Risk ID Risk Description Risk Cause Probability Status Assigned to Trigger Event
Example:071111a Schedule Critical Very High 8.1 Low Active Joe Smith
071123a Very High 6.3 High
071123b Serious Very High 4.5 Low
071210a Moderate Very High 2.7 High
071211a Minor Very High 0.9 Low
071222a Moderate High 2.1 High
080105a Moderate Low 0.9 Low
080109a High 4.9 High
080109b Low 2.1 Low
080111a Serious Med 2.5 Med0000000000000
Impact Area
Impact Score
Risk Score
Detecta-bility
New technology presents IT with a steep learning curve, could cause delay in implementation
Staff do not have experinece in this technology
Staff does not obtain training; early "prove feasibility" tasks are not completed
Sample data on this tab are displayed on the ThreatChart tab
Very Serious
Very Serious
Very Serious
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this risk is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how severly the project would be affected if the risk event were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = Minor impact 3 = Moderate impact 5 = Serious impact 7 = Very Serious impact 9 = Critical impact
F6
Probability is the likelihood that the risk event will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Risk Score Priority indicates how closely this Risk should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Red = Migh High Risks should be watched closely. The Red / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this risk Observe = not imminent but keep an eye on it Closed - no longer a threat to the project
J6
The person who is responsible for watching and/or dealing with this risk
K6
Indication that the risk event has or is about to occur. May cause initiation of the Response Plan
G7
Do Not enter data into this column. Data are calculated automatically.
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Risk Description Risk Cause Probability Status Assigned to Trigger EventImpact Area
Impact Score
Risk Score
Detecta-bility
00000000000000000000000000000000
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this risk is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how severly the project would be affected if the risk event were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = Minor impact 3 = Moderate impact 5 = Serious impact 7 = Very Serious impact 9 = Critical impact
F6
Probability is the likelihood that the risk event will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Risk Score Priority indicates how closely this Risk should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Red = Migh High Risks should be watched closely. The Red / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this risk Observe = not imminent but keep an eye on it Closed - no longer a threat to the project
J6
The person who is responsible for watching and/or dealing with this risk
K6
Indication that the risk event has or is about to occur. May cause initiation of the Response Plan
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Risk Description Risk Cause Probability Status Assigned to Trigger EventImpact Area
Impact Score
Risk Score
Detecta-bility
00000
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this risk is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how severly the project would be affected if the risk event were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = Minor impact 3 = Moderate impact 5 = Serious impact 7 = Very Serious impact 9 = Critical impact
F6
Probability is the likelihood that the risk event will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Risk Score Priority indicates how closely this Risk should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Red = Migh High Risks should be watched closely. The Red / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this risk Observe = not imminent but keep an eye on it Closed - no longer a threat to the project
J6
The person who is responsible for watching and/or dealing with this risk
K6
Indication that the risk event has or is about to occur. May cause initiation of the Response Plan
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Results of formal analysis Response Strategy Comments; Fallback plans
Example:071111a 04-Mar-06 Example text
071123a
071123b
071210a
071211a
071222a
080105a
080109a
080109b
080111a0000000000000
Contingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
Advanced training planned for 3 staff to occur on 12/2/03
M6
Put results of detailed quantitative analysis here
N6
A description of the plan in place to deal with this risk. Can be: Mitigation - reduce the impact of the risk event on the project Contingency - alternate course of action should the risk even occur Transfer (Insurance) - make the risk event someone else's problem Avoidance - make the risk less likely to occur at all
O6
Use Expected Monetary Value (EMV) to calculate the Contingency Reserve. EMV (cost) = Probability x Cost EMV (time) = Probability x Delay Example: Probability = 50% Cost if risk event occurs = $5,000 EMV (cost) = $5,000 x 0.5 = $2,500 Total of all EMV = Contingency Reserve for the project.
P6
Date that agreement was reached on the Response Strategy
L7
Do Not enter data into this column. Data are calculated automatically.
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Results of formal analysis Response Strategy Comments; Fallback plansContingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
00000000000000000000000000000000
M6
Put results of detailed quantitative analysis here
N6
A description of the plan in place to deal with this risk. Can be: Mitigation - reduce the impact of the risk event on the project Contingency - alternate course of action should the risk even occur Transfer (Insurance) - make the risk event someone else's problem Avoidance - make the risk less likely to occur at all
O6
Use Expected Monetary Value (EMV) to calculate the Contingency Reserve. EMV (cost) = Probability x Cost EMV (time) = Probability x Delay Example: Probability = 50% Cost if risk event occurs = $5,000 EMV (cost) = $5,000 x 0.5 = $2,500 Total of all EMV = Contingency Reserve for the project.
