What it means
A project risk register is the controlled record of identified risks, analysis, owners, responses, indicators, decisions, status, and closure evidence.
Why it matters
The register should support decisions and accountability rather than become a static inventory created for reporting or audit.
Practical focus
- Record enough context to understand the risk, current exposure, ownership, planned action, timing, and decision history.
- Link risks to affected objectives, assumptions, dependencies, changes, issues, and response work.
- Archive or close risks only with a reason and evidence that the exposure is no longer active or relevant.
- Retain the approved definitions, assumptions, decisions, ownership, exceptions, measures, and change history that demonstrate how Project Risk Register operates in real project work.
- Exercise this failure scenario: The register contains hundreds of entries, but no one can identify which exposures require action this week or how responses affect the plan.
Common mistakes
- Using Project Risk Register as a label without defining its scope, owner, decision criteria, and expected evidence.
- Treating a template, meeting, tool screen, or status report as proof that Project Risk Register works consistently in normal delivery.
- Optimizing a single activity while ignoring dependencies, incentives, risk transfer, and the end-to-end outcome.
- Testing only the expected path and never rehearsing this failure condition: The register contains hundreds of entries, but no one can identify which exposures require action this week or how responses affect the plan.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: