You are on page 1of 9

Project Risk Register

Template & Guide


Version 1.3 (April 2008)

This Guide is intended to be read in conjunction with the following Template for the development of a
Project Risk Register.
As such, the Guide should be removed from the front of your final document.
The project management templates are being continuously improved. Feedback on suggested
improvements to this Template would be appreciated
What is a Risk Register?
Why would you develop a Risk
The Risk Register records details of all the Register?
risks identified at the beginning and during
the life of the project, their grading in A Risk Register is developed to:
terms of likelihood of occurring and
seriousness of impact on the project, initial • provide a useful tool for managing
plans for mitigating each high level risk, and reducing the risks identified
the costs and responsibilities of the before and during the project;
prescribed mitigation strategies and
subsequent results. • document risk mitigation strategies
being pursued in response to the
It usually includes: identified risks and their grading in
terms of likelihood and seriousness;
• a unique identifier for each risk; • provide the Project Sponsor, Steering
Committee/senior management with a
• a description of each risk and how it documented framework from which
will affect the project; risk status can be reported;
• an assessment of the likelihood it will • ensure the communication of risk
occur and the possible management issues to key
seriousness/impact if it does occur stakeholders;
(low, medium, high);
• provide a mechanism for seeking and
• a grading of each risk according to a acting on feedback to encourage the
risk assessment table (refer to Table involvement of the key stakeholders;
1); and
• who is responsible for managing the • identify the mitigation actions required
risk; for implementation of the risk
• an outline of proposed mitigation management plan and associated
actions (preventative and costings.
contingency); and
• in larger projects, costings for each When would you develop a Risk
mitigation strategy. Register?

This Register should be maintained Initial risks must be identified and graded
throughout the project and will change according to likelihood and seriousness
regularly as existing risks are re-graded in very early in the Project. This initial risk
the light of the effectiveness of the assessment will form part of the Project
mitigation strategy, and new risks are Proposal/Brief or Project Business Case
identified. In smaller projects, the Risk for the project. Once the project is
Register is often used as the Risk approved the Risk Management Plan and
Management Plan. Risk Register should be fully developed.
In the case of smaller projects the Risk
Register may serve both purposes.
What you need before you start: Mitigation actions should include such
things as:
• Knowledge and understanding of the
project. • Preventative actions - planned actions
• Knowledge and understanding of the to reduce the likelihood a risk will
Key Stakeholders. occur and/or reduce the seriousness
should it occur. (What should you do
• Knowledge and understanding of now?)
appropriate types of risk management
activities, or where to obtain them. • Contingency actions - planned actions
to reduce the immediate seriousness
• Any of the following documents – of the risk when it does occur. (What
Project Proposal/Brief, Project should you do when?)
Business Case, or Project Business
Plan. • Recovery actions - planned actions
taken once a risk has occurred to
allow you to move on. (What should
you do after?)
Also advisable:
The column for work breakdown structure
• Departmental Project Management (WBS) indicates that the mitigation action
Guidelines. has been added to the WBS; that is, it is
• Corporate/Business Plan for the being acted upon.
Department/Business Unit.
A number of different text styles have
What you will have when you are been used within the template, as follows:
finished: • Text in blue italics is intended to
provide a guide as to the kind of
A complete Project Risk Register that is information that can be included in a
ready to be given due consideration by the section and to what types of projects it
Project Sponsor and/or the Project might be applicable. It should be
Steering Committee. deleted from the final document .
• Text in normal font is intended as
examples.
• Text enclosed in <angle brackets>
How to use this template is intended to be replaced by
whatever it is describing.
The template consists of some headings
• This document has been formatted
and a table that reflects the nature of the
for duplex printing. If you intend to
information that is to be addressed.
print single sided, you may need to
delete some page breaks.
The completed Risk Register should be
brief and to the point, so it quickly conveys
Checklist
the essential information. It should be
updated on a regular basis, at least
Have you remembered to remove:
monthly.
• The versioning statement from the
front cover of your document?
The description of the risk should include
the associated consequences or impact • This guide and checklist from the
where these are not obvious. These front of your document?
consequences can be useful in identifying • All blue italic instructional text and
appropriate mitigation actions. In larger <prescriptive text enclosed in angle
more complex projects, a separate column brackets> within the template?
may be required.
<Project Title>
Risk Register as at <Date>
File No.: <n>

<enter name of unit>


Department of <enter name of department>
REPORT FOR: (Optional) eg <Project Name> Steering Committee
PROJECT MANAGER: <Name>
PROJECT OBJECTIVE: As stated in the Project Business Plan.

