--- title: "Risk audits" subject: "ICT Project Management" chapter: 12 key: "semester_7/ict_project_management:risk-audits" source: https://www.bctengineer.com/q/semester_7/ict_project_management/risk-audits site: BCT Engineering --- # Risk audits ICT Project Management · Chapter 12: Project Risk Management - Asked in: year not given - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_7/ict_project_management/risk-audits - Whole chapter: https://www.bctengineer.com/md/semester_7/ict_project_management/chapter-12 ## Question What do you mean by risk audits? ## Short answer A risk audit reviews the effectiveness of risk responses and the risk management process, conducted by an independent auditor during project monitoring. It examines implementation, identifies new risks, and recommends corrective actions, producing updates to the risk register and lessons learned. ## Answer A **risk audit** is a review of the effectiveness of risk responses in dealing with identified risks and their root causes, and also of the effectiveness of the risk management process. It is a tool of **Control Risks** (Monitoring and Controlling). A risk auditor, usually from outside the project, examines and documents whether risk management is working. #### Purpose - Check whether the risk management plan and process are being followed. - Evaluate whether planned responses were implemented and effective. - Identify new risks, changes in the probability or impact of risks, and risks that have become irrelevant. - Verify the quality of the risk register and risk data. - Find lessons learned and improve risk processes. #### When and who - Scheduled at set times, such as at project reviews, phase ends, or when problems arise (defined in the risk management plan). - Performed by the project manager, or a PMO/independent auditor. #### Procedure ```text Plan audit -> Review risk register, plans, records -> Interview team -> Check responses and reserves -> Report findings -> Corrective actions -> Follow-up ``` 1. Define the scope and format of the audit. 2. Examine risk documents: plan, register, status. 3. Verify the response implementation and ownership. 4. Evaluate the use of contingency reserves. 5. Identify gaps and new risks. 6. Report findings with recommendations. 7. Follow up on corrective action. #### Related tools in Control Risks Risk reassessment, technical performance measurement, variance and trend analysis, reserve analysis, status meetings. #### Output Work performance information, change requests, updates to the risk register, plan and OPA. **Example:** A mid-project audit of a software project finds that the "key staff leaves" risk had a mitigation plan (cross training) not carried out; the auditor recommends immediate action and reassigns an owner. ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. What does a risk audit review? A. Only the project budget B. Effectiveness of risk responses and of the risk management process C. Only the quality of the product D. Vendor contracts Answer: B. A risk audit examines whether responses work against risks and root causes and whether the risk process is effective. (Key point: Definition) 2. Risk audits are a tool of which process? A. Plan Risk Management B. Identify Risks C. Control Risks D. Plan Risk Responses Answer: C. Risk audits belong to Control Risks in Monitoring and Controlling. (Key point: Process group) 3. Who typically conducts a risk audit? A. Only the sponsor B. A risk auditor, usually from outside the project, or the PM/PMO C. Only the vendors D. Only team members who own the risks Answer: B. A risk auditor, usually external to the project, or PM/PMO performs the audit at times set in the plan. (Key point: Who performs) 4. An audit finds that a planned mitigation (cross training) was never carried out. What does the auditor recommend? A. Close the risk B. Immediate action and reassigning an owner C. Delete the risk from the register D. Ignore it until the project ends Answer: B. Audits verify response implementation and ownership and recommend corrective action and follow-up. (Key point: Audit finding) ## Related in ICT Project Management - [Procurement audits](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Aprocurement-audits) — ICT Project Management, chapter 13 - [Risk](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Adefine-risk) — ICT Project Management, chapter 12 - [Project risk](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Aproject-risk) — ICT Project Management, chapter 12 - [Risk management plan](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Arisk-management-plan) — ICT Project Management, chapter 12 - [Resolution of risk](https://www.bctengineer.com/question.md?key=semester_7%2Fict_project_management%3Aresolution-of-risk) — ICT Project Management, chapter 12 ## Related in other subjects - [Gumbel flood, confidence limits, hydrologic risk](https://www.bctengineer.com/question.md?key=semester_5%2Fengineering_hydrology%3Agumbel-100-500-n30-risk) — Engineering Hydrology, chapter 6, asked 2× - [Risk management and its steps](https://www.bctengineer.com/question.md?key=semester_7%2Fproject_engineering%3Arisk-management-define-steps) — Project Engineering, chapter 5, asked 2× - [Safety risk-benefit analysis; dispute resolution](https://www.bctengineer.com/question.md?key=semester_8%2Fengineering_professional_practice%3Asafety-risk-benefit-conflict-resolution) — Engineering Professional Practice, chapter 6 - [Return period for bridge design at 5% risk](https://www.bctengineer.com/question.md?key=semester_5%2Fengineering_hydrology%3Abridge-return-period-5pct-risk) — Engineering Hydrology, chapter 6