Risk register

List what could go wrong, what you will watch for, who acts, and what they will do.

From the brief onwards. Review it at each baseline and after each change request. Feeds: the business requirements document and the RACI.

• Write each risk as "If cause, then effect".
• Name a trigger that someone can observe without asking anyone.
• Score likelihood and impact on the scale in the Scale sheet, never from memory.
• Name one owner, as a role.
• Write the response, and link the rules, requirements, decisions or questions involved.
• Close a risk that can no longer happen, say what closed it, and keep the row.

1. What trigger will you watch? Answered in Trigger column: each one can be seen in the record or in a source, for example NFR-01's warning for RSK-01.
2. Is this a risk, or an issue already happening? Answered in Status column: RSK-07 became certain when SRC-10 fixed the date, and CR-01 closed it.
3. Who owns the response? Answered in Owner (STK) column: one role per risk.
4. Where do the scores come from? Answered in Scale sheet: the author's scale, tagged MINE, with the reason for each axis.
5. What would each risk break? Answered in Links column: the sources, rules, requirements, decisions and questions at stake, and the tests where one exercises the risk, for example TC-10 and TC-22 for RSK-03.

• Risks stated as causes, such as "lack of resources". You can spot one when there is no "then": nothing says what would go wrong.
• No trigger: nobody could say, on a given day, whether the risk is getting closer.
• The owner is "the project": nobody named in the register would act.
• Scores with no scale: two people score the same risk differently, and nothing settles it.
• No link to what the risk would break: a risk cannot be traced to any rule, requirement or test.

• RSK-07 stays in the register, closed, with its last scores. It was the highest score until CR-01 closed it on Tuesday 22 September 2026 (DEC-15). Rejected: deleting closed risks, which would hide why CR-01 was urgent.
• Each tag says where the risk comes from, a rule or a source, and MINE marks the scores and the response. The scale has its own sheet, with the reason for each axis in its Rationale column. Rejected: a MINE tag on every row and nothing else, which would hide the rules each risk rests on.
• Likelihood is judged over one year, roughly the period covered by the specimen requests' dates (EX-01 to EX-08). Rejected: "over the life of the system", which nobody can judge.
• Likelihood and impact are small whole numbers, and the score is a formula. Rejected: scores typed by hand, which drift from the two numbers they multiply.