Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
Risk Management User Reference Guide
for Higher Level Skills Demand Led Training – Course Development Projects
This document provides a quick reference guide to
using the Risk Management Tools that have been
provided as part of the Higher Level Skills Demand
Led Training – Risk Modelling Toolkit. It assumes
that users will already have a basic understanding of
risk in a project environment, and be familiar with
the terminology and principles of risk management.
Prior to using this guide and its risk register, users
should read the full report “Higher Level Skills
Demand Led Training – Risk Management”. This will
provide an understanding of the background,
context and methodology used in creating the
exemplar and template risk registers.
Start a new
course
development
project
Identify the risks
Lessons learnt
report, for use in
other projects
•Use template risk
register to establish
your project risk
baseline
There are two Excel Workbooks:
1. Exemplar Risk Register that provides the
exemplar risk register generated through
analysis of issues and risks data collected
from 65 different projects to develop a new
demand led training course. It provides the
baseline data for the worst case inherent
risks, together with the best case residual
risk achieved after risk control and
mitigating actions are in place.
2. Template Risk Register that provides the
tool that will calculate, from the baseline,
the inherent risk and residual risk scores for
your own training development project.
Monitor and control
the risks
Evaluate the risks
•Use action checklists
•Use template risk log
•Use action checklist
•Use risk log
Plan risk response
•Risk bubble maps and
risk log data
31/10/11
Page | 1 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
1 Start a new project
Before beginning a new demand led course development project, an
educational institution must determine whether the benefits realised by the
project fits its strategic goals.
Before work begins, an executive sponsor should be identified. The institution
should complete a high-level evaluation of the project’s business case, its
limitations, and its technical and financial requirements. Finally, a project
manager should be identified, who can then set up a project plan.
To assist with the decision making process about whether or not a proposed
project should proceed, the risks should be evaluated. Thereafter, risk
management and monitoring should be continuously carried out throughout
the whole lifecycle of the project.
The template risk register provides a tool for evaluating a project’s initial risk
position, deciding whether the inherent risk is “within appetite”, identifying
further risk reduction action that can be put in place to bring the risk within
appetite and calculating the residual risk position. Thereafter, it provides a tool
to monitor the risks on an ongoing basis.
Need more detailed information about how this risk management toolkit has
been produced? Refer to the explanatory report “Higher Level Skills Demand
Led Training – Risk Management”.
1. Create a new set of
project risk files
Save the Template Risk Register with a new name that contains ‘baseline-date’.
2. Set the project title
Open the renamed risk register, then on the worksheet High Level Risks, replace the words Project Title: in cell A1, with
the title of your own project.
3. Set the start date
In cell D1, enter the date on which you are creating your project risk register.
4. Enter the register
owner
In cell H1, enter the name of the person who has responsibility for maintaining the register.
31/10/11
Page | 2 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
1b Understand the
Template
The Template Risk Register has been created using lessons learnt data from 65
different demand led training new course development projects. The risk
statements and risk scores are the result of extensive data analysis and
evaluation. Therefore, the baseline inherent risk score, from which your project
risk ratings are calculated, is a reliable representation of the probability and
impact values attributable to each risk.
The residual risk scores calculated are a reliable representation of the probability
and impact values attributable to each risk when the suggested risk reduction
actions are put in place.
1. Initial position
The exemplar risk register provides a baseline against which to measure the starting risk position of any new course
project. It shows the worst case risk that you could expect, and the best case risk that you could expect to achieve
having initiated all of the measures described to control or mitigate the risk.
The template register provides the working document that will show the inherent risk and residual risk for your own
course development project. Based on the answers that are provided in the “Action Checklist” sheet, the tool calculates
the inherent risk that is applicable to your project at your baseline date, and the residual risk that is applicable to the
additional risk control and mitigating actions that you have already put in place or plan to carry out.
Baseline Point. Ideally this will be at the start of your project then all risks will be monitored and managed throughout
the whole lifecycle. However, it can be created, for the first time, at any stage during the project lifecycle and risk
management and monitoring commenced from that date.
2. Risk categories
To enable clarity of risk analysis and subsequent risk management the risks associated with ‘responding to employer
demand for higher level skills training through the development of a new training course’ have been allocated to seven
high level categories. These are:
1.
2.
3.
4.
5.
6.
7.
Main output risks.
Strategic and commercial risks.
Financial risks.
Legal risks.
Organisational and management risks.
Project delivery risks (operational).
Training delivery risks.
31/10/11
Page | 3 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
3. The worksheets
There are 4 worksheets within the provided template workbook.
High Level Risks
Executive level
decision making
Risk Log
Operational level
risk management
Risk Maps
Risk prioritisation
and action
planning.
Visual risk
monitoring
Actions Checklist
Identify which risk
management
actions are in
place
Controls the
inherent risk
ratings for project
4. Spreadsheet
formula
This sheet is a slave to the risk log, if the values in the risk log are changed so will this risk table and chart.

