Context
ℹ Please remember this document template is just a suggestion; every business and organisation will have different documentation standards and expectations of their business analysts, so only use the templates that will help you drive value in your role. There are no formal “standards” across the Business Analyst profession, and this is merely a starting point to help you get started. We recommend, suggest and implore you to edit, modify, delete, add, substitute and otherwise re-work this to provide value. The commentary/advice highlighted in <italic blue like so> is designed to help you fill out the documentation, and SHOULD BE DELETED BEFORE DISTRIBUTION INTERNALLY!
This document is used to track and escalate risks where appropriate.
It requires input from the entire project team and project leads.
Template
File download (via link or button)
Text copy
Understandably downloading a file off the internet has a myriad of risks, so we provide a text version that you can simply highlight, copy (Ctrl+C) & paste (Ctrl+V) into your application of choice to use further. If using Microsoft Word, you may wish to use the “Merge Formatting” option.
📃 Click the expander below to view the full template.
Risk Register
| Risk ID | Entry Date | Author | Title | Event | Effect | Project Deliverable | INHERENT Impact / Consequence | INHERENT Probability / Likelihood | INHERENT Overall Rating / Score | Risk Category | When / Proximity | Risk Owner | Risk Response / Control Strategy | Treatment Plan / Mitigation | Next action | Next action due date | Risk actionee | RESIDUAL Impact / Consequence | RESIDUAL Probability / Likelihood | RESIDUAL Overall Rating / Score | Date updated | Date of Next Review | Risk RAG | Additional Comments |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Assign an ID number to the risk – the format may be determined by your programme. | State the date when this risk was entered into the register. dd/mm/yyyy | State who has added the risk to the register. | A short descriptive title for ease of reference such as in the status report. | What unplanned event may occur? | What is the actual impact in terms of: scope, quality, effort/cost, time, benefits | Name of project deliverable impacted by the proposed risk | What would the consequences be if the risk actually occurs? Each consequence should have a separate line on the register. | What are the factors affecting the likelihood of this risk occurring? Consider – has it occurred before? Are there factors which will increase or decrease its likelihood? Are they imminent? | Automatically calculated. Refer to risk matrix (Probability x Impact = Rating) | What type of risk is this? Use the drop down list of categories to select from the standard list | If the risk materialises how far away in time will the risk occur. | Who will be accountable for this risk? | Use the standard response types to define how the risk will be controlled. | Describe the plan to mitigate the risk. | What actions are required or have taken place. The actions are detailed steps of a an overall treatment / mitigation. | dd/mm/yyyy | Who is responsible for next action? | What would the consequences be if the risk actually occurs? Each consequence should have a separate line on the register. | What are the factors affecting the likelihood of this risk occurring? Consider – has it occurred before? Are there factors which will increase or decrease its likelihood? Are they imminent? | Automatically calculated. Refer to risk matrix (Probability x Impact = Rating) | dd/mm/yyyy | dd/mm/yyyy | Select from the drop down box:GreenAmberRed | |
| Rsk1 | 14/09/2021 | Project Team | Limited Access to XYZ Team Members owing to current work volume | Add delays to the project and access to important information we need | Delays to the project | XYZ Interviews | Major | Possible | Significant (7) | Time | Fortnight | [Name Redacted] | Accept | careful scheduling of interviews to maximise timePM is recruiting aditional Team members to provide support | PM/PSO | 14/12/2021 | PM/PSO | Moderate | Likely | Significant (7) | 28/10/2021 | 15/12/2021 | Green | Sufficient communication was achieved throughout Project and remains ongoing as required. |
| Rsk2 | 31/08/2021 | Project Team | Strategic objective unclear | Strategy and Project objectives not specified clearly | Extension to timelines, increase in scope, increase in budget impact | XYZ | Moderate | Possible | Moderate (6) | Approvals/Governance | Month | [Name Redacted] | Avoid | Clarify Strategic Objective with Executive and Sponsors, be clear in Project Plan | Update Project PlanMaintain objective with Project Team | 14/12/2021 | PM/PSO | Major | Possible | Significant (7) | 28/10/2021 | 15/12/2021 | Green | Clarified through Project Plan with Project Sponsors. |
