estimated according to the expected value. In the simplest risk event, expected and individual risk events and according to the preferred scales set approach the cost impact is should it proximity may be based the results of qualitative risk preferred scales out in the risk multiplied by the probability occur. on certain assumptions. analysis. For complex risk set out in the risk management plan. (assuming probability has been For example, the impact situations, the fields of the management estimated on a numeric scale) of delay in an activity in risk register may be The areas affected by plan. to give the expected value. The the schedule may be inadequate to store all the the risk event should expected value of more assessed on the basis relevant information. also be noted, complex risk events may be that that activity lies on typically in terms of calculated using tools such as the critical path. scope, schedule and decision trees. cost. Response Owner Type Actionee Response Status Residual/secondary risks The person The nature of the The person who The actions chosen in response A simple statement of Despite best efforts to responsible response will will implement the to the risk event and their effect whether the risk event is deal with a risk event, the for managing probably be evident response. This may, (e.g. a reduction in probability, active (default situation) planned response may the risk. from its description or may not, be the impact or both). or closed. A risk event leave some residual risk or but noting the same person as the may be closed if its create a new, secondary The cost of implementing the category can aid owner. probability or impact has risk. In some cases this can response should be estimated analysis of overall greatly reduced (and it be covered by explanatory to ensure it does not exceed the risk in terms, for has been accepted), work text, in others it may be expected value of the risk itself example, of how has progressed beyond necessary to create a new and that the total cost of risk much threat has the cause of the event or risk event with responses fits within the risk been transferred or budget. what proportion of
estimated according to the preferred scales set out in the risk management plan. according to the preferred scales set out in the risk management plan. The areas affected by the risk event should also be noted, typically in terms of scope, schedule and cost. expected value. In the simplest approach the cost impact is multiplied by the probability (assuming probability has been estimated on a numeric scale) to give the expected value. The expected value of more complex risk events may be calculated using tools such as decision trees. risk event, should it occur. expected and proximity may be based on certain assumptions. For example, the impact of delay in an activity in the schedule may be assessed on the basis that that activity lies on the critical path. individual risk events and the results of qualitative risk analysis. For complex risk situations, the fields of the risk register may be inadequate to store all the relevant information. Response Owner Type Actionee Response Status Residual/secondary risks The person responsible for managing the risk. The nature of the response will probably be evident from its description but noting the category can aid analysis of overall risk in terms, for example, of how much threat has been transferred or what proportion of The person who will implement the response. This may, or may not, be the same person as the owner. The actions chosen in response to the risk event and their effect (e.g. a reduction in probability, impact or both). The cost of implementing the response should be estimated to ensure it does not exceed the expected value of the risk itself and that the total cost of risk responses fits within the risk budget. A simple statement of whether the risk event is active (default situation) or closed. A risk event may be closed if its probability or impact has greatly reduced (and it has been accepted), work has progressed beyond the cause of the event or Despite best efforts to deal with a risk event, the planned response may leave some residual risk or create a new, secondary risk. In some cases this can be covered by explanatory text, in others it may be necessary to create a new risk event with
risk-register-extended-annotated.docx