Project Management: Foundations to Practice · Risk Management
Identifying Risks
A risk register created once and never revisited provides a false sense of security. This chapter covers what genuine, ongoing risk identification requires.
Risk identification is the process of determining which uncertain events could affect a project, positively or negatively, and documenting them in a risk register, a living document that tracks each risk's description, category, and owner throughout the project [1]. Calling it a 'living' document is not incidental; a register that stops being updated after the initial planning phase stops reflecting the project's actual current risk landscape almost immediately.
Key Takeaways
- A risk register is a living document tracking each risk's description, category, and owner, meant to be continuously updated.
- Identification techniques include brainstorming, expert interviews, and reviewing lessons learned from similar past projects.
- ISO 31000 frames risk identification as continuous, not a one-time planning-phase exercise.
- Risks that actually damage a project are disproportionately ones invisible at kickoff, only emerging once circumstances shift mid-project.