It is important to pick a risk register format that is fit for purpose. Tracking more fields does not ensure that the data will be better. Sometimes tracking more fields causes each field to be documented less thoroughly. There is a benefit to tracking only the fields that are necessary. Additional fields can be added at any time based on need. Tracking five fields well can often be more powerful than tracking 50 fields with incomplete data. More fields increase the likelihood that fields will be given less individual attention. This article attempts to guide readers to streamline their risk register format.
The fields above are the minimum required. The risk ID is needed to locate a risk in databases, etc. The risk name or statement defines the threat or opportunity and has basis information for the scoring and quantification. The probability illustrates whether a risk will occur. The impact highlights how damaging a threat is or how beneficial an opportunity could be. The Monte Carlo fields have been used in this example.
If a project stakeholder understands the risk, the probability of occurrence and the potential impact, then they will have enough information to rank the risk and decide how to act on it.
A company can get as complicated as desired with qualitative inputs (red, amber, green, etc.). It is important to remember that the key to risk tracking is identifying whether something is bad and putting a plan in action to reduce the risk. Extra fields do not always add to this, and they may take extra time and effort to track.
Companies often rank risks by inputs such as:
There is nothing wrong with tracking hundreds of fields and impact types; however, it is another area where it is easy to hit a point of diminishing returns. If a company tracks a field for probability to show if it will happen and a field for impact to show how bad it will be, then that is probably enough for most cases. Fewer fields are easier to view and digest. People tend to do a better job tracking a small number of things in detail than a huge list of items. The number of fields often reduces the quality of each field.
There should be a basis of risk input for each risk regardless, so tracking extra fields may not be needed unless a company has specific filtering needs for their risks.
Two scenarios are compared below with each input on a scale from 1 to 5:
Scenario 1:
Scenario 2:
Scenario 2 tracked two inputs fields instead of seven; however, it is clearer due to the basis statement. The reduction in the number of fields did not have a negative impact on clarity and the overall risk score is unchanged.
Documenting a simple field will allow the process to be simplified. The key is to find something fit for purpose and not to chase theoretical perfection.
A set of reports has been generated based on the risk register below. Min and max cost values were added to smooth the curve; however, the fields were not needed to generate Monte Carlo charts.
The six fields shown allow the team to know what the risk is, rank it, quantify it for Monte Carlo Analysis and understand the basis for the ranking & quantification.
The number of fields may not seem like enough, however, the charts provided will allow the management team to easily see which risks need to be mitigated. The streamlined mitigation fields will be covered in another article.
Risk ID | Risk Statement | Probability | Risk Impact | Cost Impact (USD) | Schedule Impact (Weeks) |
PROC-UNIT1-0001 | There is a threat of delay in the delivery of the DCS system due to possible change in vendor. The chosen vendor may go bankrupt due to COVID-19 concerns and would not be able to fill the order. The probability is based on official correspondence with the vendor. The impact is based on four weeks for vendor selection and an estimated ten-week delay to the start of fabrication. The cost is based on the time delay, additional cost on the quote and expediting fees. | 50% | High | 2,000,000 | 14 |
CNST-UNIT1-0001 | Acme Manufacturing has had minor quality issues on recent projects. This may require minor field work and adjustments with piping. The impact is ranked a medium as the issue impacts the critical path. | 80% | Medium | 30,000 | 2 |
ENG-UNIT1-0001 | Unit 1 – Late vendor data. Day for day slip due to critical path | 25% | Medium | 500,000 | 6 |
ENG-UNIT2-0002 | Unit 2 – Late vendor data. Low risk due to schedule float. | 5% | Low | 100,000 | 0 |
CNST-UNIT1-0002 | Space issues for vessel. Currently working. This is critical path item. | 50% | High | 1,000,000 | 4 |
The charts are powered by:
The threat matrix provides a summary of all threats in the project (pre-mitigated and post-mitigated) ranked by a score of one to ten.
Threats with a probability over 50% and a high impact on the project delivery are ranked a ten and are in the top-right corner. Risks are reduced in score as they go down or left on the matrix.
There is one red risk that has not been reduced by our actions. There are two yellow risks remaining. The risks are detailed in a separate chart.
The threat Risk Level report illustrates the total number of threats distributed by red, yellow and green. The score after our mitigating actions is shown below.
There is one red risk that has not been reduced by our actions. There are two yellow risks remaining. The risks are detailed in a separate chart.
Name | Score from | Score up to | Number of Risks |
High | 8 | 10 | 1 |
Medium | 4 | 8 | 2 |
Low | 1 | 4 | 2 |
The following risks on the chart are ranked by score after mitigation.
The Acme Manufacturing quality issue is the only red risk remaining. All other risks have been mitigated to a yellow score or below.
The red and yellow risks should be reviewed for further mitigation. The green risks pose a limited threat.
