Pre and post mitigation score

Anis Chamaa
This is a great question and one that often reveals how mature a project’s risk management process really is.

According to PMI’s Standard for Risk Management in Portfolios, Programs, and Projects (PMI, 2019), the pre-mitigation score should remain unchanged, as it represents the inherent risk, the level of exposure before any response actions are implemented.
It forms part of the project’s historical record and enables you to demonstrate the actual effectiveness of your risk treatment.

When a risk is mitigated or closed, only the post-mitigation (or residual) score should be adjusted, as it reflects the remaining exposure after the mitigation actions have taken effect.
The variance between the two scores tells the story of your mitigation success.

Changing the pre-mitigation score would distort the baseline and weaken lessons learned, audits, or trend analyses.

In short:
Pre-mitigation = Inherent Risk (baseline)
Post-mitigation = Residual Risk (after response actions)

Keep both visible for transparency, traceability, and maturity evidence.

Curious to hear how other practitioners track these values in their risk registers do you also keep both fields for audit trail and lessons learned?

The pre-mitigation score usually stays the same. It shows the original level of risk before you took any action.

Once the risk is mitigated, you only update the post-mitigation score to reflect the lower risk level. This helps you keep a clear record of what the risk was before and how much it improved after.

This way, you can look back and see which actions actually worked.