Risk register – About

Risk register

From Wikipedia, the free encyclopedia

Join the related FREE PM templates related Facebook Group (LIKE Facebook page) and LinkedIn Group. Click here to purchase 70+ project management templates with FREE upgrades thereafter.

Risk register plots the impact of a given risk over of its probability. The presented example deals with some issues which can arise on a usual Saturday-night party.

risk register (PRINCE2) is a document used as risk management tool and to fulfill regulatory compliance acting as a repository for all risks identified and includes additional information about each risk, e.g. nature of the risk, reference and owner, mitigation measures. It can be displayed as a scatterplot or as a table.

ISO 73:2009 Risk management—Vocabulary defines a risk register to be a “record of information about identified risks”.

Project Management Templates for both Agile and Waterfall project planning and tracking.


A Risk Register can contain many different items. There are recommendations for Risk Register content made by the Project Management Institute Body of Knowledge (PMBOK) and PRINCE2ISO 31000:2009 does not use the term risk register, however it does state that risks need to be documented.

There are many different tools that can act as risk registers from comprehensive software suites to simple spreadsheets. The effectiveness of these tools depends on their implementation and the organisation’s culture.

A typical risk register contains:

  • A risk category to group similar risks
  • The risk breakdown structure identification number
  • A brief description or name of the risk to make the risk easy to discuss
  • The impact (or consequence) if event actually occurs rated on an integer scale
  • The probability or likelihood of its occurrence rated on an integer scale
  • The Risk Score (or Risk Rating) is the multiplication of Probability and Impact and is often used to rank the risks.
  • Common mitigation steps (e.g. within IT projects) are Identify, Analyze, Plan Response, Monitor and Control.

The risk register is called “qualitative if the probabilities are estimated by ranking them, as “high” to “low” impact. It is called “quantitative” both the impact and the probability is put into numbers, e.g. a risk might have a “$1m” impact and a “50%” probability.

Contingent response – the actions to be taken should the risk event actually occur.

Contingency – the budget allocated to the contingent response

Trigger – an event that itself results in the risk event occurring (for example the risk event might be “flooding” and “heavy rainfall” the trigger)


Although risk registers are commonly used tools not only in projects and programs but also in companies, research has found that they can lead to dysfunctions, for instance Toyota’s risk register listed reputation risks caused by Prius’ malfunctions but the company failed to take action. Risk registers often lead to ritualistic decision-making, illusion of control, and the fallacy of misplaced concreteness: mistaking the map for the territory. However, if used with common sense risk registers are a useful tool to stimulate cross-functional debate and cooperation.

See also


  1. ^ http://www.iso.org/iso/catalogue_detail?csnumber=44651
  2. ^ Kokcharov I. What Is Risk Management? http://www.slideshare.net/igorkokcharov/what-is-project-risk-management
  3. ^ http://www.iso.org/iso/home/standards/iso31000.htm
  4. Jump up to:ab Drummond, Helga. “MIS and illusions of control: an analysis of the risks of risk management. Journal of Information Technology (2011) 26, 259–267. doi:10.1057/jit.2011.9
  5. ^ Lyytinen, Kalle. “MIS: the urge to control and the control of illusions – towards a dialectic”. Journal of Information Technology (2011) 26, 268-270 (December 2011). doi:10.1057/jit.2011.12
  6. Jump up to:ab Budzier, Alexander. “The risk of risk registers – managing risk is managing discourse not tools”. Journal of Information Technology (2011) 26, 274-276 (December 2011), doi:10.1057/jit.2011.13

Further reading


Risk register the project “barbecue party” with somebody inexperienced handling the grill, both in table format (below) and as plot (right).

Category Name RBS ID Probability Impact Mitigation Contingency Risk Score after Mitigation Action By Action When
Guests The guests find the party boring 1.1. low medium Invite crazy friends, provide sufficient liquor Bring out the karaoke 2 within 2hrs
Guests Drunken brawl 1.2. medium low Don’t invite crazy friends, don’t provide too much liquor Call 911 x Immediately
Nature Rain 2.1. low high Have the party indoors Move the party indoors 0 10mins
Nature Fire 2.2. highest highest Start the party with instructions on what to do in the event of fire Implement the appropriate response plan 1 Everyone As per plan
Food Not enough food 3.1. high high Have a buffet Order pizza 1 30mins
Food Food is spoiled 3.2. high highest Store the food in deep freezer Order pizza 1 30mins

An example of the Risk Register for a project that includes 4 steps: Identify, Analyze, Plan Response, Monitor and Control.