Risk Registers and Contingency Planning
A risk register is a living record of uncertainties that could affect an objective. Contingency planning connects important risks to preapproved actions, triggers, owners, and resources so a team can respond when prevention is not enough.
itEngineering leadership and delivery management | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Risk Registers and Contingency Planning
A risk register is a controlled record of uncertainty that could affect an objective. It turns scattered concerns into comparable, owned decisions. Contingency planning extends the register by defining what happens if a selected risk materializes or crosses an agreed trigger.
The pair forms a feedback loop:
objective -> identify -> assess -> respond -> monitor -> trigger -> contingency -> learn
The register keeps attention on possible events. A contingency plan prepares a response for events whose remaining exposure could still disrupt delivery. Neither artifact removes uncertainty. Their value comes from timely decisions, clear authority, and evidence that changes the response.
Start with an objective
A risk only has meaning in relation to an objective. State the delivery outcome, boundary, time horizon, and risk appetite before collecting entries. A concern such as "the supplier may be late" is incomplete. It does not state the cause, uncertain event, or effect.
Use a cause-event-effect statement:
Because the integration specification is still changing, the supplier may deliver the adapter after system testing begins, causing the release date to move.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts
Supports
- Risk management integrated with governance, objectives, decisions, appetite, ownership, monitoring, reporting, escalation, and continual improvement
- Risk identification, assessment, response, control effectiveness, residual exposure, and contingency arrangements for high-impact risks
- 2020 revision and later guidance context used in the timeline research decision
- https://projectdelivery.gov.uk/govs-002-project-delivery-functional-standard/
Supports
- Risk and issue management as part of project planning and control
- Roles, accountabilities, reporting, decisions, dependencies, and delivery governance
- https://www.nist.gov/publications/guide-conducting-risk-assessments
Supports
- Preparing, conducting, and maintaining risk assessments
- Threat events, vulnerabilities, likelihood, impact, uncertainty, risk aggregation, and ongoing monitoring
- September 2012 publication of Revision 1
- https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final
Supports
- Contingency planning purpose, process, format, requirements, priorities, and relationship to resilience
- Business impact analysis, preventive controls, contingency strategies, plan development, exercises, and maintenance
- May 2010 publication and impact-level templates
- https://csrc.nist.gov/topics/security-and-privacy/security-programs-and-operations/contingency-planning
Supports
- Contingency planning as coordinated plans, procedures, and technical measures for recovery after disruption
- Alternate equipment, manual processing, alternate locations, and impact-based controls
- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
Supports
- Risk Assessment and Contingency Planning control families
- Security and privacy controls implemented within an organization-wide risk-management process
- https://csrc.nist.gov/pubs/sp/800/84/final
Supports
- Test, training, and exercise programs for information-technology plans and capabilities
- Evidence-based improvement of contingency readiness
- September 2006 final publication used in the timeline
- https://csrc.nist.gov/nist-cyber-history/risk-management/chapter
Supports
- FIPS 87 in 1981, SP 500-85 in 1982, and SP 500-134 in 1985 as early contingency-planning guidance
- SP 800-34 in 2002, its 2010 update, and SP 800-84 in 2006
- Historical relationship among risk management, contingency planning, and plan verification
- https://www.nist.gov/publications/risk-management-guide-information-technology-systems
Supports
- July 2002 publication of the original SP 800-30
- Identifying, assessing, mitigating, and continually evaluating information-technology risk
- https://csrc.nist.gov/nist-cyber-history?area=3400d8ba-1c7d-42e4-8cf5-2206b911b080&type=Standards
Supports
- June 2002 publication of SP 800-34 and its guidance on writing contingency plans
- https://csrc.nist.gov/csrc/media/publications/shared/documents/itl-bulletin/itlbul2002-06.pdf
Supports
- Seven-step contingency planning sequence in the original SP 800-34
- Impact analysis, controls, strategies, planning, training, exercises, and maintenance
- https://www.iso.org/standard/65694.html
Supports
- ISO 31000 principles, framework, and process for risk management
- Identifying, analyzing, evaluating, treating, monitoring, and communicating risk
- February 2018 second edition and the earlier 2009 edition
- https://www.pmi.org/learning/library/quantitative-risk-assessment-methods-9929
Supports
- Risk-register creation during identification and probability-impact assessment during qualitative analysis
- Risk registers as inputs to quantitative project risk assessment and work-breakdown mapping
- https://github.com/sindresorhus/awesome
Supports
- Starting catalog used to discover relevant curated Awesome lists
- https://github.com/getprobo/awesome-compliance
Supports
- Discovery of AuditBoard, Archer, LogicGate, MetricStream, Onspring, OneTrust, ServiceNow, and Hyperproof as GRC ecosystem products
- Awesome Links curation decision for risk and compliance tooling
- https://www.servicenow.com/products/integrated-risk-management.html
Supports
- Connected enterprise, operational, technology, and compliance risk workflows
- Risk assessment, centralized oversight, remediation, business continuity, and operational resilience capabilities
- https://www.servicenow.com/standard/resource-center/data-sheet/ds-risk-management.html
Supports
- Risk register and taxonomy, business impact analysis, monitoring, reporting, and links to continuity and resilience
- https://www.archerirm.com/resilience-management
Supports
- Important services and dependency mapping, risk insights, continuity plans, scenario tests, incidents, and crisis coordination
- https://community.archerirm.com/hc/en-us/articles/52147296844435-Archer-Enterprise-Operational-Risk-Management
Supports
- Risk catalog, risk assessment, prioritization, and named accountability capabilities
- https://www.metricstream.com/products/operational-risk-management.htm
Supports
- Mapping objectives, processes, products, risks, controls, appetite, and action plans
- https://www.metricstream.com/products/operational-resilience.htm
Supports
- Linking risk management, business impact analysis, continuity plans, communications, issue actions, and recovery sequences
- https://riskonnect.com/business-continuity-resilience/bcm-vs-erm/
Supports
- Distinction and feedback relationship between enterprise risk management and business continuity management
- Register assessment before disruption and continuity response after a risk event
- https://riskonnect.com/
Supports
- Enterprise risk, project risk, business continuity, crisis management, and operational resilience product families
- https://www.logicgate.com/solutions/business-continuity-management/
Supports
- Business impact analysis, critical-function risks, continuity and disaster-recovery plans, testing, findings, and remediation
- https://auditboard.com/itrm/
Supports
- Risk assessments, tolerance-linked treatment, centralized reporting, asset-level business impact analysis, and continuity strategy
- https://www.resolver.com/grc-software/business-continuity-bcm-software/
Supports
- Linking impact assessments, recovery objectives, dependencies, exercises, continuity plans, risks, controls, and obligations
- https://www.resolver.com/grc-software/risk-management/
Supports
- Centralized risk identification, assessment, ownership, mitigation, incidents, risk events, and reporting
- https://software.onspring.com/bcdr-management-software-from-onspring
Supports
- Mapping processes and dependencies to risks, continuity plans, response workflows, exercises, findings, and mitigation
- https://www.onetrust.com/products/it-risk-management/
Supports
- IT asset, process, and vendor risk mapping with qualitative and quantitative assessment and remediation
- https://hyperproof.io/product/risk-management/
Supports
- Structured risk intake, likelihood, impact, tolerance, risk registers, control mapping, issues, mitigation, and reporting
