Risk Monitoring and Reporting
Keeping the register honest
Monitoring answers three questions continuously: are agreed responses being executed, has the exposure changed, and have new risks appeared? Tools include risk reviews in status meetings, risk audits (examining the effectiveness of the risk process and responses), variance and trend analysis, technical performance measurement, reserve analysis (reserve burn-down against remaining exposure), and tracking key risk indicators and triggers against defined thresholds.
Reporting aggregates: top risks with owners and status, exposure trend, reserve status, responses due or overdue, closed risks, and escalations. A risk report that lists only counts of risks is weak; it should communicate aggregate exposure and whether it is moving toward or away from thresholds.
Traps: confusing a risk audit with a quality audit; monitoring the register's contents without reassessing probability and impact; leaving closed risks open or reopening them without evidence; failing to record a workaround used for an unplanned risk so it can be analyzed later; reporting to stakeholders only when a threshold is breached; forgetting lessons learned at closure.
Rule of thumb: reserve analysis is the honest test. If remaining reserve funds are falling faster than remaining risk exposure, the project is consuming contingency it may need later.
Worked example: a supplier-delay indicator is set at two missed milestone updates. At the first miss, the risk is reviewed and contingency is not released. At the second miss, the trigger fires, the fallback supplier is activated, and the sponsor receives an updated exposure report.