Risk Registers: Structure, Assessment, and Use

All flashcards

What is a risk register?

A risk register is a record of information about identified risks. It commonly includes details such as descriptions, assessments, owners, and planned responses.

What does a risk score usually represent?

It is often the product of a risk's probability and impact ratings and can be used to help rank risks. It is a prioritisation aid, not a precise prediction.

How do qualitative and quantitative risk registers differ?

A qualitative register uses ranked descriptions such as high or low. A quantitative register expresses probability and impact numerically, such as a 50% probability and a $1 million impact.

What are a trigger, a contingent response, and a contingency?

A trigger is an event that results in the risk event occurring. A contingent response is the action planned if the risk occurs, and a contingency is the budget allocated to that response.

What is the fallacy of misplaced concreteness in risk-register use?

It is mistaking the representation—the register or map—for the real situation. Recording a risk does not mean the risk has been managed or that planned actions have been taken.

Quiz questions

1. How does ISO 73:2009 define a risk register?Answer: As a record of information about identified risks.
2. What is a common way to calculate a risk score or rating?Answer: Multiply the probability rating by the impact rating.
3. How does a qualitative risk register differ from a quantitative one?Answer: It uses ranked descriptions, while a quantitative register uses numerical estimates.
4. In a flooding scenario, heavy rainfall brings about the flooding event. What role does rainfall have?Answer: It is the trigger.
5. Why can mechanical reliance on a risk register create an illusion of control?Answer: Recording a risk may be mistaken for acting effectively to manage it.