Risk register
Risks are things that may go wrong and would hurt an objective, a requirement or delivery. Each is scored by probability × impact and has a response; accepting a risk needs a recorded decision.
For: Project lead, Product owner
Scoring
Probability and impact are rated 1–5. Their product is the score: 1–4 Low, 5–9 Medium, 10–14 High, 15–25 Critical. The matrix shows where the open risks sit; click a cell to list them. Residual scores record what remains after mitigation.
States and rules
| State | Rule |
|---|---|
| Identified | Raised; may be unscored. |
| Assessed | Needs probability and impact. High and critical risks also need an owner and a response. |
| Mitigating | Needs a mitigation plan or linked mitigating work. |
| Accepted | Needs the Accept response and an Accepted decision linked with “is accepted by”. |
| Occurred | It happened; handle it as an issue (often a defect or task). |
| Closed | No longer relevant. |
Set a next review date; overdue reviews are flagged in the register and on the Overview.
Links and agents
A risk threatens objectives, requirements or work, is mitigated by work, requirements or standards and is accepted by a decision. Coding agents get open high and critical risks with the work they threaten and can raise new ones with raise_risk.