RiskRegister

Abstract

Identifying risk in a project is always important in order to understand potential consequences related to given tasks and/or decision made within a project. Uncertainty and opportunities will always be present, and hence it is important to accommodate and grasp important factors, that might influence the outcome of a project and hence its success.

The risk register used in both Project Management Institute Body of Knowledge (PMBOK) and PRINCE2 standard is a document that contains relevant information on located risks and or possibilities. It enables the project manager to record and register risks and opportunities within a given project. As it is included in both of these standards, it is a widely recognised tool. It is a way of documenting and registering risk and builds on other methods in order to locate more cryptic risks as well as how to deal with them. Hence the risk register is used as a risk management tool. However, more straight forward and easily identified risk are potentially discovered once using the risk register and hence also added to the risk register. This is done by the project manager, once updating or maintaining the document. In this document the risks are summarized, creating an overview of potential threats, risks and also opportunities. The project manager can find assistance for this within the project support group, but the document should be kept in a secure place and only be accessed by certain people in order to secure its quality.

Once risks are identified, the project manager can use the risk register tool to establish an overview of risk and potential threats or opportunities to the projects in a structured way. By filling in important information on the impact of the risk, the probability of the risk, how to handle the risk, amongst others, the project manager can locate and assign scores, indicating the importance of that risk being handled. Here manages should keep in mind, that assigned scores are based on the perception of the risk when added to the document and hence the quality of the risk register relies on an iterative and ongoing evaluation of registered risks. Noting down whether a risk has been handled or not is also an ongoing process that likewise is important in order to assure the quality of the risk register. Because of its simple structure the risk register can be reevaluated and adjusted on a day-to-day basis, by filling in the relevant information in the risk register document. This therefore makes it a simple yet effective tool in order to handle risks in a project.

Big Idea

The risk register is both a part of the Project Management Institute Body of Knowledge (PMBOK) as well as PRINCE2 and hence a widely recognised tool to manage risk . The purpose of including a risk register in a project, as described in PRINCE2, is to record identified risks, that might have occurred in the beginning or during the undertaking of the project. Here, the risks history along with relevant information, such as its impact and probability are reported and stored in a document by the project managers choice. By doing so the project manager can use the risk register as identification of potential threats and opportunities related to the project.

This tool is a tool that the project manager can use in the beginning, as well as, throughout the lifetime of a project. As uncertainty will inevitably be bigger at the beginning of a project, as explained in “the paradox of project planning” the risk register is an important tool to secure an overview and a structured approach to coming risk, opportunities and uncertainties. The risk register can take many forms and can be both a document, a spreadsheet or something similar. The important part is that the structure of such a document provides a detailed yet simple and easy overview of the discovered risks. If the document is created correctly, the project manager will be able to track and accommodate for certain risks throughout the lifetime of a project. An example of how to set up such document will be given in the following section. It is important to mention, that the risk register is not a way of identifying risks, opportunities and threats, but rather a way of registering these. However, by using the risk register, the overview and structure, might actually help the project manager see other potential risk . This way less cryptic risks can actually be identified as a consequence of applying the risk register, even if this is not its intended purpose.

As risk and uncertainties can appear throughout a project, the manager will be using a risk register to be able to track which risk or opportunities that are currently present in the project. The manager should keep track of which risks that have been dealt with and which are yet to be handled and how. Thus, a risk register requires a certain level of detail. The project manager will not only have to identify and record risks, but also weigh their importance to the project. The risk must therefore be scored on different parameters, that indicates their importance of being handled. How these risks are handled should also appear in the risk register. This way the project manager will be able to for example contact given employers ahead of time, in case a risk related to their work needs to be handled.

Application

A risk register does not require any certain programs or tools. It can simply be done by creating a document, spreadsheet or its alike. The project manager can choose the option that is preferred and set up the risk register in four simple steps.

1. Create the document
2. Choose and fill in the relevant aspects for the given project
3. Fill in the information on found risks
4. Follow up on risks that have been handled and maintain the document with new potential risks

When applying the risk register, it is as mentioned important to create a simple yet detailed overview. By doing so, the project manager will be allowed to keep track of the important risks and opportunities related to the project. The project manager should, therefore together with the project support group, find the categories that they find most informative for the project and list these in the document. They should avoid overcomplicating the document in order to decrease complexity and hence preserve the overview that allows them to decide on how and what to act on.

A way of creating either a list, table, matrix or other is found in the standard of PRINCE2 and listed below. When choosing a selection of these, the project manager should keep in mind which aspects that support one another and paints the picture, that would best benefit the project.