The table shows the 7 high level risk statements relating to each risk category. The risk ratings
provide the maximum risk exposure (from the detailed contributory risks) in each category.

The bubble map is of the Type 2, described below, depicting each of the 7 high level risks.
This sheet is a slave to the action checklist. The risk log sheet contains the high level risk statement for each
category, followed by a detailed breakdown of the individual risks that will contribute to it. Each risk is
broken down as:

Risk source

Risk statement

Inherent proximity, probability, impact and risk rating

Risk indicators

Risk probability reduction actions (weighted)

Risk impact reduction actions (weighted)

Contingency action in the event that the risk crystallizes (materialises)

Residual probability, impact and rating assuming the suggested reduction action is in place.
All calculations in this sheet are automatic, and are controlled by the answers that are given in the action
checklist.
This sheet is a slave to the risk log, and if the values in the log change so will the bubble maps. The bubble
maps provide a graphic representation of the risks contained within each of the 7 high level categories. Two
types of bubble map are provided to aid risk prioritisation and action planning:

Type 1 - probability x proximity x impact. The x axis is derived from the proximity of the risk, the y
axis from the probability of the risk and the bubble size from the impact of the risk.

Type 2 - impact x probability x risk rating. The x axis is derived from the probability of the risk
materialising, the y axis from the worst case impact should the risk materialise, the bubble size is
derived from the risk rating (the magnitude). The shading indicates the risk classification “risk
appetite”.
In both types the blue bubbles are the inherent risk and the red bubbles indicate how the risk is reduced if
the suggested control measures for each of the contributory detailed risks are put in place.
This sheet is the control sheet. The action checklist provides an aggregated list of all of the risk reduction
actions suggested in the risk log. Each action is cross referenced to the risk(s) that it will reduce if put in
place.
In addition to providing the information needed to generate your project’s inherent and residual risk, it
provides a monitoring tool of what action is underway or completed, and who is responsible for undertaking
the action.
The two columns shaded in orange require data to be entered.
Much of the spreadsheet contains calculations formula, graphing and conditional formatting, these cells are locked, and
the sheet protected, to prevent accidental changes. However, the risk log is intended as a tool to assist accurate risk
monitoring and control, rather than a static snapshot, therefore, some parts of the worksheets remain unlocked for user
editing. Care should be taken when inserting rows to ensure that the inserted row picks up the relevant formatting. If
31/10/11
Page | 4 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
deleting row, extreme care should be taken, as the worksheet will need to be unprotected whilst deleting, and then reprotected.
DO NOT delete any columns!
Of the 60 risks identified, 55 will be applicable to every project whose output is a
new higher level skills training course.
2 Identify the risks
All risk statements are written as “There is a risk that (cause)............., leading to
(consequence)..........., resulting in (impact description).........”
Need more information about generic project risk management? See the JISC
Infokit “Risk Management”
1. Create the precise
baseline for your
project
The template risk log starts from a worst case baseline. To establish where your project’s risk baseline is it is necessary
to:
-
2. Remove risks that
are not relevant
Identify any factors that may eliminate one or more of the defined risks.
Insert any additional risks statements that could be applicable to your specific project that are not described in the
template.
Identify the risk management actions that are currently in place in your institution that will already have reduced
either the probability or impact of the defined risks.
If any of the following factors apply to your project, carefully delete the applicable row of the Risk Log, as indicated in
the table. To delete rows:
1. Under the Review tab of the menu, click Unprotect sheet.
2. Carefully delete the applicable rows.
3. Click protect sheet. Do not change any of the selections in the tick boxes. Click OK.
Factor
More than one employer commissioning the course
No E learning content of any kind in the course
No accreditation or validation specified or intended for developed course
There is more than one subject specialist within the institution
Risk number
1a
6n, 6o, 6p
6q, 7h
5e, 5f
Number of rows
5
4, 3, 2
3, 3
2, 1
To avoid inadvertently changing any of the many formula in this risk log it is strongly recommended that you do turn the
protect sheet function back on prior to continuing with the subsequent steps.
DO NOT renumber the remaining risks.
31/10/11
Page | 5 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
4. Add any other risks
statements
