Identifying risk

The risk log

An essential tool in any project management methodology is the risk log or risk register. This provides a means of recording the identified risks, the analysis of their severity and the necessary management actions to be taken.

The risk log can be a simple document or spreadsheet and as a general guide any risk log should contain the following fields:

Unique ID This may be simply a title but some kind of alphanumeric coding may be useful where you are dealing with a large number of risks.
Risk (description) Presented in a structured format: Condition – 'There is a risk that' Cause – 'Caused by' Consequence – 'Resulting in'
Likelihood (probability) What is the likelihood of the risk occurring? It would be helpful to record the justification behind this analysis.
Impact What will the impact be if the risk occurs? It would be helpful to record the justification behind this analysis.
RAG status Red, Amber, Green (RAG) status, based on the product of the probability and impact – this is explained further in the section on quantitative risk analysis
Timescale What is the 'risk window' when this risk may occur and when do you start to lose options as to how you respond?
Cost What will the risk cost if it does occur? NB. You can't assess this unless you know what your response action will be.
Owner There should be a person nominated to 'own' the risk which means monitoring the situation and ensuring that necessary management actions are carried out. In a project situation this should be somebody within the project team and in all cases it should be somebody who will be impacted by the risk and who has a vested interest in addressing it.
Risk management approach/ Mitigating actions What are the agreed response actions? These may be broken into:
  • preventative actions to mitigate the risk and
  • the response action if the risk actually occurs. This is sometimes known as an 'impact plan'
Residual risk This is the expected level of risk once all the mitigating actions are complete.
Early warning signs What 'trigger' might alert you to the fact that the risk is about to occur? In some cases you may only choose to spend money on a response action once the trigger occurs.


You may also want to note any interdependencies between risks ie where one risk occurring impacts on another risk. This is sometimes known as 'risk coupling'. This cross-reference alerts you to the fact that when one risk occurs a related risk also requires reviewing.

Our basic template gives you a starting point. This is an expanded version of the preliminary 'risk assessment' template used within our project management guide (both the full risk log and the cut-down initial risk assessment can be viewed in the same template, one on each tab). Merely having logged the risks and possibly assigned them a probability and impact (often very subjectively) can give you a warm glow and the feeling that 'that's that sorted!'.

Actually that's when the real work starts. We've covered the risk log at this point because it is a tool for you to record the identified risks as a first step in managing them. In all probability, having identified a risk, you will have to do a lot more analysis and planning before you can fill in all of the fields with any degree of confidence and start to turn the unknown into the planned.

You may wish to add 'progress logs' for each risk – these could be all under one tab/sheet, or for more complex projects a single progress sheet per risk (and example is given in our template for the risk ID 'EXAMPLE1').