Risk Register

Disciplines > Change Management > The 4D Change Project Framework > Documents > Risk Register

Description | Template | See also

Description

The Risk Register holds a list of key risks that need to be monitored and managed. The alternative is to close your eyes and hope that problems will not occur.

Definition: a risk is an undesirable future event. The Risk Register analyzes risks and drives action to:

Reduce the likelihood of the risk occurring.
Increase the visibility of the risk.
Increase the ability to handle the risk, should it occur.
Reduce the impact of the risk, should it occur.

In practice, the Risk Register is regularly reviewed and updated and may be a permanent item on the project meeting agenda.

The simplest form of risk register considers just the probability of occurrence and impact should the risk occur. This is much better than nothing, but ignores issues such as the visibility of risks (sometimes you cannot reasonably see it coming) or how manageable it is (sometimes you cannot do anything to slow it down or handle it).

The status of the risk may be flagged as a number (eg. 1 to 5), a simple statement or Red/Amber/Green (RAG). RAG is a popular format as the color is highly visible and and typically flags:

Green: Do nothing. Under control. Not imminent.
Amber: Discuss. Could be problematic. Take local action.
Red: Act now. Escalate. Imminent.

Template

Ref	Originated (Person/Date)	Risk	Analysis	Status	Action (Owner/Date)

Notes

This is a relatively simple format and many risk registers have multiple columns. This format subsumes these into text.

Risk description may separate cause and effect.
Analysis may include consideration of probability, impact, visibility, manageability, cause and others factors. The impact on other projects and processes may also be noted.
Status flags attention and can include indication of changes over time (eg. GAA for RAG status in past, present and future).
Action can include progress updates.