If you consider that one or more risks should be added to the risk register for your project then:
a) Write the risk statement and the impact statements;
b) Determine the high level risk category to which it contributes;
c) Using the blank rows supplied at the end of the category, write the risk statement in column C, the impact in
column D; the risk indicators in column L, any actions that could be taken to reduce the probability of the risk
materialising in column J, and any actions that could be taken to reduce the impact of the risk if it did occur in
column M.
d) If you require more than two additional rows in a category then insert an extra row for each risk. To maintain
formatting for colours, dropdowns and particularly the bubble maps insert the extra rows BETWEEN the blank
rows supplied.
e) Assign the risk source in column A, using the drop down list.
f) Allocate a risk number in column B, following the existing format.
g) Evaluate, assign and insert inherent proximity, probability and impact ratings to columns E, F and G. Section 3
of this guide (evaluate the risk) provides guidance about assigning scores.
h) Calculate the inherent risk rating (probability x impact) and insert the result in Column H.
i) Evaluate by how much your risk reduction actions will reduce the probability and impact scores and insert the
residual ratings in columns Q and R.
31/10/11
Page | 6 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
5. Identify in place risk Using the Actions Checklist worksheet.
management
a) Set the baseline - Use column E, (baseline starting point) drop down list. Identify which of the risk control and
actions
mitigation actions are already in place in your organisation for your project.
 Yes – select ‘yes’ only if this action is already in place and applies to your project.
 No – select ‘no’ if this action does not apply (even if it is planned to be put in place later)
For example, consider action number 8, if a contract has already been issued to and agreed by the employer
then the answer would be ‘yes’. If it has not been issued and agreed, but the intention is to do so, then the
answer is ‘no’.
b) Planned actions – Use column F, (planned actions to reduce risk) drop down list. Identify any risk reduction
actions that you already plan to put in place.
 Yes – select ‘yes’ only if you already plan to carry out this action and it is already part of your project
plans.
 No – select ‘no’ if at this point in time there are no plans to carry out this action.
 Baseline – select ‘baseline’ if you selected yes in column E.
For example, considering action number 8 again, if it is part of your current project plans to issue a
contract/agreement to the employer that defines their expected input into steering groups, with a schedule and
nominated staff, then select ‘yes’. If there are no current documented plans to issue a contract of this nature
then answer ‘no’. If, as above, it has already been done then answer ‘baseline’, since the answer to column E
would have been ‘yes’.
6. Save the baseline
risk register
Save your spreadsheet. The projects baseline inherent and residual risk has now been set and calculated.
Switching to any of the worksheets ‘high level risks’, ‘risk maps’ or ‘risk log’ will now give you the risk position of your
own project. This information may now be used either at an executive or operational level for risk management
decisions.
31/10/11
Page | 7 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
3 Evaluate the risk
Each risk has been analysed and evaluated to decide when the risk is most likely
to happen, what the likelihood of it happening is and what the effects would be
on the project outputs, outcomes and benefits would be if it were to happen.
Each risk has then been assigned an appropriate proximity, probability and
impact score.
The inherent risk score assigned to each risk statement is a reliable
representation of the probability and impact values attributable to each risk, in a
worst case scenario and should not be altered once the baseline is set.
Any additional risks that have been added to the log will require manual scoring
for inherent and residual risk.
This section ‘Evaluate the risk’ provides all of the information necessary to
evaluate any new risks that have been added. It will also provide a detailed
explanation and understanding about how to interpret the scores that appear
automatically in the risk log.
1. Assign the
probability
The probability or likelihood factor is defined as a measure of the chance of an impact at that selected level of severity
actually being incurred. The likelihood is assessed, in the first instance, assuming preventative management controls
have not been applied, this gives the inherent risk rating in column F. Then, residual risk likelihood is assessed and
assigned in column Q, after the consideration of the proposed management measures (risk reduction action). Thus two
probability ratings are given for each risk.
Project Delivery Probability Factors
Based on experience with similar projects, the event:
Probability
Factor
Chance
Very High - Could be expected to occur during the project delivery
6
74% - 99.9%
High - Could easily be incurred and has generally occurred in similar projects
5
57% - 73%
