M & C

Risk Audit

Risk audits are used to evaluate the effectiveness of the risk identification, risk responses, and risk man- agement process as a whole. Information reviewed in a risk audit can include:

Risk event audits
- Risk events
- Causes
- Responses
Risk response audits
- Risk event
- Responses
- Success
- Actions for improvement
Risk management processes
- Process
- Compliance
- Tools and techniques used
Good practices
Areas for improvement

The risk audit is a tool used in process 11.7 Control Risks in the PMBOK® Guide – Sixth Edition. It is conducted periodically as needed.

Tailoring Tips

Consider the following tips to help tailor the risk audit to meet your needs:

To make the audit more robust you can include an assessment of the effectiveness of the risk management approach.
Large organizations often have policies and procedures associated with project risk. If this is the case in your organization, include an assessment of compliance with the policies and procedures.
Many organizations don’t track opportunity management. You can expand the scope of the audit to include opportunity management if appropriate.
For larger projects you may want to include information on overall risk in addition to risk events.

Alignment

The risk audit should be aligned and consistent with the following documents:

Risk management plan
Risk register
Risk report

Document element	Description
Risk event audit	Event	List the event from the risk register.
	Cause	Identify the root cause of the event from the risk register.
	Response	Describe the response implemented.
	Comment	Discuss if there was any way to have foreseen the event and respond to it more effectively.
Risk response audit	Event	List the event from the risk register.
	Response	List the risk response from the risk register.
	Successful	Indicate if the response was successful.
	Actions to improve	Identify any opportunities for improvement in risk response.
Risk management process audit	Plan risk management	Followed: Indicate if the various processes were followed as indicated in the risk management plan.
	Identify risks	Tools and techniques used: Identify tools and techniques used in the various risk management processes and whether they were successful.
	Perform qualitative risk analysis
	Perform quantitative risk analysis
	Plan risk responses
	Control risks
Describe any practices that should be shared for use on other projects.	Describe any practices that should be shared for use on other projects. Include any recommendations to update and improve risk forms, templates, policies, procedures, or processes to ensure these practices are repeatable.
Description of areas for improvement	Describe any practices that need improvement, the improvement plan, and any follow- up dates or information for corrective action.