7 Monitoring, Controlling, and Communicating Project Risks

Risk control as a continuous cycle

Project risks can change as work progresses: assumptions are tested, new information appears, and planned responses affect the likelihood or impact of uncertain events. Monitoring and control is a continuous cycle of tracking indicators, reviewing exposure, carrying out responses, updating records, and sharing information so people can make timely decisions.

Track risk indicators and triggers

For each significant risk, record a clear description of the uncertain event and its potential effect on project objectives, along with an owner responsible for watching the risk and reporting changes. The risk register should also record indicators or triggers, their data source and checking frequency, and the planned response, action owner, due date, and current status.

Choose indicators that are relevant and observable. For a project that depends on a supplier delivering a critical component, missed production milestones or a rising number of overdue quality checks could indicate change. If the supplier misses an agreed readiness date, the team could activate a qualified backup supplier.

Useful dashboards show indicator trends and whether they have crossed agreed thresholds. A risk rating without context does not show those changes.

Review changing risk exposure

At regular reviews and project milestones, risk owners and the project manager should check whether existing risks have changed, new risks have emerged, and planned actions are working. Relevant evidence can include schedule progress, cost forecasts, quality results, dependencies, supplier updates, and changes in assumptions.

Set review frequency in proportion to the risk level, pace of change, and project context. Review urgent or rapidly changing exposures more often. Reassess likelihood and impact using the project’s agreed scales, considering effects on scope, time, cost, quality, safety, and expected benefits. Record trends and explain changes in priority.

Check whether responses have created secondary risks. For example, using a backup supplier may reduce delay exposure but introduce extra cost or integration risk.

Keep the risk register current. If the uncertain event has happened, manage it as an issue with an owner and action plan, and record any remaining risks that the issue creates. Close a risk only when its exposure has ended or it no longer requires active management, and document why.

Implement and verify responses

A response is effective only when agreed actions are completed and their effect is checked. Integrate actions into the schedule, budget, and assigned work; confirm owners, deadlines, dependencies, and approval requirements. During reviews, compare actual progress with the response plan and determine whether residual exposure is acceptable. If the risk is not improving as expected, revise the response, seek a decision, or escalate it through the project’s governance arrangements.

For example, a project may identify the possibility of a delay in regulatory approval. The team tracks review milestones as indicators and assigns an owner to obtain regular updates. If the regulator misses a milestone, the team escalates the delay, assesses its effect on the critical path, and implements an approved schedule contingency. The team then monitors whether the revised forecast reduces the project’s exposure.

Communicate risk status

Risk communication supports awareness and decisions; it is more than distributing the risk register. Provide stakeholders with timely, understandable updates tailored to their responsibilities. A useful risk report or dashboard summarizes the most significant exposures, changes since the previous review, indicators and triggers, response progress, residual exposure, and decisions or support needed. Escalate material changes promptly rather than waiting for a routine report, continue dialogue with affected stakeholders, and protect sensitive information as appropriate.

Use a consistent status format, such as increasing, stable, decreasing, triggered/issue, or closed, and define each term for the project. A color rating can draw attention, but it should be accompanied by the reason for the rating and the action required. Keep the risk register as the authoritative record, and ensure meeting notes, forecasts, and decision logs agree with it.

Capture lessons and close out risks

Capture lessons throughout the project, especially after a response has been implemented, a trigger has occurred, or a risk has been closed. Record what happened, the cause, which indicators provided useful warning, whether the response worked, and what should change in future planning or practice. Apply lessons that can improve the current project as well as preserving them for future work.

At closeout, review open and closed risks, assess response effectiveness, and document remaining exposure. Formally close risks that no longer require management. Transfer unresolved risks to the appropriate operational owner or follow-on project, with clear ownership, response actions, and reporting arrangements. If no suitable owner accepts a risk, escalate it through governance rather than leaving it unassigned.

• risk indicator