Medium - An even chance of occurring in similar projects
4
40% - 56%
Low - Known to happen in similar projects
3
23% - 39%
Very low - Has occurred in a minority of similar projects
2
6% - 22%
Conceivable - but has rarely occurred in similar projects
1
0%-5%
If you have added a new risk to the log the probability factor will need to be assigned. Decide how likely you think it is
that the risk will occur and assign a score of between 1 and 6 using the table above as a guide. The score that you put
into the risk log column F should be a worst case interpretation.
31/10/11
Page | 8 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
2. Define the
proximity
The proximity relates to the stage in the project when the risk is likely to materialise. The number in column E defines
the proximity using the numerical values in the table below.
Stage
0
1
Any time throughout
the full lifecycle
Feasibility
2
Start up
3
Initiation
4
Development of
training course
5
Training course
delivery
Closure
6
0 allocated for use in proximity scale to indicate that the risk could occur at any point during the whole
lifecycle of the project
Identification of potential demand for a new training course through ONA (organisational needs analysis)
Identification of options to meet the demand
Assessment of the viability of HEI developing new training course to meet the demand
Presentation of recommendation to employer and other stakeholders
Preparation of business case
Identification and in principle agreement with partners
Identification of risks
Outline planning and costing
Production of outline training specification
Liaison with partners and outline agreement for input into development and/or delivery
Identification of funding source
Preparation and submission of bids for funding ( where appropriate)
Agreement to commence work
Detailed TNA (training needs analysis) to refine training specification
Appoint project manager
Detailed time and resource planning and costing
Establish steering groups
Draw up and agree contracts with suppliers
Establish employer interest groups
Define quality of training course
Refine and update the project risks
Appoint project team resources
Contracting with suppliers and SLAs with partners
Final agreement to produce the training course
Production of all materials for new training course delivery and assessment
Provision of resources for delivery
Course accreditation (where planned)
Control of work
Management of risks and issues
Activities and communication to ensure sustainability of delivery
Delivery of learning to employer(s) workforce
Refinement of new training course
Completion of all documentation for project, funders and employers
Handover of materials and responsibility for delivery to appropriate faculty
Handover of marketing for sustainability to relevant departments
31/10/11
Page | 9 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
If you have added a new risk to the log the proximity will need to be assigned. Decide when the risk could occur and
assign a score of between 1 and 6 using the table above as a guide. The score should be put into the risk log column
E.
3. Impact analysis
4. Identify impact
score affecting the
risk
The impact or severity factor is defined as a measure of the expected degree of loss or damage (impact) from the most
severe event associated with a risk factor and is derived from the severity level.
Severe
An event that, if it occurred, would cause program failure (inability to achieve
minimum acceptable requirements)
Major
An event that, if it occurred, would cause major cost and schedule increases.
Secondary benefits/requirements may not be achieved.
Moderate
An event that, if it occurred, would cause moderate cost and schedule increases, but
important requirements would still be met.
Minor
An event that, if it occurred, would cause only a small cost and schedule increase.
Requirements would still be achieved.
Low
An event that, if it occurred, would have negligible effect on program.
The severity includes several impact types. Impacts are divided into primary and secondary. Primary impacts are those
that are directly related to the immediate outputs of the new course development project, whereas secondary are those
that are related to the institutional outcomes and benefits.
Reading the score off the risk log column G, and relating it to this table will provide a greater understanding of the
severity of the impacts described in the log.
31/10/11
Page | 10 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
Delivery
Schedule
Sustainability
Total failure of
delivery with no
learners
Major schedule
overrun so
severe that
project would be
terminated by
funder or
employer
Not sustainable
Significantly low
learner numbers,
delivered without
full cost recovery
Significant
schedule increase
of more than
15% that could
lead to reduction
in employer
support and low
learner numbers
Schedule
increase of not
more than 15%
that may lead to
lower employer
support
Small schedule
increase up to
10% that, in most
cases, would be
absorbed by the
project
No increase
Moderate
Minor
Learners drop
out of
assessment of
course
Small cost
increases that, in
most cases, can
be absorbed by
the project
Lower numbers
than predicted,
but costs still
recovered
