The risk register: from list to quantified plan
A risk register lists the uncertain events that could affect a project, how likely they are, what they would do, who owns them and what is being done about them. Kept as a spreadsheet it informs meetings. Linked to the schedule and the cost, it tells you how much time and money the risks are worth, and whether the responses are paying for themselves.
What a good risk entry holds
- A cause, an event and an effect: "Because the vendor's shop is at capacity, the exchangers may arrive late, delaying installation." Vague entries ("schedule risk") cannot be assessed or owned.
- A probability that the event occurs, and its impact on time and cost, ideally as ranges.
- The activities it affects, so the impact lands on the right part of the network.
- An owner and a response: avoid, reduce, transfer or accept a threat; exploit, enhance, share or accept an opportunity.
- The assessment before and after the response, and the response's own cost.
The probability-impact matrix
A matrix scores each risk by probability and impact into bands (low, medium, high). It is good for ranking and for conversation, and poor for answering "how late?" or "how much?", because scores cannot be added and the matrix ignores where in the schedule a risk lands. Use it to prioritize; use quantitative analysis to size.
Quantifying the register
In a schedule risk analysis, each register risk becomes an event that occurs in a share of iterations equal to its probability and, when it does, adds its impact to the activities it affects. Because the network is recalculated, a risk on a path with float may cost nothing, and the same risk on the critical path may cost weeks. Running the analysis with the register before and after responses shows what the responses are worth in days and dollars, which is the business case for spending on them.
Opportunities count too
Registers are usually all threats. Opportunities (a faster method, an early delivery, a scope simplification) belong in the same register, with the same rigor, and shift the distribution the other way.
Keeping it alive
- Review it on the same cycle as the schedule update, not once at sanction.
- Retire risks that can no longer happen, and release the contingency held for them.
- Record risks that occurred, and draw the contingency for them, so the remaining exposure stays honest.
In DeltaSys
The DeltaSys Planner's register holds threats and opportunities with pre- and post-response assessments on a configurable matrix, mapped to the activities they affect, and simulates them with the schedule's own uncertainty. The contingency ledger beside it holds contingency against the open risks, proposes a release when a risk is retired and a draw when one occurs, and keeps every movement on record. Risks raised in the Estimator travel with the estimate into the schedule.
Related: cost risk and contingency · three-point estimates.
Primavera and P6 are trademarks of Oracle Corporation; Microsoft Project is a trademark of Microsoft Corporation; PMBOK is a trademark of the Project Management Institute; AACE is a trademark of AACE International; Last Planner is a registered trademark of the Lean Construction Institute. DeltaSys is not affiliated with or endorsed by them. Standards are described in our own words; see the publications themselves for their text.