skills/project-governance/references/risk-and-reporting.md

# Risks, issues, and delivery reporting

## Risk and issue records

A risk is an uncertain event with a cause and consequence; an issue exists now. Record ID, description, source or evidence, exposure, owner, response, trigger, due date, and status as useful for the engagement. Distinguish planned mitigation from completed mitigation and inherent risk from residual exposure.

Adopt the client's scale when supplied. If using ordinal likelihood and impact, define bands and their basis; multiplying ordinal scores is a prioritization aid, not a probability or expected monetary value. Do not turn an unknown likelihood into a plausible-looking percentage.

Apply an impact override: catastrophic safety, legal, operational-continuity, or solvency consequences can require escalation even at low likelihood or a low product score. Unknown exposure may require investigation rather than acceptance. Authority, urgency, and irreversibility matter alongside numerical rank.

A useful response specifies what changes the exposure, who can do it, cost, completion evidence, and fallback. Insurance or contract transfer may leave operational or reputational exposure. Compare mitigation cost and benefit where estimable, but do not use a monetary ratio to waive an applicable obligation or unacceptable consequence.

## Status and cost forecasting

Use a short executive readout of decisions, trend, and the constraint on delivery. Supporting detail may include:

| Item | Evidence to report |
|---|---|
| Milestone | Original baseline, approved baseline if changed, forecast, actual, variance, and reason. |
| Progress | Accepted outputs or a defined measure of work completed; remaining work and uncertainty. |
| Cost | Approved budget, actual spend, committed cost, estimate to complete, forecast at completion, variance. Avoid counting commitments twice. |
| Capacity | Availability versus demand for constrained roles, including other work. |
| Risk | Material exposures, changes, triggers, response status, and decisions needed. |
| Issue | Current consequence, owner, resolution date, action, and escalation. |
| Decision | Choice, authority, alternatives, consequence of delay, and latest useful date. |

Compare spend with the expected cost profile. Where earned-value measures are used, define planned value, earned value, actual cost, and scope baseline consistently; do not infer schedule completion directly from percent budget spent.

## Escalation and maintenance

Set escalation using materiality and the time available to respond, following existing authority. Urgent issues may need action before the next scheduled committee. Prepare the escalation within scope and use the user's authorization for actual communications.

Track changes since the last report and closure evidence for actions. Keep decision records and superseded baselines accessible. A risk register should shrink or change as risks are resolved, realized, or redefined; counting open items alone is not a measure of health.