HKSM

A risk report is a concise summary of the project's current risk exposure, major threats and opportunities, and the status of risk responses. It turns detailed risk data into clear insights and requests for decisions.

Key Points

• Summarizes overall risk exposure and trends for the project, not every detail from the risk register.
• Covers both threats and opportunities with focus on what needs attention now.
• Highlights top risks, triggers, owners, response status, and residual exposure.
• Includes key metrics such as heat map, risk burndown, and reserve usage.
• Tailors content and frequency to the audience and governance cadence.
• Supports decisions on response actions, risk thresholds, and contingency or management reserve adjustments.

Purpose

The risk report provides a decision-focused view of the project's risk situation so leaders can act promptly. It communicates exposure, trends, and the effectiveness of current responses in a clear and concise format.

Data Sources

• Risk register and risk log (identified risks, owners, status, responses).
• Risk management plan (thresholds, categories, reporting cadence).
• Qualitative and quantitative analysis outputs (prioritization, simulations, exposure metrics).
• Assumptions log and issue log for emerging risks and realized risks.
• Schedule and cost performance data (SPI, CPI, forecast variances).
• Contingency and management reserve status and usage.
• Risk audits, reviews, and lessons learned.
• Change log and decision register for escalations and approvals.
• Early warning indicators and performance trends.

How to Compile

• Confirm reporting cadence, audience, and thresholds from the risk management plan.
• Update the risk register with latest analysis, statuses, and response actions.
• Prioritize and select top risks by exposure and urgency, including key opportunities.
• Summarize overall exposure level and trend since last period.
• Show response effectiveness and residual risk after actions taken.
• Include concise visuals or summaries (e.g., heat map notes, risk burndown trend).
• State decisions needed, escalations, and upcoming triggers or review dates.
• Verify consistency with performance data and reserves, then circulate for review.

How to Use

• Discuss top risks and opportunities in governance meetings and stand-ups.
• Decide on additional responses, contingency drawdown, or escalation when thresholds are exceeded.
• Align team priorities by assigning owners and due dates for risk actions.
• Inform stakeholders about risk trends and confidence in meeting objectives.
• Feed updates back into the risk register and integrated status reporting.

Sample View

Example content for a one-page risk report:

• Overall risk exposure: Medium, trending upward.
• Top threats (3-5): Brief description, owner, trigger, response status, residual exposure.
• Top opportunities (1-3): Benefit, owner, action plan, likelihood window.
• Response effectiveness: Actions completed this period and results.
• Risk metrics: Heat map summary, risk burndown since last month.
• Reserves: Contingency used to date vs. remaining; any forecast shortfall.
• Upcoming triggers and decision points: Dates and required approvals.
• Requests: Approve additional funding for responses, change in risk thresholds, or escalation.

Interpretation Tips

• Look for trend direction as well as current exposure level to anticipate action needs.
• Differentiate inherent risk (before response) from residual risk (after response) to judge effectiveness.
• Check whether risks exceed agreed thresholds and require escalation or governance decisions.
• Balance attention between threats and opportunities to optimize outcomes.
• Validate that reserve usage aligns with realized risks and approved responses.
• Watch for repeated slippage on the same triggers, which may indicate systemic causes.

PMP Example Question

During a monthly review, the sponsor asks for the risk report to support a go or no-go decision on a scope change. What should the report emphasize?

1. A detailed list of every identified risk with full probability and impact data.
2. Top risks and opportunities, exposure trends, response effectiveness, and decisions needed from governance.
3. Only quantitative outputs such as simulation percentiles and S-curves.
4. All issues and change requests raised since the last reporting period.

Correct Answer: B - Top risks and opportunities, exposure trends, response effectiveness, and decisions needed from governance.

Explanation: A risk report is a concise, decision-oriented summary. It synthesizes key insights and requests rather than listing every detail or unrelated logs.