What is a risk register and what are its typical fields?

What is a risk register and what are its typical fields?

• A. A static list of risks with only probability and impact
• B. A change request log
• C. A financial ledger for risk costs
• D. A living document listing identified risks, probability, impact, triggers, owners, responses, and status

Answer: (D)

A risk register is a living document used to capture and manage risks identified for a project. It tracks not just what risks exist, but also how likely they are, what impact they could have, what would trigger them, who is responsible for addressing them, what actions are planned to treat them, and the current status of each risk. Typical fields include: risk description, probability, impact, risk score or priority, triggers, owner, risk response or mitigation plan, contingency plan, residual risk, status, and dates identified or last updated. It may also include risk category and links to actions or owners responsible for follow-up. This comprehensive, up-to-date format supports proactive risk management rather than a static snapshot, which is why it best fits the concept being tested. A static list misses key elements like ownership, triggers, and planned responses; a change request log and a financial ledger serve different purposes and don’t capture the ongoing management of risk.

A risk register is a living document used to capture and manage risks identified for a project. It tracks not just what risks exist, but also how likely they are, what impact they could have, what would trigger them, who is responsible for addressing them, what actions are planned to treat them, and the current status of each risk.

Typical fields include: risk description, probability, impact, risk score or priority, triggers, owner, risk response or mitigation plan, contingency plan, residual risk, status, and dates identified or last updated. It may also include risk category and links to actions or owners responsible for follow-up.

This comprehensive, up-to-date format supports proactive risk management rather than a static snapshot, which is why it best fits the concept being tested. A static list misses key elements like ownership, triggers, and planned responses; a change request log and a financial ledger serve different purposes and don’t capture the ongoing management of risk.