| Rsk3 | 31/08/2021 | Project Team | Conflicting Work Priorities | Several projects and tasks across resources may result in delay | Delay to change | XYZ | Moderate | Possible | Moderate (6) | People | Fortnight | [Name Redacted] | Avoid | Communicate with Line Managers | Constant monitoring of priorities | 14/12/2021 | PM/PSO/SDL | Major | Likely | High (8) | 28/10/2021 | 15/12/2021 | Green | Managed through careful time management. |
Conditional Logic for the above:
| Risk Category | Risk Categories Explained | Risk Response | Risk Response Description | Risk RAG | Risk Status | Risk RAG Description |
|---|---|---|---|---|---|---|
| Select | N/A | Select | Involves changing some aspect of the project, i.e. the scope, procurement route, supplier or sequence of activities, so the threat can no longer have and impact or no longer happen. | Select | Select | N/A |
| Commercial and Legal | Contract, economic, legislative | Avoid | Proactice actions taken to: *Reduce the probability of the event occuring through some form of control; *Reduce the impact of the event should it occur | Green | Open | Green = under control |
| Budget | Funding, contingency | Reduce | Putting in place a fallback plan for actions that will be taken to reduce the impact of the threat should the risk occur. A reatice form of ‘reduce’ response which has no impact on liklihood. | Amber | Closed | Amber = Actively being mitigated |
| Approvals/Governance | Processes, approvals | Fallback | A third party takes on responsibility for some of the financial impact of the threat. E.g. insurance or clauses in a contract. This is a form of ‘reduce’ which only reduces the financial impact of a threat. | Red | Red = Requires assistance | |
| Dependency | Other projects | Transfer | A conscious and deliberate decision is taken to retain the threat, having discered it is more economical to do so than to attempt a threat response action. The threat should continue to be monitored to ensure it remains tolerable. | |||
| Probity | Confidentiality, security, perceived fairness | Accept | Modern procurment methods commonly entail a form of risk sharing through the application of a pain/gain formula: both parties share the gain (within agreed limits) if the cost is less than the cost plan; and share the pain (within agreed limits) if the cost plan is exeeded. | |||
| People | Sponsor, departments, users, demand, personnel | Share | Seizing an opportunity to ensure the opportunity will happen and the impact will be realised. | |||
| Time | Technology, design, skills, plans, environment | Exploit | Proactive actions taken to: *Enhance the probability of the event occurring *Enhance the impact of the event should it occur | |||
| Enhance | A conscious and deliberate decision is taken not to exploit or enhance the opportunity, having discerned it is more economical not to attempt an opportunity response action. The opportunity should continue to be monitored. | |||||
| Reject |
Risk Calculation for Above:
| Impact / Consequence | ||||||||
| Select | Insignificant | Minor | Moderate | Major | Extreme | |||
| Select | 1 | 2 | 3 | 4 | 5 | |||
| Probability / Likelihood | Almost Certain | 5 | Moderate (6) | Significant (7) | High (8) | High (9) | High (10) | |
| Likely | 4 | Moderate (5) | Moderate (6) | Significant (7) | High (8) | High (9) | ||
| Possible | 3 | Low (4) | Moderate (5) | Moderate (6) | Significant (7) | High (8) | ||
| Unlikely | 2 | Low (3) | Low (4) | Moderate (5) | Moderate (6) | Significant (7) | ||
| Remote | 1 | Low (2) | Low (3) | Low (4) | Moderate (5) | Moderate (6) |
Formula is =VLOOKUP(I4,Formulas!$B$18:$H$23,HLOOKUP(H4,Formulas!$D$15:$H$16,2,FALSE), FALSE)
We create and share this content to help give back to the community, and give aspiring Business Analysts the guidance we wish we had when we started out.
Please remember you can join the conversation or suggest other topics at any time over in the Business Analysis Space Discord. We welcome any feedback on this or any other posts via email or via the Discord. If this content has helped you or you just appreciate the goal, you can help by sharing our site with your networks or consider donating to our hosting costs.
Contributions & authored by:
Stefan Carton
This content is licensed under CC BY-SA 4.0: Attribution-ShareAlike 4.0 International with full rights to original listed authors & contributors. The opinions expressed within the content above are solely of the respective authors and contributors, and may not reflect the opinions and beliefs of their respective employers/organisations, other writers on this site or website affiliates.
Updated: 2/08/2022