Risk Management - minimum data?

Question

I'd like to come up with a "3x5 card risk board" which is essentially a movable dry-erase board where 3x5 sticky cards can be posted by the team and moved/reviewed daily/weekly as needed. (I use the 2-D grid of probability & impact for placement)

I'd like a reasonable minimum set of data for the cards so they are readable and contain just enough info to be useful. I can follow up with the author/owner after the meeting to get details that I can put into the actual register, but people tend to only look at/use the board.

Other than Title, what would people suggest be a minimum set of data for the cards?

Answer 1

First, I like the idea of a risk board with the probability/impact axis. It can make the team more focused on the risks of the project and can create the desire to mitigate risks and thus pull them to the lower-left side of the board.

Now, I would add the following to the risk cards:

• A unique ID for each of the risks, that can be used to identify them in the risk register (just a running number)
• Risk title, should be a short sentence describing just the event that could occur.
• Risk owner

The rest of the details should be maintained in the risk register.

IMO, if the team discusses the risks on a frequent basis, this level of detail is just enough.

Answer 2

You will also need the course of action. You can use a simple code to keep the data on the card to a minimum. Use like M for mitigate, A for accept, etc. I'd also include a code to indicate if there is a contingency plan and resources in place. Include estimated date of impact.

If you have available landscape, you can also indicate if this risk is associated with another risk or issue(s).

Finally, I'd add a stop light indicator to report its current health.

Answer 3

Since it sounds like you're running an independent risk register and this board is only for team use and review/identification of risks, I'd forget the 2D grid and use just use a blank space. This will eliminate the focus on "high probability/high impact" risks, and keep everyone looking at them all. You could if you wanted order them according to severity or proximity, but the grid creates an unconscious focus on specifics.

As for information, I'd suggest using both sides of the card. The front side (visible to all) would be just the risk, and its impact. On the back I'd add the risk register code as Oren suggested, the M,A,T codes per David, the risk Owner, and the date the risk was identified.

The key here is that you don't want to clutter the cards, but you don't want to lose valuable information. So separate what you need from what you want the team focusing on.

Answer 4

I'm going by memory, but Waltzing with Bears taught me to record the following for each risk: description, cost, probability, indicators, mitigation strategies. An indicator is something you can notice that tells you that the risk is about to be realised and become a problem. I don't know whether you can fit all that on a 3x5, but I'd try.