Risk audits

A risk audit is a review of the effectiveness of risk responses in dealing with identified risks and their root causes, and also of the effectiveness of the risk management process. It is a tool of Control Risks (Monitoring and Controlling). A risk auditor, usually from outside the project, examines and documents whether risk management is working.

Purpose

• Check whether the risk management plan and process are being followed.
• Evaluate whether planned responses were implemented and effective.
• Identify new risks, changes in the probability or impact of risks, and risks that have become irrelevant.
• Verify the quality of the risk register and risk data.
• Find lessons learned and improve risk processes.

When and who

• Scheduled at set times, such as at project reviews, phase ends, or when problems arise (defined in the risk management plan).
• Performed by the project manager, or a PMO/independent auditor.

Procedure

Plan audit -> Review risk register, plans, records
   -> Interview team -> Check responses and reserves
   -> Report findings -> Corrective actions -> Follow-up

1. Define the scope and format of the audit.
2. Examine risk documents: plan, register, status.
3. Verify the response implementation and ownership.
4. Evaluate the use of contingency reserves.
5. Identify gaps and new risks.
6. Report findings with recommendations.
7. Follow up on corrective action.

Related tools in Control Risks

Risk reassessment, technical performance measurement, variance and trend analysis, reserve analysis, status meetings.

Output

Work performance information, change requests, updates to the risk register, plan and OPA.

Example: A mid-project audit of a software project finds that the "key staff leaves" risk had a mitigation plan (cross training) not carried out; the auditor recommends immediate action and reassigns an owner.