Risk Register: The Central Repository for Project Risk Information

PMBOK v8 Definition

The risk register is a repository in which outputs of risk management processes are recorded. It captures details of identified individual project risks and is updated throughout the project as processes are conducted. The risk register may contain limited or extensive risk information depending on project variables such as size and complexity.

This document is an output of the Identify Risks process and is continuously updated through Perform Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks. The risk register belongs to the Risk performance domain.

Why It Matters for the Exam

The risk register appears in 15-20% of PMI exam questions across all domains, particularly in questions about risk management, communication, and monitoring. Expect scenario-based questions where you must identify what belongs in the risk register versus the risk report, or determine which process updates the risk register. Memorizing its content and timeline is essential for scoring correctly on these questions.

Key Points to Remember (for the exam)

• Primary Content: List of identified risks with unique identifiers, described in sufficient detail for unambiguous understanding. A structured risk statement distinguishes risks from their cause(s) and effect(s).

• Risk Owners: Potential risk owners are recorded in the risk register when identified during the Identify Risks process.

• Updating Processes: The risk register is updated by five processes: Identify Risks, Perform Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks.

• Not a Static Document: The risk register evolves throughout the project—it is not created once and finalized.

• Distinction from Risk Report: The risk register contains detailed individual project risks; the risk report contains summary information on overall project risk and trends.

• Tailoring: Content varies by project size and complexity—small projects may have minimal entries; large projects may have extensive detail.

• Common Confusion: The risk register is often confused with the risk report. The register is the detailed repository for individual risks; the report summarizes overall project risk exposure.

Typical PMI Exam Example

During the Perform Risk Analysis process, the project team updates the risk register with probability and impact ratings for each identified risk. A new risk is later discovered during Monitor Risks and must be added to the risk register along with its analysis and proposed response. The project manager records the risk owner and updates the risk register accordingly.

PMI Exam Traps

• Trap: Confusing the risk register with the risk report

  • Reality: Risk register = detailed individual risks; risk report = summary of overall project risk and trends

• Trap: Thinking the risk register is created only during Identify Risks

  • Reality: It is created during Identify Risks but updated by four subsequent processes

• Trap: Believing the risk register only contains threats

  • Reality: The risk register includes both threats and opportunities (positive and negative risks)

• Trap: Assuming risk owners are always assigned during Identify Risks

  • Reality: Only potential risk owners are recorded during Identify Risks; final assignment occurs later

Important PMI Connections

Quick Review Questions

1. Which five processes update the risk register throughout the project?

2. What is the difference between the risk register and the risk report?

3. During which process is the risk register first created?

4. What information about risk owners is recorded in the risk register during Identify Risks?

5. True or False: The risk register only contains information about threats, not opportunities.

PMBOK v8 Reference

Section 2.7.2.2 - Identify Risks (Risk Register definition) Section 2.7.2.6 - Monitor Risks (Risk Register updates) Section 2.7.3 - Tailoring Considerations (Risk Register content varies by project)