P6
Date that agreement was reached on the Response Strategy
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Results of formal analysis Response Strategy Comments; Fallback plansContingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
00000
M6
Put results of detailed quantitative analysis here
N6
A description of the plan in place to deal with this risk. Can be: Mitigation - reduce the impact of the risk event on the project Contingency - alternate course of action should the risk even occur Transfer (Insurance) - make the risk event someone else's problem Avoidance - make the risk less likely to occur at all
O6
Use Expected Monetary Value (EMV) to calculate the Contingency Reserve. EMV (cost) = Probability x Cost EMV (time) = Probability x Delay Example: Probability = 50% Cost if risk event occurs = $5,000 EMV (cost) = $5,000 x 0.5 = $2,500 Total of all EMV = Contingency Reserve for the project.
P6
Date that agreement was reached on the Response Strategy
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Opportunity Description Opportunity Cause Probability Status Assigned to Trigger Event
Example:021111a Schedule Med 4.5 High Active Joe Smith
Very Low 0.9 Med
Low 2.7 Low
High Very High 6.3
High High 4.9
High Med 3.5
High Low 2.1
High Very Low 0.7
000000000000000
Opportunity ID
Impact Area
Impact Score
Opportunity Score
Detecta-bility
New technology presents IT with a real opportunity, could shave weeks off of implementation
Very High
Very High
Very High
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this opportunity is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how much the project would be helped if the opportunity were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = very low impact 3 = low impact 5 = med impact 7 = high impact 9 = very high impact
F6
Probability is the likelihood that the opportunity will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Opportunity Score Priority indicates how closely this Opportunity should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Blue = High High Opportunitiess should be watched closely. The Blue / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this opportunity Observe = not imminent but keep an eye on it Closed - no longer a opportunity for the project
J6
The person who is responsible for watching and/or dealing with this opportunity
K6
Indication that the opportunity has or is about to occur. May cause initiation of the Response Plan
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Opportunity Description Opportunity Cause Probability Status Assigned to Trigger EventOpportunity
IDImpact Area
Impact Score
Opportunity Score
Detecta-bility
000000000000000000000000000000
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this opportunity is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how much the project would be helped if the opportunity were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = very low impact 3 = low impact 5 = med impact 7 = high impact 9 = very high impact
F6
Probability is the likelihood that the opportunity will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Opportunity Score Priority indicates how closely this Opportunity should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Blue = High High Opportunitiess should be watched closely. The Blue / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this opportunity Observe = not imminent but keep an eye on it Closed - no longer a opportunity for the project
J6
The person who is responsible for watching and/or dealing with this opportunity
K6
Indication that the opportunity has or is about to occur. May cause initiation of the Response Plan
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Opportunity Description Opportunity Cause Probability Status Assigned to Trigger EventOpportunity
IDImpact Area
Impact Score
Opportunity Score
Detecta-bility
0000000
A6
Use the following format for the Risk ID: YYMMDDx Where YY = year MM = month DD = day x = a count of risks entered on this day Example: 051112a = first risk logged on Nov 12, 2005)
C6
Indicate where this opportunity is most likely to have impact. Can be on Schedule, Cost, Scope or Quality
E6
Impact Score is an indication of how much the project would be helped if the opportunity were to occur. It can be any of the following values: 1,3,5,7,9 where: 1 = very low impact 3 = low impact 5 = med impact 7 = high impact 9 = very high impact
F6
Probability is the likelihood that the opportunity will occur. It is a decimal. Choose from .1, .3, .5, .7 or .9 where: .1 = very low probability .3 = low probability .5 = med probability .7 = high probability .9 = very high probability
G6
Priority is a calculated score: Probability x Opportunity Score Priority indicates how closely this Opportunity should be monitored. Color indicates priority as follows: Green = Low Yellow = Medium Blue = High High Opportunitiess should be watched closely. The Blue / Yellow / Green cutoffs are based on decisions documented in the Risk Response Plan and set in the Priority Chart tab of this spreadsheet.
H6
Will you be able to see this risk event coming? 1 =high detectability 3 = medium detectability 5 = low detectability
I6
Active = Action is being taken to deal with this opportunity Observe = not imminent but keep an eye on it Closed - no longer a opportunity for the project
J6
The person who is responsible for watching and/or dealing with this opportunity
K6
Indication that the opportunity has or is about to occur. May cause initiation of the Response Plan
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Signs and Symptoms Response Strategy Comments; Fallback plans
Example:021111a 04-Mar-06 Example text
0
0
0
0
0
0
0
000000000000000
Results of formal analysis
Contingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
Vendor announces availability of the new product
Expedite purchase of a sample of the new technology
M6
These are indicators that the opportunity is likely to occur.
