Risk Register Template Prince2

Standard Operating Procedure: PRINCE2 Risk Register Management

Document ID: TR-SOP-PM-042
Effective Date: 2023-10-27
Version: 2.1.0
Review Cadence: Semi-Annual

---

1. Executive Summary & Purpose

The purpose of this SOP is to standardize the identification, assessment, and management of risks within the Template Registry framework, adhering to PRINCE2 methodology. This document ensures that project risks are captured, analyzed, and mitigated systematically to prevent project deviation and protect institutional objectives.

2. Scope & Prerequisites

• Scope: Applies to all projects managed under the Template Registry governance model. Covers the entire lifecycle from initiation to project closure.
• Prerequisites:
  • Access to the centralized Project Management Information System (PMIS).
  • PRINCE2 Foundation or Practitioner certification (recommended).
  • Baseline Risk Management Plan (RMP).

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Procedure

Phase 1: Risk Identification

• Schedule a risk identification workshop with key stakeholders.
• Capture internal and external threats using standard WBS-based categories.
• Populate the Register with: Risk ID, Date Identified, Risk Description, and Risk Cause.

Phase 2: Risk Assessment

• Evaluate Probability (1-5) and Impact (1-5).
• Calculate Expected Value: (Probability × Impact).
• Assign an "Initial" score and "Residual" score (post-mitigation).
• Determine Risk Proximity (when the risk is likely to occur).

Phase 3: Risk Response Planning

• Select response strategy: Avoid, Reduce, Transfer, Share, or Accept.
• Document specific mitigation actions for each identified risk.
• Assign a named Risk Owner for every entry.

Phase 4: Monitoring and Control

• Update Register status during every Weekly Progress Meeting.
• Re-assess Probability/Impact scores based on current project maturity.
• Escalate risks exceeding the defined Project Tolerance to the Project Board.

---

5. Quality Assurance & Pro-Tips

Quality Standards:

• Completeness: No risk shall exist in the register without a designated Owner and a defined Response Strategy.
• Timeliness: Risk Register must be updated within 24 hours of a project status review.

Pro-Tips:

• Avoid Vague Entries: Use the "Cause -> Event -> Effect" format (e.g., "Due to [Cause], [Event] may occur, resulting in [Effect]").
• Watch the Residual: If the residual risk is higher than the project’s risk appetite, the project must be paused for board intervention.
• The "Zero Risk" Fallacy: Never leave the Register empty. A project without risks identified is a project lacking sufficient oversight.

---

6. Frequently Asked Questions (FAQ)

Q: At what point is a risk considered an "Issue" under PRINCE2? A: A risk becomes an Issue the moment the uncertainty materializes. Once the event occurs, move the entry from the Risk Register to the Issue Register and trigger the Exception Process if necessary.

Q: How often should we retire risks? A: Risks should be archived only after the threat window has passed or the risk has been successfully mitigated to the point of irrelevance. Do not delete them; change the status to "Closed/Expired" to maintain an audit trail.

---

Authorized by: Julian Vance Chief Architect, Template Registry