A risk register is a project management document that records identified risks, their probability of occurring, their potential impact on the project, and the actions planned to mitigate or manage them. It is a living document · updated throughout the project as risks are realized, resolved, or superseded by new ones.
A risk is something that might happen · it has not occurred yet. An issue is something that has already happened and is currently affecting the project. Risk management is about preventing problems. Issue management is about resolving problems that already exist. Many project management tools maintain separate risk registers and issue logs for this reason. When a risk materialises, it moves from the risk register to the issue log.
The standard method is a risk matrix: rate both likelihood (usually 1-Low, 2-Medium, 3-High) and impact (same scale) separately, then multiply them to get a risk score. A risk with High likelihood and High impact scores 9 and requires immediate mitigation. A risk with Low likelihood and Low impact scores 1 and may be accepted. The matrix approach makes scoring consistent and shows which risks need active management.
Quality matters more than quantity. A risk register with 5 well-described, actively managed risks is more useful than one with 50 vague, never-updated entries. For most projects, 10-20 risks is appropriate. If you have more than 30, consider whether some are actually assumptions, issues, or constraints rather than genuine risks. Review and prune the register regularly · a risk that no longer applies should be closed, not only left sitting there.
The project manager owns the risk register and is responsible for keeping it current. Individual risk owners are responsible for monitoring their assigned risks and implementing mitigation actions. The project sponsor should review high-rated risks regularly. In larger organizations, a Project Management Office (PMO) may audit risk registers across projects. The register should be updated at every project status meeting, not only when something goes wrong.
There are five responses for threats and five for opportunities. For a threat: escalate it to someone with the authority to act, avoid it by changing the plan, transfer it to a third party such as an insurer or contractor, mitigate it by reducing its likelihood or impact, or accept it and hold a contingency. For an opportunity: escalate it, exploit it so it happens, share it with a partner better placed to capture it, enhance its likelihood or impact, or accept it. Record the chosen strategy in its own column beside each risk, so the actions that follow match the decision. Source: Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide), Sixth Edition (2017).