N6
Put results of detailed quantitative analysis here
O6
A description of the plan in place to deal with this opportunity. Can be: Exploit - eliminate uncertainty that an opportunity will occur Share - give responsibility for the opportunity to a third party Enhance - increase probability or impact of an opportunity Acceptance - Deal with it (threat or opportunity) if and when it occurs but make no plans now Contingency - set aside a dollar or time reserve that will absorb impact of the risk event
P6
See comment in Contingency Reserve column on Threat Register for info on EMV. Note: EMV for Opportunities is positive and serves to reduce the Contingency Reserve.
Q6
Date that agreement was reached on the Response Strategy
L7
Do Not enter data into this column. Data are calculated automatically.
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Signs and Symptoms Response Strategy Comments; Fallback plansResults of formal
analysis
Contingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
000000000000000000000000000000
M6
These are indicators that the opportunity is likely to occur.
N6
Put results of detailed quantitative analysis here
O6
A description of the plan in place to deal with this opportunity. Can be: Exploit - eliminate uncertainty that an opportunity will occur Share - give responsibility for the opportunity to a third party Enhance - increase probability or impact of an opportunity Acceptance - Deal with it (threat or opportunity) if and when it occurs but make no plans now Contingency - set aside a dollar or time reserve that will absorb impact of the risk event
P6
See comment in Contingency Reserve column on Threat Register for info on EMV. Note: EMV for Opportunities is positive and serves to reduce the Contingency Reserve.
Q6
Date that agreement was reached on the Response Strategy
Copyright 2006 CVR/IT Consulting LLC Risk Register Your OrganizationName Here
Risk ID Signs and Symptoms Response Strategy Comments; Fallback plansResults of formal
analysis
Contingency Reserve; Cost and Schedule adjustments to Project
Plan
Date of Plan Approval
0000000
M6
These are indicators that the opportunity is likely to occur.
N6
Put results of detailed quantitative analysis here
O6
A description of the plan in place to deal with this opportunity. Can be: Exploit - eliminate uncertainty that an opportunity will occur Share - give responsibility for the opportunity to a third party Enhance - increase probability or impact of an opportunity Acceptance - Deal with it (threat or opportunity) if and when it occurs but make no plans now Contingency - set aside a dollar or time reserve that will absorb impact of the risk event
P6
See comment in Contingency Reserve column on Threat Register for info on EMV. Note: EMV for Opportunities is positive and serves to reduce the Contingency Reserve.
Q6
Date that agreement was reached on the Response Strategy
Risk Chart - Risk Score x DetectabilityThis chart displays one data point for each risk.
Low Risk Scores are on the leftHigh Risk Scores are on the rightHighly detectable risks are at the bottomPoorly detectable risks are at the top
To identify highest priority risks (i.e. high Risk Score and Low Detectability), do the following:1. Select all rows below that have risk data (starting with row 19)2. Sort on column C, Descending, then sort on Column B, Descending, as follows
3. For each unique Risk Score, the highest Risk x Detectability values will be at the top4. Data on this page are updated automatically as you revise or enter new data on the ThreatRegister tab
Probability 0.1/0.3/0.5/0.7/0.9 where 0.1 is very low and 0.9 is very high
Risk Score Impact x Probability
Detectability
Priority Determined by criteria set on Priority Chart tab
Status Active (being worked), Observe, Closed
To add more rows, copy and insert formatted rows.
http://www.cvr-it.com
For a complete explanation of how to use this template, see the companion document, Risk Management Plan.
YYMMDDx (e.g., 021112a = first risk, logged on Nov 12, 2002)
Impact Score (Threat)
1/3/5/7/9 where: 1 = Minor impact (could have minimal effect on project cost, schedule or deliverables) 3 = Moderate impact (could have moderate effect on project cost, schedule or deliverables) 5 = Serious impact (could significantly increase cost, delay the schedule or degrade deliverables) 7 = Very Serious impact (could kill the project or seriously reduce project value) 9 = Critical impact (will kill the project)
Impact Score (Opportunity)
1/3/5/7/9 where: 1 = very low impact (may have slight impact on cost reduction or shortening of schedule) 3 = low impact (may have some impact in cost reduction or shortening of schedule) 5 = med impact (could have substantial impact by reducing cost, shortening the schedule or improving the quality of deliverables) 7 = high impact (could make this project a stunning success) 9 = very high impact (could have a positive impact at the business level by enhancing Business Value)
An indication of how easy it will be to see this risk event coming before it actually occurs. 1=high (can see the event well in advance) 3=medium (can see the event just before it happens) 5=low (can see the event as it happens or after it happens)
Note: Values for Probability and Impact Score are derived from the Risk Management Plan
