A project risk report the board cannot use
The Riverside Bridge Replacement is an £85m, 30-month public infrastructure project. Its risk register contains 140 risks. Each month the project team reports the top ten risks by risk score to the programme board. Scores were set at project start and have not been revised after mitigation actions; the 'design change' risk remains scored 5x5=25 although the design has been frozen for eight months. The risk owner for 'utility diversion delay' has left the project and no replacement is named. Contingency is £6m, but the cost plan shows only £2m remaining; schedule float is three weeks. The latest report lists all top-ten risks as 'high' with no trend arrows and no information on control effectiveness. A board member says the report is 'unusable' and asks for a revised approach before the next monthly meeting.
1. Diagnose why the current risk report is failing to support project decisions.
Read the worked answer
The report fails because scores are stale and not linked to controls or actions. A 25 score frozen for eight months signals that the register is not maintained. Top-ten-by-score reporting hides new and emerging risks and risks with a low current score but high velocity. No trend, movement, control effectiveness or residual risk means the board cannot see whether management is reducing risk. A missing owner for utility diversion means no accountability. Contingency and float are not connected to risk exposure: £2m remaining against a £6m budget and three weeks of float are treated as financial and schedule facts, not risk indicators. All 'high' without differentiation creates alarm fatigue. There is no linkage to appetite or tolerances. The report is a list, not a decision aid.
2. Design a revised risk reporting and KRI approach for the programme board, including how to treat contingency and schedule float.
Read the worked answer
Revise as follows:
- Re-baseline the register: cause-event-consequence, owner, inherent and residual scores, controls and evidence, treatment actions and due dates.
- Report top risks by residual exposure plus a watchlist for emerging, low-score and high-velocity risks.
- Include trend arrows, movement since last period, control effectiveness rating and overdue actions.
- Use KRIs: contingency drawdown versus earned value, schedule float consumed, number of risks with overdue actions, owner vacancies, and design change requests after freeze.
- Set tolerance thresholds: contingency below £3m or float below two weeks triggers board escalation; any risk above appetite requires a decision.
- Use quantitative schedule and cost risk analysis (e.g., Monte Carlo) to show the probability of completing within budget and date.
- Separate risk reporting from issue reporting.
This gives the board leading indicators, a clear picture of residual exposure, and a specific ask rather than a list of red items.