Rating for Likelihood and Seriousness for each risk


L Rated as Low E Rated as Extreme (Used for Seriousness
only)
M Rated as Medium NA Not Assessed
H Rated as High

Grade: Combined effect of Likelihood/Seriousness


Seriousness
low medium high EXTREME
low N D C A
Likelihood
medium D C B A
high C B A A

Recommended actions for grades of risk


Grade Risk mitigation actions
A Mitigation actions, to reduce the likelihood and seriousness, to be identified and
implemented as soon as the project commences as a priority.
B Mitigation actions, to reduce the likelihood and seriousness, to be identified and
appropriate actions implemented during project execution.
C Mitigation actions, to reduce the likelihood and seriousness, to be identified and costed for
possible action if funds permit.
D To be noted - no action is needed unless grading increases over time.
N To be noted - no action is needed unless grading increases over time.

Change to Grade since last assessment


NEW New risk ↓ Grading decreased
— No change to Grade ↑ Grading increased
<Project Title> - Risk Register (as at dd-mm-yyyy)

LikelihoodAssessment of

SeriousnessAssessment of

Grade (combined Likelihood and Seriousness)


Id Description of Risk Impact on Change Date of Mitigation Actions Responsibility Cost Timeline Work
(including any Project Review (Preventative or for mitigation for Breakdown
identified ‘triggers’) (Identify Contingency) action(s) mitigation Structure
consequences 1) action(s)

<n> <A “newspaper <Describe the <Change <Date of <Specify planned <Specify who <Specify This is to
headline” style nature of the in Grade last mitigation is responsible timeframe indicate that
statement. Also risk and the since last review> strategies: for for the
identify relevant impact on the review> • Preventative undertaking mitigation identified
triggers that may project if the risk (implement each action(s) mitigation
cause the risk to be is not mitigated immediately) mitigation to be action has
realised.> or managed> • Contingency action(s)> complete been
(implement d by> included in
if/when risk the WBS
occurs).> (workplan).

1 Steering Lack of H H A NEW 15/02/06 Preventative: Project NA 15/03/06 Y


Committee availability will • Highlight Manager
unavailable. stall progress strategic
Identified triggers: (ie. delayed connection -
• Steering decisions will link Project
Committee defer output Objective to
meetings finalisation, relevant
repeatedly extend project Agency
1
In larger projects, the consequences of the threat may not be evident, and noting them under each risk or in a separate column can be useful in
identifying appropriate mitigation actions.

Page 2
<Project Title> - Risk Register (as at dd-mm-yyyy)

rescheduled timelines and strategic


due to lack of staff resources objectives
availability; will be required • Confirm 2006
• Members do for longer than meeting
not attend anticipated) schedule in
despite prior January
confirmation • Confirm SC
of attendance. membership
• Widen
representation
(include other
Agencies)
2 Inadequate funding Budget blow out M M B No 15/02/06 Contingency: Project TBC TBC N
to complete the means cost change Re-scope project, Manager
project savings must be focusing on time
Identified triggers: identified – ie. and resourcing
• Funding is reduced output
redirected; quality,
• Costs increase timeframes are
(poor quality extended,
materials/ outcomes
inaccurate cost (benefits) will be
estimates) delayed and/or
reduced.

Page 3
<Project Title> - Risk Register (as at dd-mm-yyyy)

3 Staff reject new Rejection H H A NEW 15/02/06 Preventative:


procedures means High level Sponsor NA 21/02/06 Y
Triggers include additional time reinforcement of
• Staff don’t and resources policy changes;
participate in required to Provide Project NA 21/02/06 Y
training (not achieve opportunity for Manager
prepared for new successful staff feedback
roles); implementation prior to
• New procedures - ie. outputs policy/procedure Consultant $3,0 30/03/06 N
not applied languish; more finalisation; 00
(work-arounds training is Develop Training
still used). required Plan that allows
(additional cost, for repeat Project 30/03/06 N
time delays); attendance Manager NA
potential for (perhaps 2 stage
‘falling back into training?);
old ways’ (more Identify staff
change mgt ‘champions’ to Project 30/04/06 N
required); loss promote adoption Manager NA
of credibility for of new
project procedures
(perception of (buddy system);
failure). Circulate
information to
staff that
• promotes how
new procedures
have improved
processes (eg.
10 steps
reduced to 4
steps etc);
• proportion of
staff that have
successfully
completed the
training.
• Identifies local
‘buddies’ for

Page 4
<Project Title> - Risk Register (as at dd-mm-yyyy)

Page 5