Risk Monitoring, Reporting and Communication
Monitoring and review
Risk management is continuous. Monitoring tracks whether risks are changing, whether responses are working, and whether new risks have emerged. Activities include regular risk reviews, risk register updates, tracking trigger conditions (early warning indicators), reassessing probability and impact, reviewing residual risk, and closing risks that are no longer relevant or have occurred. Reviews should be scheduled and also triggered by change (scope, schedule, supplier, external events).
Reporting
Reporting communicates risk status to the right audience in the right format: risk register extracts, risk dashboards, heat maps, top-risk lists, trend analysis, and escalation reports. Good reporting is timely, accurate, relevant, concise and action-oriented - it tells decision-makers what needs attention, not just a list of risks. Different audiences need different views: the board needs exposure and escalation; the team needs actions and owners.
Communication
Communication and consultation run throughout the lifecycle, ensuring stakeholders understand risks and their roles. Transparency builds trust; hiding bad news is a common failure and a governance breach. Escalation must be timely and follow the defined route.
Traps
- Treating the register as a static document set up at the start.
- Reporting every risk to every audience (noise, not insight).
- Monitoring likelihood and impact but forgetting to check whether the response is actually being implemented.
- Failing to close risks, leaving a bloated register.
Worked example
A trigger of "supplier lead time exceeds 6 weeks" is set. At review, lead time hits 7 weeks: the trigger fires, the response (activate backup supplier) is invoked, the risk is re-scored, and the change is reported to the sponsor with the revised exposure.
Rule of thumb
Monitor continuously, report by exception and audience, and always check both the risk and the response.