Risk Register Updates: Iterative Process for Project Risk Management

PMBOK v8 Definition

Risk register updates refer to the process of revising the risk register to reflect new risks, reassess existing risks, and update response strategies as the project progresses. This iterative process is performed regularly throughout the project life cycle and is a key component of risk management that helps ensure the project's risk documentation remains current and actionable.

Why It Matters for the Exam

The PMI exam frequently tests your understanding that risk register updates are iterative and occur throughout the project, not just during planning. Questions often present scenarios where a risk materializes or becomes obsolete, and you must select the correct update action. Expect situational questions about when to update the risk register and what information must be recorded.

Key Points to Remember (for the exam)

• Main Output of Multiple Processes: Risk register updates are outputs of Identify Risks, Perform Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks
• Iterative Nature: Risk identification should be iterative because not all risks can be identified at the outset due to inherent uncertainties and unknowns
• Required Information: Each update must capture when a risk was identified, when a risk might occur, when a risk may no longer be relevant, and the deadline for taking action
• Unique Identifier: Each individual project risk receives a unique identifier in the risk register
• Risk Owner Assignment: Potential risk owners are recorded during Identify Risks, and Monitor Risks ensures risk owners are assigned to maintain continuity
• Content Flexibility: The risk register may contain limited or extensive risk information depending on project variables such as size and complexity
• Structured Risk Statement: Risks should be described in detail with a structured statement distinguishing causes from effects

Typical PMI Exam Example

During project execution, a new regulatory requirement emerges that could delay the project by two weeks. The project manager must update the risk register to document this new risk, assign a potential risk owner, and record the deadline for taking action. This update occurs as part of the Monitor Risks process.

PMI Exam Traps

• Trap: Thinking risk register updates happen only during the Identify Risks process

• Reality: Updates occur across five processes: Identify Risks, Perform Risk Analysis, Plan Risk Responses, Implement Risk Responses, and Monitor Risks

• Trap: Confusing the risk register with the issue log

• Reality: The risk register captures potential future events (risks), while the issue log documents events that have already occurred (issues)

• Trap: Believing all risks can be identified at project start

• Reality: Risk identification is iterative because inherent uncertainties exist at the beginning; continuous identification is required as the project evolves

• Trap: Assuming the risk register content is standardized regardless of project size

• Reality: The risk register may contain limited or extensive information depending on project variables such as size and complexity

Important PMI Connections

Quick Review Questions

1. During which five processes are risk register updates recorded as outputs?

2. A project manager discovers that a previously identified risk is no longer relevant. What information must be updated in the risk register?

3. Why must risk identification be iterative rather than performed only at the beginning of the project?

4. What is the minimum information that should be captured when a new risk is added to the risk register?

5. How does the content of the risk register differ between a small, simple project and a large, complex project?

PMBOK v8 Reference

Section 2.7.2.6 - Monitor Risks Section 2.7.2.3 - Perform Risk Analysis Section 4 - Inputs and Outputs (Risk Register Updates)