Level of sophistication
How you can implement a risk management system can vary widely. For example, the minimalist approach of P3.express has only one artifact called the follow-up register, used for storing information about risks as well as issues, change requests, improvement plans, and lessons learned. They are in the same place for two reasons:
- You can use a simple process that applies to all of them without making your project management system too complicated.
- Those elements morph from one type to another as time passes; for example, an uncertain event in the future, which is a risk, can actually occur, which then makes it an issue. When you work on it and close it, it becomes a lesson learned.
While this approach works well for most projects, a mega-project with a high degree of complexity may require a more detailed approach. In those cases, you can separate the element into different artifacts and use different processes for them.
PRINCE2® and many other resources use a separate risk register for storing the risk data. This register, which can be a spreadsheet, contains the analysis information as well as planned responses.
A single risk can have multiple responses, and a single response can serve multiple risks. Therefore, if you still need to make your system more advanced, it would be a good idea to separate risks and responses into two different tables and then create many-to-many relationships between them.
If you need to be even more advanced after separating out risks and their responses, you can even break the risk table into causes and effects, because a single cause can have multiple effects/risks, and each risk can have multiple causes. You can even go one step further and convert it from two tables with many-to-many relationships into a graph.
In practice, there’s no end to how complicated you can make this system, and you should always build one that is appropriate to your project. If you have doubts about the appropriate level of sophistication, though, err on the side of the simpler one.