Risk Register: How to Build and Maintain One for PMP

The Risk Register: Your Project's Living Risk Document

The risk register is arguably the most referenced output in the entire PMBOK Guide. It is created during the Identify Risks process and updated throughout the project lifecycle. For the PMP exam, you need to understand not just what a risk register contains, but how it evolves as the project progresses through planning, execution, and monitoring.

What Goes Into a Risk Register

A risk register is a comprehensive document that records identified risks and their details. The PMP exam tests the following components:

Risk ID: A unique identifier for tracking purposes.
Risk description: A clear statement of the uncertain event, often written in cause-risk-effect format.
Risk category: Technical, external, organizational, or project management.
Probability assessment: The likelihood that the risk event will occur.
Impact assessment: The consequence to project objectives if the risk occurs.
Risk score: Probability multiplied by impact, used for prioritization.
Risk owner: The person responsible for monitoring the risk and implementing responses.
Response strategy: The planned approach (avoid, mitigate, transfer, accept for threats; exploit, enhance, share, accept for opportunities).
Contingency plan: Actions to take if the risk event occurs.
Fallback plan: Actions to take if the contingency plan fails.
Triggers: Warning signs that the risk is about to occur or has occurred.
Residual risks: Risks that remain after response implementation.
Secondary risks: New risks created by implementing a risk response.

Building the Risk Register: Step by Step

Step 1: Identify Risks

Gather risks using brainstorming, interviews, Delphi technique, SWOT analysis, checklists, and document review. The goal is volume — capture every potential risk without evaluating them yet. The project team, stakeholders, subject matter experts, and even end users can contribute.

Step 2: Perform Qualitative Risk Analysis

Assess each risk's probability and impact using predefined scales. Plot risks on a probability-impact matrix. This step prioritizes risks so the team focuses effort where it matters most. High-priority risks move to detailed analysis; low-priority risks go on a watch list.

Step 3: Plan Risk Responses

For each prioritized risk, develop a response strategy, assign a risk owner, define triggers, and estimate contingency reserves. Each response should be appropriate, cost-effective, realistic, and agreed upon by stakeholders.

Step 4: Monitor Risks

During execution, the risk register is a living document. New risks are identified, existing risks are reassessed, triggers are monitored, and response effectiveness is evaluated. Risk audits and variance analysis feed back into the register.

PMP Exam Focus Areas

The exam tests several nuanced aspects of risk registers:

When the risk register is created: It is an output of the Identify Risks process, not Plan Risk Management. Plan Risk Management produces the risk management plan, which governs how risk activities will be performed.
Who owns risks: Every identified risk must have a risk owner. "The team" is not an acceptable owner — it must be a specific individual.
Secondary risks: Implementing a risk response can create new risks. These secondary risks must also be analyzed and recorded in the register.
Residual risks: After implementing a response, some exposure usually remains. This residual risk must be documented and may require contingency reserves.

Common Mistakes on PMP Risk Register Questions

Confusing the risk management plan with the risk register — the plan describes the process; the register lists the actual risks.
Believing the risk register is finalized during planning — it is updated continuously.
Ignoring positive risks (opportunities) — the risk register records both threats and opportunities.
Assigning response strategies without an owner — ownerless responses do not get executed.

For hands-on practice building and interpreting risk registers, explore our PMP cheat sheets or sign up for scenario-based practice questions that test real-world risk register applications.