Risk Register Playbook
Guide Origin: Official | ArcKit Version: [VERSION]
/arckit:risk creates a comprehensive risk register following HM Treasury Orange Book principles for project and operational risk management.
Inputs
| Artefact |
Purpose |
Requirements (ARC-<id>-REQ-v1.0.md) |
Requirements that could be at risk |
| Stakeholder drivers |
Business context and risk appetite |
| Architecture diagrams |
Technical risks from design |
| Existing risk registers |
Organizational risk context |
Command
Output: projects/<id>/ARC-<id>-RISK-v1.0.md
Risk Register Structure
| Section |
Contents |
| Executive Summary |
Overall risk profile and top risks |
| Risk Appetite |
Organization's tolerance for risk |
| Risk Categories |
Grouping of risks by type |
| Risk Register |
Detailed risk entries with scoring |
| Risk Treatments |
Mitigation actions and owners |
| Risk Monitoring |
Review schedule and escalation |
| Dependencies |
Cross-project and external risks |
Orange Book 4Ts Risk Responses
| Response |
Description |
When to Use |
| Tolerate |
Accept the risk |
Low impact, low likelihood |
| Treat |
Mitigate the risk |
Reduce likelihood or impact |
| Transfer |
Share the risk |
Insurance, contracts, third parties |
| Terminate |
Avoid the risk |
Remove the risk source entirely |
Risk Scoring Matrix
| Likelihood / Impact |
Very Low (1) |
Low (2) |
Medium (3) |
High (4) |
Very High (5) |
| Very High (5) |
5 |
10 |
15 |
20 |
25 |
| High (4) |
4 |
8 |
12 |
16 |
20 |
| Medium (3) |
3 |
6 |
9 |
12 |
15 |
| Low (2) |
2 |
4 |
6 |
8 |
10 |
| Very Low (1) |
1 |
2 |
3 |
4 |
5 |
Risk Categories
| Category |
Examples |
| Strategic |
Business case viability, stakeholder support |
| Delivery |
Timeline, resources, dependencies |
| Technical |
Technology maturity, integration complexity |
| Security |
Data breaches, cyber threats |
| Financial |
Budget overrun, funding uncertainty |
| Compliance |
Regulatory, legal, policy requirements |
| Operational |
Service availability, support capability |
One-Page Workflow
| Phase |
Key Activities |
ArcKit Commands |
| Discovery |
Define requirements and stakeholders |
/arckit:requirements, /arckit:stakeholders |
| Identification |
Identify and categorize risks |
/arckit:risk |
| Assessment |
Score and prioritize risks |
Review workshop |
| Treatment |
Define mitigations and owners |
Update risk register |
| Monitoring |
Regular review and reporting |
Governance meetings |
Review Checklist
- Risk appetite clearly defined and agreed.
- All risk categories considered.
- Each risk has likelihood, impact, and score.
- All high/very high risks have treatment plans.
- Treatment owners and deadlines assigned.
- Dependencies on other projects captured.
- Review schedule established.
- Escalation thresholds defined.
Risk Entry Format
| Field |
Description |
| ID |
Unique identifier (RISK-001) |
| Title |
Brief description |
| Category |
Risk category |
| Description |
Detailed explanation |
| Cause |
What could cause this risk |
| Effect |
Impact if risk materializes |
| Likelihood |
1-5 score with rationale |
| Impact |
1-5 score with rationale |
| Inherent Score |
Likelihood × Impact (before treatment) |
| Response |
Tolerate/Treat/Transfer/Terminate |
| Treatment |
Actions to address the risk |
| Owner |
Person accountable |
| Residual Score |
Score after treatment |
Key Principles
- Risk-Informed Decisions: Use risk to guide project decisions.
- Proportionate Response: Treatment effort matches risk severity.
- Clear Ownership: Every risk has a named owner.
- Regular Review: Risks change; register must be living document.
- Escalation Culture: High risks escalate promptly to senior leaders.
wehub-resource-sync