In this lesson,
you'll learn about the risk register.
Risk management is an integral part of any project
or business operation that involves identifying, assessing
and prioritizing uncertainties
that could potentially affect the achievement of objective.
One of the most effective tools used
in risk management is the risk register.
Now, this includes a list of key risk indicators
the risk owners, and the risk threshold.
We will also discuss some other related concepts such
as the risk description, risk impact, risk likelihood
risk outcome, risk appetite, risk tolerance, and risk level.
So what is a risk register?
A risk register is also known as a risk log.
It is a document that records details
about identified risk, including their description,
impact, likelihood and mitigation actions.
It serves as a crucial tool for communication
and helps in tracking and managing potential risks
throughout the project lifecycle.
A risk register might also resemble
the heat map risk matrix.
A risk register should be shared between shareholders
so that they can better understand the work they manage.
The risk register will contain several key areas
including the risk description,
risk impact, risk likelihood, risk outcome, risk level
and the cost of each risk identified in the risk register.
The first step
in creating a risk register is to describe the risk.
This involves identifying the risk
and providing a detailed description of what it entails.
The description should be clear and concise
enabling anyone reading the risk to understand the risk
without requiring additional information.
Second, we have the risk impact.
The impact of a risk refers to the potential consequences
if the risk actually takes place.
It could be in terms of cost, time, quality
or any other critical project objective.
The impact is usually rated on a scale,
i.e., low, medium, high,
depending on the severity of the potential consequences.
Third, we have the risk likelihood,
likelihood or probability
is the chance of a particular risk occurring.
Like impact, it's also typically rated on a scale.
The scale could be numerical, just say one to five or one
through 10, or descriptives like rare, unlikely, possible
likely, almost certain.
Fourth, we have the risk outcome.
The outcome is the result of the risk, if it occurs,
it's directly related to the impact
and likelihood of the risk.
The outcome helps in understanding the overall effect
of the risk on the project.
Fifth, we have the risk level or threshold.
The risk level or threshold is determined
by combining the impact and likelihood.
It helps prioritize risk in deciding which risk
require immediate attention, and the risk level
can be categorized as high, medium, or low.
Six, we have the cost.
The cost of a risk is the financial impact it could have
on a project.
It could be the cost incurred
if the risk incurs or the cost of mitigating the risk.
Now, I mentioned that one of the things contained
in a risk register is the risk level or threshold.
But before we can determine the level
of risk to record it as high, medium or low,
is crucial to identify the tolerance level
and risk appetite of your organization.
The risk tolerance or risk acceptance is the degree
of uncertainty an organization
or individual is willing to handle
while achieving their objectives.
It is the maximum amount
of risk that they are prepared to accept.
Tolerating or accepting the risk means
that no countermeasures are defined because the level
of risk does not justify the cost
or because there will be unavoidable delays
before the countermeasures are deployed.
Simply, the organization chooses to not do anything
about the risk.
Risk appetite is a key concept in risk management,
that refers to the amount and type
of risk an organization is really to pursue
or retain in order to achieve its strategic objectives.
It essentially reflects the organization's approach
towards risk taking.
There are three main types of risk appetite,
expansionary, conservative, and neutral.
An expansionary risk appetite indicates
that the organization's willing to take
on more risk for the potential of higher returns.
This approach is often seen
in aggressive growth oriented businesses.
On the other hand, a conservative risk appetite suggests
that the organization prefers to take less risk
even if it means accepting lower returns.
This is common in businesses that prioritize stability
and long-term sustainability.
Lastly, a neutral risk appetite signifies a balance
between risk and return.
Organizations with a neutral risk appetite aim
to strike a balance
between taking calculated risk and ensuring steady growth.
By identifying the tolerance level
and risk appetite upfront,
organizations can effectively categorize
and prioritize risk.
This helps them to align the risk management efforts
with the overall strategic objectives
and ensures that the resources are utilized effectively.
Now that we have a basic risk register completed
we need to add two or more things to it.
The key risk indicators and the risk owner.
Key risk indicators or KRIs
are critical predictive metrics that organizations use
to provide a early signal of increasing risk exposure
in various areas of the enterprise.
Key risk indicators serve as a barometer
of risk or safety levels providing a forward-looking view
of potential risk and are often associated
with the organization's risk appetite.
Key risk indicators are used to measure the potential impact
and likelihood of a risk, allowing organizations
to take proactive steps
to manage the risk before it escalates.
They're typically tied to the organization's objectives
and are used to monitor changes in the level of risk
that can affect the ability to achieve these objectives.
For example, in a banking institution,
a key risk indicator could be the number
of loan defaults in a given period.
A sudden increase in this key risk indicator
might indicate a higher risk of credit default
which could prompt the bank to investigate
and take action to mitigate this risk.
Another important thing to document
in your risk register is the risk owner.
The risk owner is the person
or group responsible for managing the risk.
They are responsible
for monitoring their risk, implementing mitigation actions
and updating the risk register as necessary.
For example, a risk owner could be a project manager
in a construction project.
Now, in this particular context
the project manager would be responsible
for identifying potential risks
such as delays due to bad weather
or cost overruns due to fluctuating material prices.
They would monitor these risks,
implement mitigation strategies like scheduling work
for dry weather, or locking the material prices in early
and update the risk register as necessary.
The project manager as the risk owner will be accountable
for managing these risks
and ensuring the project stays on track.
So remember, the risk register, the risk appetite
and key risk indicators are three pivotal elements
in effective risk management.
The risk register serves
as a comprehensive document that records
and tracks potential risk,
facilitating clear communication and effective management
of uncertainties throughout a project's lifecycle.
Risk appetite, whether expansionary, conservative
or neutral guides and organization's approach to risk taking
influencing how risk are categorized and prioritized.
And lastly, we have KRIs
which provide an early warning system for potential risks
allowing organizations to proactively manage risk
before they escalate
thereby aligning risk management efforts
with strategic objectives.
Understanding and effectively utilizing these components
can significantly enhance an organization's ability
to navigate uncertainties and achieve its objectives.