A risk register (PRINCE2) is a scatterplot used as risk management tool and to fulfill regulatory compliance acting as a repository for all risks identified and includes additional information about each risk, e.g. nature of the risk, reference and owner, mitigation measures.
Contents
ISO 73:2009 Risk management—Vocabulary defines a risk register to be a "record of information about identified risks".
Example
Risk register the project "barbecue party" with somebody inexperienced handling the grill, both in table format (below) and as plot (right).
Terminology
A Risk Register can contain many different items. There are recommendations for Risk Register content made by the Project Management Institute Body of Knowledge (PMBOK) and PRINCE2. ISO 31000:2009 does not use the term risk register, however it does state that risks need to be documented.
There are many different tools that can act as risk registers from comprehensive software suites to simple spreadsheets. The effectiveness of these tools depends on their implementation and the organisation's culture.
A typical risk register contains:
The risk register is called "qualitative if the probabilities are estimated by ranking them, as "high" to "low" impact. It is called "quantitative" both the impact and the probability is put into numbers, e.g. a risk might have a "$1m" impact and a "50%" probability.
Contingent response - the actions to be taken should the risk event actually occur.
Contingency - the budget allocated to the contingent response
Trigger - an event that itself results in the risk event occurring (for example the risk event might be "flooding" and "heavy rainfall" the trigger)
Criticism
Although risk registers are commonly used tools not only in projects and programs but also in companies, research has found that they can lead to dysfunctions, for instance Toyota's risk register listed reputation risks caused by Prius' malfunctions but the company failed to take action. Risk registers often lead to ritualistic decision-making, illusion of control, and the fallacy of misplaced concreteness: mistaking the map for the territory. However, if used with common sense risk registers are a useful tool to stimulate cross-functional debate and cooperation.