Ibrahim KhanBusiness Applications Manager| University of Doha for Science and TechnologyDoha, Qatar
When a risk is noted in the risk register with a mitigation plan and response, but the risk has not yet occurred, can we consider the risk as closed? Or, does the risk get closed when it has already occurred and the risk response has been executed?
In other words, can a risk be kept open and monitored until it has occurred or there are no more chances that it will occur? Saving Changes...
Great question - the risk should remain open unless its time for further realization has expired. I've worked with clients that leave it as "open" but also with others who have a different status such as "open-realized" to differentiate those which have been realized from those which haven't.
It all depends on what you want to do with the underlying risk data in your registers and what your stakeholders expect.
Kiron Saving Changes...
Peter RapinSubject Matter Expect; Project Delivery| Independent ConsultantOntario, Canada
First, it should be noted that occurrence or realization of an identified risk does not necessarily preclude it from recurrence.
Second, risk management is not limited to identification, analysis and developing mitigating measures, it also includes the process of applying those mitigating measures when it occurs, tracking the effectiveness of the mitigating measures and possibly a lessons learned cycle. Typically, historical risk registers are used when developing risk management plans for future projects and the complete risk history is useful - Did any of the identified risk materialize? How accurate were our impacts analysis? How effective were our mitigating measures? Where could we have done better? As a minimum a reference to applicable documentation (data) should be available in the project risk register.
Your Project Risk Management Plan should detail how to document risk realization and required documentation. Why not through the Risk Register? Saving Changes...
If a risk materializes, it will be managed as an issue. Unless there is a non-zero chance of a similar problem occurring, the risk should be managed as is. One risk may not be one problem case. For example, the risk of a customer making a request that exceeds the initial scope can be a different issue in multiple cases. Saving Changes...