No loss
No loss
Reputational/opport
unity
Permanent loss of
employer regard
within networks
affecting further
engagement with
sector
Educational
Internal
Prolonged loss of
recognition for
expertise in subject
area
Withdrawal of
5
institutional
support for this
type of demand led
course
Not sustainable
after first pilot
delivery without
significant further
investment in
revision and
marketing
Adverse publicity with
one employer
affecting further
engagement with
employer in all areas
of institution
Affects learner
perception of
institution’s
expertise or
flexibility
Withdrawal of
faculty support for
this type of
demand led course
4
Sustainable with
some
modification of
course
Loss of opportunity to
exploit employer
relationship in other
business areas
Adverse affect on
motivation of
learners to enrol on
further courses of
study
Loss of capacity to
update other
mainstream
courses through
integration
3
Content
sustainable with
additional
marketing
Minor, adverse
complaints affecting
number of learners
provided
Missed opportunity
for collaboration
with other
institutions
Loss of opportunity 2
to update
academic’s
“Employability”
No loss
Concern restricted
and repairable
1
Low
Cost increases of
not more than
5%
Secondary
Impact
score
Development
cost
Total Nonrecovery of
development
costs or increase
of costs greater
than 15% that
would cause
termination
Increase in costs
greater than 5%
Impact types (an event that if it occurs will cause )
Primary
Major
Severe
Severity
Level
Impact table
If you have added a new risk to the log you must assign an impact rating in column G. Decide how severe you think
the impact will be in respect of both the primary and secondary impacts in the table. The score that you put into the
risk log should be a worst case interpretation.
31/10/11
Page | 11 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
The risk rating score is calculated as impact x probability, and is calculated automatically by the spreadsheet from the
probability and impact scores and shown in column H.
PROBABILITY
5. Risk Rating
calculations
6
5
4
3
2
1
6
5
4
3
2
1
1
12
10
8
6
4
2
2
18
15
12
9
6
3
3
24
20
16
12
8
4
4
30
25
20
15
10
5
5
IMPACT FACTOR
If you have added a new risk to the log, you will have to do this calculation yourself (multiply proximity x impact) and
enter it into the inherent risk rating column H.
Each rating is assigned a qualitative classification as low, medium or high, which is automatically shown by the
spreadsheet as red, amber or green. This gives an indication about whether the risk is “within appetite”.
Do not attempt to change the cell colour manually.
High
High impact and probability risks posing a severe threat to project success. They
require detailed assessment and immediate comprehensive action bring within risk
appetite to reduce the risk.
Medium
Risks that pose a threat to the success of the project. Some immediate action may be
required to reduce their impact and/or probability, together with a comprehensive
action plan.
Low
Risks with low impact or low probability that require a less detailed assessment and
that could be accepted/tolerated. Their status should be monitored periodically for
changes.
.
31/10/11
Page | 12 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
4 Plan risk response
1. Overall risk rating
Having established the inherent risk of the project, a management decision must
be taken to establish whether it is within “Risk Appetite” as it stands in the
baseline, or whether further risk management actions should be put in place to
reduce the risk.
The overall risk rating of the development project is calculated as the sum of the risk ratings assigned to each individual
risk. The inherent overall score is in cell H3, and the residual overall score is in cell S3.
In the template there are a total of 60 detailed risks documented. So the maximum score is 60x30 = 1800 and the
minimum is 60x1 = 60. This is then categorised as low, medium or high. (The template creates the colour automatically,
based on the number of risks entered in the register and may be seen in cell H185 )
As risks are added or deleted the count changes and the values used to assign the project risk rating/category alter.
High
Medium
Low
2. Bubble maps
>720<1800
>300=720
<300
The bubble maps are directly linked to the data in the risk log, to provide a visual representation of the following:
1. The high level risks impact x probably, with the bubble size driven by the risk rating.
2. Each of the detailed risks, by category. Two maps are provided for each category.
a. Probability x proximity, with the bubble size driven by impact. This enables each risks to be prioritised
based on when they are likely to occur and how likely they are to occur.
b. Impact x probability, with the bubble size driven by risk rating. This enables each risk to be prioritised
based on its severity. The position against the background colour shows where the risk lies in respect of
“risk appetite”
Each map provides two sets of bubbles, one generated by the inherent risk and one by the residual risk. This enables
the effect of applying risk management actions to be evaluated for effectiveness.
It is not possible for excel to label the bubbles with the risk number, therefore:


If the maps are to be used as part of management briefing material one option is to copy the map to Microsoft
powerpoint and overlay it with labels.
If the maps are being used for operational risk management by the risk register owner/project manager,
familiarisation with the data in each section of the risk log will be sufficient to visually identify the bubbles.
31/10/11
Page | 13 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
Alternatively in the working copy of the register the maps could be moved to be alongside the log table.
3. Interpreting the
data for risk
reduction action
prioritisation
By comparing the blue (inherent risk) bubbles with the red (residual risk) bubbles it is possible to determine whether
additional risk reduction action should be put into place to further reduce the residual risk.
Example based on risk category 2 from the Exemplar Risk Register (with labelling overlaid in powerpoint).
We can see from the above that to prioritise the order of actioning risk control measures:
1. Risk 2a is high risk and could occur during project start up, but, can be brought within risk appetite by significant
reduction in the probability.
2. Risk 2h is a moderate risk and risk 2i is a high risk, both could occur during project initiation and can be brought
within risk appetite by significant reduction in the probability.
3. Risks2g and 2d are moderate risks and both could occur during development of the course and can be brought
within risk appetite by reduction in the probability.
4. Risks 2b, 2c, 2e, 2f are bordering on low risk, could occur during development of the course, though the
implementation of countermeasures does little to reduce the residual risk.
Another consideration at the point of prioritisation may be the cost associated with action taken. The suggested action
to reduce probability, reduce impact and any contingency action that may be taken should the probability begin to
increase, can be found in the template risk register. It should also be noted that dealing with risks 2a and 2i alone will
reduce the aggregate risk associated with the high level risk 2, though not to the same extent as dealing with 2a, 2h, 2i,
2g and 2d.
31/10/11
Page | 14 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
Priority could, therefore be assigned as:
Priority
High
Medium
Low
Risk number
2a,2i,2h
2g, 2d
2b, 2c,2e, 2f
Source of risk
Project management, Employer, Employer
External, Organisational
External, Organisational, External, External
Risk prioritisation will need to be undertaken for each category, based on the actual inherent and residual risk data
contained in your baseline risk register.
4. Assign risk
reduction action
Save a copy of your baseline risk register file annotated with a version control reference. The baseline version remains
on file for reference and should not be altered in any way. Work now with your version 1 copy. It is good practice to
annotate each new copy with the date and or version number. The date updated can be added at the top of the ‘High
Level Risks’ sheet.
The risk reduction actions (probability and impact) listed in the ‘risk log’ against each risk have been weighted to
indicate their effectiveness in reducing the risk. Shown as a number in brackets alongside each action. The number at
the start of each action gives the cross reference onto the ‘action checklist’.
Once the risks have been prioritised appropriate risk reduction measures can be selected for action. And a person
assigned responsibility for carrying out the action.
Working with the ‘action checklist’ column F – planned actions to reduce risk. For each action that you now plan to put
in place to reduce the risks:
1.
2.
3.
4.
Change the drop down selection in column F to ‘yes’
Enter a target date for when the action is to have been completed by
Enter the name of the person who is responsible for carrying out the action
Include the actions in your overall detailed project planning.
The risk ratings and maps will now alter to show a reduced residual risk.
31/10/11
Page | 15 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects
5 Monitor and control the
risk
Updating the progress of your project risks is the only way to make sure it stays
within appetite. The focus at this point is on monitoring the risk, managing any
changes, updating the register, and applying further actions as necessary.
As the project progresses risks may be removed, or new ones may emerge and
require adding to the list.
1. Monitor the risk
All of the risks contained in the log should be reviewed on a regular basis.
2. Manage the
changes
Managing changes involves modifying actions, risk probability and risk status on requested changes or new information.
Keep the current version of the risk register up to date and compare them to the baseline.
Changes can be made to the risk log and actions checklist to reflect new information as follows:




