be able to track and accommodate for certain risks throughout the lifetime of a project. An example of how to set up such document will be given in the following section. It is important to mention, that the risk register is not a way of identifying risks, opportunities and threats, but rather a way of registering these. However, by using the risk register, the overview and structure, might actually help the project manager see other potential risk (https://www.stakeholdermap.com/risk/risk-register.html). This way less cryptic risks can actually be identified as a consequence of applying the risk register, even if this is not its intended purpose.

As risk and uncertainties can appear throughout a project, the manager will be using a risk register to be able to track which risk or opportunities that are currently present in the project. The manager should keep track of which risks that have been dealt with and which are yet to be handled and how. Thus, a risk register requires a certain level of detail. The project manager will not only have to identify and record risks, but also weigh their importance to the project. The risk must therefore be scored on different parameters, that indicates their importance of being handled. How these risks are handled should also appear in the risk register. This way the project manager will be able to for example contact given employers ahead of time, in case a risk related to their work needs to be handled.

Application

• Risk identifier: Provides a unique reference for every risk entered into the risk register. It will typically be a numeric or alphanumeric value-Risk author
• Risk author: The person who raised the risk-Risk category
• Date registered: The date the risk was identified
• Risk category: The type of risk in terms of the project’s chosen categories (e.g. schedule, quality, legal)
• Risk description: Describes the risk in terms of the cause, event (threat or opportunity) and effect (in words of the impact)
• Probability, impact and expected value: I t is helpful to estimate the inherent values (pre-response action) and residual values (post-response action). These should be recorded in accordance with the project’s chosen scales
• Proximity: This would typically state how close to the present time the risk event is anticipated to happen (e.g. imminent, within the management stage, within the project, beyond the project). Proximity should be recorded in accordance with the project’s chosen scales
• Risk response categories: How the project will treat the risk in terms of the project’s chosen categories. For example:

1. for threats: avoid, reduce, transfer, share, accept, prepare contingent plans
2. for opportunities: exploit, enhance, transfer, share, accept, prepare contingent plans

• Risk response: Actions to be taken to resolve the risk. These actions should be aligned with the chosen response categories. Note that more than one risk response may apply to a risk
• Risk status: Typically described in terms of whether the risk is active or closed
• Risk owner: The person responsible for managing the risk (there should be only one risk owner per risk)
• Risk actionee: The person(s) who will implement the action(s) described in the risk response. This may or may not be the same person as the risk owner.