risk register

Risk register of the project "barbecue party" with somebody inexperienced handling the grill, both in table format (below) and as plot (right).

A risk register can contain many different items. There are recommendations for risk register content made by the Project Management Institute Body of Knowledge (PMBOK) and PRINCE2. ISO 31000:2009{{cite web |url=http://www.iso.org/iso/home/standards/iso31000.htm|title= Risk management standards|website=www.iso.org|access-date=2020-08-10}} does not use the term risk register, however it does state that risks need to be documented.

There are many different tools that can act as risk registers from comprehensive software suites to simple spreadsheets. The effectiveness of these tools depends on their implementation and the organisation's culture.{{citation needed|date=October 2015}}

A typical risk register contains:

• A risk category to group similar risks
• The risk breakdown structure identification number
• A brief description or name of the risk to make the risk easy to discuss
• The impact (or consequence) if event actually occurs rated on an integer scale
• The probability or likelihood of its occurrence rated on an integer scale
• The Risk Score{{sfn|Project Management Institute|2021|loc=§4.6.2 Logs and Registers}} (or Risk Rating) is the multiplication of Probability and Impact and is often used to rank the risks.
• Common mitigation steps (e.g. within IT projects) are Identify, Analyze, Plan Response, Monitor and Control.

The risk register is called "qualitative if the probabilities are estimated by ranking them, as "high" to "low" impact. It is called

"quantitative" both the impact and the probability is put into numbers, e.g. a risk might have a "$1m" impact and a "50%" probability.

Contingent response - the actions to be taken should the risk event actually occur.

Contingency - the budget allocated to the contingent response

Trigger - an event that itself results in the risk event occurring (for example the risk event might be "flooding" and "heavy rainfall" the trigger)

Although risk registers are commonly used tools not only in projects and programs but also in companies, research has found that they can lead to dysfunctions, for instance Toyota's risk register listed reputation risks caused by Prius' malfunctions but the company failed to take action.Drummond, Helga. "MIS and illusions of control: an analysis of the risks of risk management''. Journal of Information Technology (2011) 26, 259–267. {{doi|10.1057/jit.2011.9}} Risk registers often lead to ritualistic decision-making, illusion of control,Lyytinen, Kalle. "MIS: the urge to control and the control of illusions – towards a dialectic". Journal of Information Technology (2011) 26, 268-270 (December 2011). {{doi|10.1057/jit.2011.12}} and the fallacy of misplaced concreteness: mistaking the map for the territory.Budzier, Alexander. "The risk of risk registers – managing risk is managing discourse not tools". Journal of Information Technology (2011) 26, 274-276 (December 2011), {{doi|10.1057/jit.2011.13}} However, if used with common sense, risk registers are a useful tool to stimulate cross-functional debate and cooperation.

• Risk
• Event chain methodology
• Risk Breakdown Structure
• Risk management tools
• Issue log
• Failure mode and effects analysis
• Failure mode, effects, and criticality analysis
• PRINCE2, utilizes a risk register

{{reflist}}

• {{cite book

| author = Tom Kendrick

| year = 2003

| title = Identifying and Managing Project Risk: Essential Tools for Failure-Proofing Your Project

| publisher = AMACOM/American Management Association

| isbn = 978-0-8144-0761-5

| url-access = registration

| url = https://archive.org/details/identifyingmanag00tomk

}}

• {{cite book

| author = David Hillson

| year = 2007

| title = Practical Project Risk Management: The Atom Methodology

| publisher = Management Concepts

| isbn = 978-1-56726-202-5

}}

• {{cite book

| author = Kim Heldman

| year = 2005

| title = Project Manager's Spotlight on Risk Management

| publisher = Jossey-Bass

| isbn = 978-0-7821-4411-6

}}

• {{cite book

| author = Robert Buttrick

| year = 2009

| title = The Project Workout: 4th edition

| publisher = Financial Times/ Prentice Hall

| isbn = 978-0-273-72389-9

}}

• {{cite book

| author = Lev Virine and Michael Trumper

| year = 2007

| title = Project Decisions: The Art and Science

| publisher = Management Concepts. Vienna, VA

| isbn = 978-1-56726-217-9

}}

• {{cite book

|last=Project Management Institute

|title=A guide to the project management body of knowledge (PMBOK guide)

|date=2021

|others=Project Management Institute

|isbn=978-1-62825-664-2

|edition=7th

|location=Newtown Square, PA

}}

• {{cite book

| author = Lev Virine and Michael Trumper

| year = 2013

| title = ProjectThink: Why Good Managers Make Poor Project Choices

| publisher = Gower Pub Co

| isbn = 978-1409454984

}}

• [https://www.mudassiriqbal.net/riskregister-vs-riskreport/ Risk Register vs Risk Report (PMP/CAPM) by Mudassir Iqbal, February 8, 2019.]

{{Authority control}}

{{DEFAULTSORT:Risk Register}}

Category:PRINCE2

Category:Risk management