Insert new risks in accordance with section 2.4 of this guide.
Close a risk – if all chance of the risk materialising has passed then the risk should be closed. In Column T of the
risk log select ‘closed’ from the drop down list. This will automatically change the residual rating for that risk to
zero.
Vary the probability score – if, whilst monitoring a risk the likelihood of it occurring is increasing, the score on
the risk log (showing in columns E and Q) can be altered to reflect the new state. In column U insert the amount
by which it has changed. For example. If the probability was 3, but the presence of indicating factors suggests
that the risk is becoming highly likely to materialise the probability will have increased to 5, therefore, insert ‘2’
into column U. Columns E and Q will reflect the increase.
Add or remove risk management actions - Using the ‘Actions checklist’ sheet. If ongoing risk management
decisions require further risk reduction action to be put in place use the column F ‘planned actions to reduce
risk’ to reflect the new actions being put in place. Refer to section 4.4 of this guide for detailed guidance.
Similarly, if having planned the implementation of a risk reduction action, for some reason it is not actually
undertaken, then you should change its status to ‘no’ in column F.

3. Risk materialisation
Comments – a free text column has been provided for the risk register owner to record any comments relating
to each risk.
If a risk materialises, i.e. the probability becomes 100%, then it is no longer considered a risk – it has become an
issue.

The risk should be closed on the risk register.
31/10/11
Page | 16 of 17
Risk Management User Reference Guide for Higher Level Skills Demand Led Training – Course Development Projects


4. Version control
An appropriate record made in the comments column explaining the circumstances
Risk transferred to the project issues log along with any contingency action that may now be put in place.
Version control. When monitoring risk and making changes to the risk register document strict version control should
be adhered to. The baseline version should never be changed, since this provides your starting reference point..
6 Lessons Learnt
information
Lessons learnt through risk management become valuable information for use in
future similar projects. It is good practice to regularly record any lessons learnt
about the project risks, in terms of when and why they materialised, what
actions were put in place to control them and how effective the controls and
actions were.
.
All parts of the Risk Management Toolkit for Demand Led Higher Level Training Course Development Projects have been produced by:
Universities South West
Unit A1,
The Innovation Centre,
University of Exeter,
Rennes Drive,
EXETER,
EX4 4RN
www.universitiessouthwest.ac.uk
31/10/11
Page | 17 of 17