Is there any template of questions or criteria that could be used for a risk to meet in order to be realized, retired, or identified?
This is an excellent question because it gets at the heart of good risk management. In order to answer it, we should first discuss the Program Risk Process (PRP) in general. Each program should develop a PRP that is tailored to the unique circumstances of the program. There are also many risk management software tools in use that have templates to assist teams in setting up their PRP.
While there is no one size fits all for a risk register template, consider the following regarding risk identification, realization, and retirement:
1) Risk Identification: Per the DoD Risk, Issue, and Opportunity Management Guide (RIO Guide), Jan 2017, risk identification occurs after the process planning step. The guide goes into detail on identifying risks, typically captured with “If, Then” statements and mapped to a risk cube based on likelihood and impact. High and moderate risks will receive out attention through mitigation actions that seek to lessen either the likelihood or impact (or both). For risk identification, we ask questions like: What can go wrong? What are the anticipated difficulties in this program development? What may cause the schedule to slip? What may cause cost growth?
These questions should be tailored to fit your program needs. The key is to identify future root causes that may cause problems in the future. Ensure the risk statement is actionable. This means that it identifies a root cause and conditions which enables various actions to mitigate it.
2) Risk Realization: Risk realization means the risk is no longer a risk (something that may occur in the future) since it has come to fruition. Just ask, did this risk actually occur? If so, it is an issue (assuming it is problematic). The RIO guide also has a section on issue management.
3) Risk Retirement: There are multiple ways to retire a risk or an issue. It becomes a judgment call as to the appropriate time to take it off your RIO rhythm. You could consider questions like: Does this risk warrant any more tracking or mitigation actions? Has this risk come to fruition and is no longer an issue?
Final Thoughts: DAU offers a Risk Management Workshop. The purpose is to assist teams in developing good risk management processes. You can learn more about it here if interested: