A Risk Report That Has Not Moved in Eight Months

The headline error: in risk reporting, an unchanged profile over eight months is not stability - it is a signal that the process has stopped running. Real projects of this size have risk movement. A report with zero movement almost always means the report has detached from the register, or the register has detached from reality.

Each symptom, read properly:

• Owner vacancy on the two most material risks, six weeks old. No one is accountable. A risk without an owner is not being managed; it is being listed. That this went unnoticed for six weeks also means nobody is checking ownership at review.
• Two response actions due in month 5, never started. Response implementation is untracked. The register probably records 'response planned' and the report presents that as 'risk controlled'. These are different states and the report conflates them.
• Probability fields untouched since month 2. There has been no reassessment. The monthly meeting is a status meeting wearing a risk-meeting label.
• A green risk whose trigger fired twice. Triggers exist on paper but nothing monitors them and no defined action follows a fired trigger. A trigger with no monitoring owner and no response protocol is decoration.
• Nine greens. In most registers a colour is somebody's opinion. Without a defined threshold for green, it is not information.

The failure: monitoring and reporting have become ceremonial. The steering committee is being given false comfort on a compliance programme, where the exposure is not just cost - it is regulatory and audit exposure, and the committee's decisions on funding and go-live timing are being made on stale data.

What I say to the programme manager: stability in the plan is good. Stability in the risk profile without evidence of reassessment is the thing an assurance function exists to catch.

What gets monitored - the content:

• Response action tracker: baseline date vs actual date, percent complete, evidence of completion, named action owner. 'Started / not started' is the minimum; evidence is the standard.
• Owner attestation each cycle: the risk owner confirms that probability, impact, response and trigger are current. An unreconfirmed risk is flagged, not silently reported.
• Trigger status: every risk with a trigger gets a monitored condition, a monitoring owner, and a pre-agreed action if it fires.
• KRIs with thresholds and trend: e.g. vendor attestations outstanding, open regulatory findings, consultation milestones vs plan, data-migration defect rate.
• Reserve and contingency drawdown against plan, so consumption is visible before it is exhausted.
• Exposure trend over time - aggregate expected exposure or simulated P80 - plus counts of new, closed and escalated risks. Movement is the signal; the snapshot is not.

How the report is presented - two pages:

1. Exposure and movement since last period, with the reason for every change (a risk that moved without a stated reason did not move).
2. Decisions required from the committee, each with options, a recommendation and a deadline.

What I remove: the twelve-row green/amber/red table as the summary artefact. It invites the committee to read colours rather than exposure.

Governance plumbing: define the thresholds for each colour, the escalation rules, and the rule that any risk with a vacant owner is escalated automatically - all in the risk management plan, so escalation is a procedure rather than an argument. Cadence: monthly reassessment of the top risks, event-driven reassessment on any fired trigger.

Separate the format from the substance. The issue is not the layout. It is that the steering committee is making funding and go-live decisions on data that has not been updated since month 2, and two of the most material risks currently have no owner. Say that, in those terms, once.

Bring facts, not opinions. Four items, all verifiable and none of them a matter of taste:

• Owner vacancy on the two most material risks, dated six weeks ago.
• Two response actions due in month 5, not started, with no evidence of progress.
• Last-edit date on the probability fields: month 2.
• A green risk whose trigger has fired twice with no recorded action.

Offer a cheap path. Keep the existing report exactly as it is and add one page: movement since last period, plus decisions required. Offer to produce it for one cycle as a trial. Most resistance to reporting change is resistance to effort, not to content.

If refused, escalate - but in that order. Use the escalation route defined in the risk management plan. If no route exists, its absence is itself a finding to raise with the PMO, because it means the only escalation mechanism is personal persuasion.

Document. Record the concern, the programme manager's decision and the date, and register 'steering committee deciding on incomplete information' as a risk with the programme manager as owner. That converts a private disagreement into a governed, owned risk - which is exactly where it belongs.

The professional line: the PMI Code of Ethics obliges accurate and timely reporting to the governing body. I will not personally present a report I know misrepresents the position, and I will not quietly drop the issue to keep the peace. Escalation is the last step, not the first - but it is a step I am prepared to take.