• "Risk identifier: Provides a unique reference for every risk entered into the risk register. It will typically be a numeric or alphanumeric value-Risk author
• Risk author: The person who raised the risk-Risk category
• Date registered: The date the risk was identified
• Risk category: The type of risk in terms of the project’s chosen categories (e.g. schedule, quality, legal)
• Risk description: Describes the risk in terms of the cause, event (threat or opportunity) and effect (in words of the impact)
• Probability, impact and expected value: I t is helpful to estimate the inherent values (pre-response action) and residual values (post-response action). These should be recorded in accordance with the project’s chosen scales
• Proximity: This would typically state how close to the present time the risk event is anticipated to happen (e.g. imminent, within the management stage, within the project, beyond the project). Proximity should be recorded in accordance with the project’s chosen scales
• Risk response categories: How the project will treat the risk in terms of the project’s chosen categories. For example:

1. for threats: avoid, reduce, transfer, share, accept, prepare contingent plans
2. for opportunities: exploit, enhance, transfer, share, accept, prepare contingent plans

• Risk response: Actions to be taken to resolve the risk. These actions should be aligned with the chosen response categories. Note that more than one risk response may apply to a risk
• Risk status: Typically described in terms of whether the risk is active or closed
• Risk owner: The person responsible for managing the risk (there should be only one risk owner per risk)
• Risk actionee: The person(s) who will implement the action(s) described in the risk response. This may or may not be the same person as the risk owner."

This example is given as part of a made-up project concerning the construction of a 10 story building, and other risks might occur. For simplicity, they are left out.

Once the categories have been chosen and listed, for instance as a as a table as done in the example, the project manager can start filling in the information. Assigning the Risk Identifier is simply done by assigning a unique value to each risk and upon assigning the impact and probability of a risk the project manager can also choose to either assign numerical values or alphabetical values. When looking at the probability and impact each individual score is of course important, but really it is the link between the impact and its probability that determines its threat to the project. This idea of seeing the correlation between categories and its impact on the project is the benefit of the risk registers overview and hence what the project manager should keep in mind when using this tool.

By looking at the given example it is in this case clear that the project manager should pay attention to risk number 1 as this has both a higher impact, as well as a higher probability. However, in some cases, it might be that some risk might be easier to handle than others. The project manager will have to manage and control which risks that should be focused on as it will be a balance between multiple criteria within the risk register. In case the project manager focuses on the impact and probability, the summarizing risk profile from PRINCE2 can be used to assist the risk register, plotting the impact and probability. This allows the manager to visually see which risk that should be given attention based on these two factors. For further analysis, the project manager could also use the ARTA (Avoid, Reduce, Transfer & Accept) approach to determine how to handle the risks.

As the practical application of this tool has now been presented, it is important to keep in mind, that this simply is a tool in order for the project manager to perform the best possible action. Therefore, this also calls upon a certain level of quality in order to ensure that the project manager is in fact basing his/her actions upon reliable and trustworthy information. By using the list of quality criteria presented in PRINCE2, the project manager will ensure, that the risk register is in fact this reliable. These criteria should both be filled in in the risk register, as well as, certain precautions in order to secure the documents and their interests.

• “The status indicates whether action has been taken.
• The issues are uniquely identified, including information about which product they refer to.
• A process is defined by which the issue register is to be updated.
• Entries on the issue register that, upon examination, are in fact risks, are transferred to the risk register and the entries annotated accordingly.
• Access to the issue register is controlled and the register is kept in a safe place.”

Limitations

As the risk register is used throughout a project and it impacts the decision making of the project manager, the manager needs to know which conclusions he/she can draw from this tool and which aspects that are outside the scope of this tool.

First, the project manager should be aware of who’s interest and hence risk the register refers to. One stakeholders’ risk might not be the risk of another stakeholder and thus it does not represent both stakeholders’ interest and precautions. Therefore, the project manager will have to include enough relevant aspects from the project to grasp the whole project and hence its risks. At the same time, be the project manager must however be aware, that certain risk might only affect parts of the project, and therefore, their influence might be of different characteristics. As there will be different interests and thereby risks as well as areas of impact, interest, opportunities, etc. The project manager will somewhat contribute to the risk register and hence the project with some bias. It will be the project managers perspective and opinion on certain risks, that will dominate the risk register. An example of this could be if numerical values are assigned to the impact or probability of a risk. Here, the numerical value will illustrate a perception of a potential risk, and hence be based on the given understanding of that risk . As the project manager is expected to secure the project’s interest, he/she will be the one responsible of the risk register in order to secure the projects interest rather than for example a particular stakeholder’s interest.

Another limitation apart from that the project managers perspective has a heavy impact on the risk register is that the risk register will rely on other methods to potentially find and locate the severity of the risk. As the register is simply a tool to register and manage the risk, it is not a tool that locates complicated and less obvious risk that could potentially be located within a very specific area of the project. Similarly, the risk register does not solve the risk, but rather sums up and provides an overview of the risk found with other tools. It likewise relies upon potential solutions found, also by using other relevant tools. The risk register is therefore simply a registering and management tool, that can be used by the project manager, and therefore also reflects the perception, that the project manager brings to the project and the handling of risks.