Risk ID | Risk Name | Post-Mitigated |
CNST-UNIT1-0001 | Quality Issues with Acme | 8 |
ENG-UNIT1-0002 | Unit 1 – Late Vendor Data | 7 |
ENG-UNIT1-0001 | Space Issues for Vessel | 7 |
PROC-UNIT1-0001 | DCS Vendor Financial Troubles | 3 |
ENG-UNIT2-0002 | Unit 2 – Late Vendor Data | 1 |
The cost curve was generated by running a Monte Carlo Analysis on the risk register. The probability 50% (P50) and probability 80% (P80) are marked on the graph. The P50 is $1.44M USD. The P80 is $2.66M USD.
We are eighty percent confident of success with an additional $2.66M USD to cover for all open risk events.
Probability of Success | Cost Exposure (Contingency Needed) |
5 | 19,442.15 |
10 | 28,456.27 |
15 | 32,365.34 |
20 | 488,883.37 |
25 | 626,330.17 |
30 | 970,408.33 |
35 | 1,029,057.37 |
40 | 1,085,100.81 |
45 | 1,203,837.85 |
50 | 1,439,434.06 |
55 | 1,589,005.16 |
60 | 1,741,364.52 |
65 | 1,945,946.21 |
70 | 2,191,779.66 |
75 | 2,370,765.26 |
80 | 2,660,695.84 |
85 | 2,890,902.78 |
90 | 3,167,002.68 |
95 | 3,564,704.14 |
The chart below shows the top cost drivers from the risk register Monte Carlo Analysis. The top risk is green from a qualitative ranking. The lowest risk is a red from a qualitative ranking. The cost inputs and rankings should be reviewed.
The DCS Vendor Risk accounts for more than half of the contingency at a success level of eighty percent.
The top three risks account for almost all the contingency on the project.
Threat ID | Threat Name | Cost Exposure |
PROC-UNIT1-0001 | DCS Vendor Financial Troubles | 1,437,564.36 |
ENG-UNIT1-0002 | Space issues for vessel | 721,101.24 |
ENG-UNIT1-0001 | Unit 1 – Late vendor data | 355,371.33 |
ENG-UNIT2-0002 | Unit 2 – Late vendor data | 70,363.73 |
CNST-UNIT1-0001 | Quality Issues with Acme | 22,048.18 |
Status Report (Threats):
The chart below shows the number of risks in open or closed status.
We have three risk events that are unmitigated and should be looked at for additional mitigation plans.
Status | Number |
Open-unmitigated | 3 |
Open-mitigated | 2 |
Closed-no impact | 1 |
Risk Id | Risk Name | Status | Risk Colour |
CNST-UNIT1-0001 | Quality Issues with Acme | Open-unmitigated | |
ENG-UNIT1-0001 | Unit 1 – Late vendor data | Open-unmitigated | |
ENG-UNIT2-0002 | Unit 2 – Late vendor data | Open-unmitigated | |
ENG-UNIT1-0002 | Space issues for vessel | Open-mitigated | |
PROC-UNIT1-0001 | DCS Vendor Financial Troubles | Open-mitigated | |
CNST-UNIT2-0001 | Underground Obstruction | Closed-no impact |
Copyright © 2021 PRC Software. All rights reserved
This will close in 0 seconds
This will close in 0 seconds
The PRC Enterprise Risk Register is a web-based risk management software solution which allows for the tracking of risk at the project and portfolio level. Audit logs for all risk updates and changes are available at the click of a button to aid with audits, claims and the flow of information. The power of the PRC Enterprise Risk Register is in the simplicity of the user interface, which is designed to navigate easily at both project and portfolio levels without compromising functionality or data. The PRC Enterprise Risk Register allows for mapping across project levels so the data can be reported at the portfolio level, even if the work, risk and organizational breakdown structures are not standardized.
This will close in 0 seconds
The PRC Enterprise Cost Risk Analysis is a customizable web-based solution for simulating estimate cost and determining cost contingency, cost drivers, and risk hotspots. The key to a good risk analysis is good inputs. The software cannot be a roadblock to success. Good risk software should be easy on the end user. Monte Carlo simulation is already a complex. The software should simplify the process.
This will close in 0 seconds
The PRC Enterprise Schedule Risk Analysis is a customizable web-based solution for simulating schedule duration and dates. At PRC Software, we believe that the key to good risk software is through good inputs and excellent user friendliness. A Monte Carlo simulation is already a complex. The software should not be complicated as well.
This will close in 0 seconds
PRC specializes in risk analysis, audit, and training. We have cross-industry experience in fields such as Aerospace & Defense, Oil & Gas, and Engineering & Construction. We believe that over-complicating the risk process often leads to wasted effort and poor results. Our goal is to "make it simple."
This will close in 0 seconds