A risk register (

PRINCE2 PRINCE2 (PRojects IN Controlled Environments) is a structured project management method and practitioner certification programme. PRINCE2 emphasises dividing projects into manageable and controllable stages. It is adopted in many countries wor ...

) is a document used as a risk management tool and to fulfill

regulatory compliance In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to the deterrence theory, according to which punishing a behavior will decrease the viol ...

acting as a repository for all risks identified and includes additional information about each risk, e.g., nature of the risk, reference and owner, mitigation measures. It can be displayed as a

scatterplot A scatter plot (also called a scatterplot, scatter graph, scatter chart, scattergram, or scatter diagram) is a type of plot or mathematical diagram using Cartesian coordinates to display values for typically two variables for a set of data ...

or as a table. ISO 73:2009 Risk management—Vocabulary defines a risk register to be a "record of information about identified risks".

Example

Risk register of the project "barbecue party" with somebody inexperienced handling the grill, both in table format (below) and as plot (right).

Terminology

A Risk Register can contain many different items. There are recommendations for Risk Register content made by the

Project Management Institute The Project Management Institute (PMI, legally Project Management Institute, Inc.) is a U.S.-based not-for-profit professional organization for project management. Overview PMI serves more than five million professionals including over 680,0 ...

Body of Knowledge ( PMBOK) and

. ISO 31000:2009 does not use the term risk register, however it does state that risks need to be documented. There are many different tools that can act as risk registers from comprehensive software suites to simple spreadsheets. The effectiveness of these tools depends on their implementation and the organisation's culture. A typical risk register contains: * A risk category to group similar risks * The risk breakdown structure identification number * A brief description or name of the risk to make the risk easy to discuss * The ''impact'' (or ''consequence'') if event actually occurs rated on an

integer An integer is the number zero (), a positive natural number (, , , etc.) or a negative integer with a minus sign ( −1, −2, −3, etc.). The negative numbers are the additive inverses of the corresponding positive numbers. In the languag ...

scale * The ''

probability Probability is the branch of mathematics concerning numerical descriptions of how likely an event is to occur, or how likely it is that a proposition is true. The probability of an event is a number between 0 and 1, where, roughly speaking, ...

'' or

likelihood The likelihood function (often simply called the likelihood) represents the probability of random variable realizations conditional on particular values of the statistical parameters. Thus, when evaluated on a given sample, the likelihood functi ...

of its occurrence rated on an

scale * The ''Risk Score'' (or ''Risk Rating'') is the multiplication of Probability and Impact and is often used to rank the risks. * Common ''mitigation steps'' (e.g. within IT projects) are Identify, Analyze, Plan Response, Monitor and Control. The risk register is called "qualitative if the probabilities are estimated by ranking them, as "high" to "low" impact. It is called "quantitative" both the impact and the probability is put into numbers, e.g. a risk might have a "$1m" impact and a "50%" probability. Contingent response - the actions to be taken should the risk event actually occur. Contingency - the budget allocated to the contingent response Trigger - an event that itself results in the risk event occurring (for example the risk event might be "flooding" and "heavy rainfall" the trigger)

Criticism

Although risk registers are commonly used tools not only in projects and programs but also in companies, research has found that they can lead to dysfunctions, for instance Toyota's risk register listed reputation risks caused by Prius' malfunctions but the company failed to take action.Drummond, Helga. "MIS and illusions of control: an analysis of the risks of risk management''. Journal of Information Technology (2011) 26, 259–267. Risk registers often lead to ritualistic decision-making,

illusion of control The illusion of control is the tendency for people to overestimate their ability to control events. It was named by U.S. psychologist Ellen Langer and is thought to influence gambling behavior and belief in the paranormal. Along with illusory super ...

,Lyytinen, Kalle. "MIS: the urge to control and the control of illusions – towards a dialectic". Journal of Information Technology (2011) 26, 268-270 (December 2011). and the fallacy of misplaced concreteness: mistaking the map for the territory.Budzier, Alexander. "The risk of risk registers – managing risk is managing discourse not tools". Journal of Information Technology (2011) 26, 274-276 (December 2011), However, if used with common sense risk registers are a useful tool to stimulate cross-functional debate and cooperation.

Example

Terminology

Criticism

See also

References

Further reading