Risk Repository

Definition

Risk Repository
(a.k.a., Risk Log, Risk Register)

a risk management work product that stores the significant risks to the success of an endeavor

Classification

As illustrated in the preceding figure, Risk Repository is part of the following inheritance hierarchy:

• Type: Concrete
• Superclass: Document
• Subclasses:
  • None

Responsibilities

The typical responsibilities of a Risk Repository are to:

• Store endeavor risks.
• Store risk metadata.

Contents

A Risk Repository typically has the following contents:

• Risks with associated Risk Metadata
  For each risk:
  • Name and description
  • Date identified
  • Asset or business process at risk
  • Threats to these assets and business processes.
  • Vulnerabilities to these threats (e.g., high/medium/low).
  • Estimated risk impact (a.k.a.,loss magnatude) (e.g., high/medium/low).
  • Estimated risk (i.e., loss, probability of occurrance) probability (e.g., high/medium/low).
  • Risk Level (e.g., High/Medium/Low)
  • Status (e.g., Accepted, Avoided, Mitigated, Transferred)
  • Risk Control (e.g., risk acceptance, avoidance, mitigation, and transfer) and Risk Monitoring Techniques Used
  • Risk control and risk monitoring actions taken including date actions taken
  • Owner
  • Resources utilized

Stakeholders

A Risk Repository typically has the following stakeholders:

• Producer:
  • Project Team
• Evaluators:
  • Project Management Team
• Approvers:
  • Technical Leader
  • Project Manager
  • Customer Representative
• Maintainers:
  • Project Management Team
• Users:
  • Project Team

Phases

A Risk Repository is typically produced and maintained during the following phases:

• Business Strategy: Completed
• Business Optimization: Completed
• Initiation: Completed
• Construction: Completed
• Initial Production: Completed
• Full-Scale Production: Completed
• Delivery: Completed
• Usage: Completed
• Retirement: Completed

Preconditions

A Risk Repository can typically be started if the following preconditions hold:

• The project has started.
• The project management team is properly staffed and trained in risk management.

Inputs

A Risk Repository typically has the following inputs:

• Work Products:
  • Risk Management Plan
  • Risk Analysis Report
• Stakeholders:
  • Program Management Team or Project Management Team member
  • Requirements Team
  • Architecture Team
  • Environments Team
  • Technical Leader

Guidelines

• This is a living repository that must be maintained and updated as risks change.
• Minimize redundancy between the risk repository and risk monitoring report.
• Use the procedure in the associated work flow to produce this work product.
• If you tailor this work product, then tailor its associated standard, template, and inspection checklist.

Conventions

Risk Repository is typically constrained by the following conventions:

• Work Flow
• Content and Format Standard
• Database Schema
• Inspection Checklist

Examples

• Example Risk Repository