Should a Risk Management Plan include a Risk Register?

Question

Is it within the scope of a Risk Management Plan document to include a Risk Register?

Or should a Risk Register be created separately, and the plan merely state that a register will be created?

Answer 1

Your risk management plan lays out the method, process and tools you will be using throughout the project to manage risks. It's a document you do at the beginning of the project and that should get signed-off. It should cover how you will identify, assess and track risks and will also include things like responsibilities, governance and decision-making processes related to risks. It should mention the tool you will use to track risks (i.e. the risk register) as well as things like how risks will be reviewed and reported (e.g. as part of a dedicated regular meeting, or through the regular status report).

So the risk register stems from the the risk management plan, but it is a separate and live document where you record information about risks as and when they get identified. Usual information in a risk register includes risk ID, name, description, project area or workstream, severity, likelihood, ownership, action/mitigation plan, dates (registered, closed, etc.). See also this question on what to include in a risk register.

Answer 2

I differ a little bit in definition from Angeline but would result in pretty much the same. In my view, the risk register or log is part of the risk management plan. However, we end up using different tools, creating two different artifacts. The plan is developed using a word application like MS Word while the register is created using another, more conducive application like a spreadsheet or database, allowing for easier data entry, analysis, and reporting. In this case, the register would be incorporated into the plan by reference.

I think it is prudent to consider the risk plan and register to be a single subordinate Project Management Plan (PMP).

Answer 3

As each plan is in fact a prognosis, the PM should "weigh items with risk" while planning (i.e. write down risks immediately). And since you baseline your plan, describe assumptions etc., a similar thing is advised with any risks identified in the beginning. In that sense, keeping these risks in a charter or initiation document is advised. Whether this is a "risk management plan", a "project management plan"... - this seems secondary and differs from framework to framework.

Later on a separate register / log (e.g. Excel sheet) is used typically.