TEMPLATESJIRA · RSK
Risk
Documents a risk as cause, event and impact, with rating, mitigation, contingency, owner and review cadence.
01Summary
Name the risk as the thing that might happen. Short enough to read in a register.
[Event] may [happen] [where]
Example
Data migration may exceed the weekend outage window
02Risk Statement
Cause, event, impact, in that order. The cause is a condition that exists today. The impact is a consequence someone cares about, with a number if you can.
If **[cause]**, then **[risk event]** may occur, resulting in **[impact]**.
Example
If the 1.2 TB customer dataset migrates at the rate seen in testing, then cutover may overrun the 48-hour outage window, resulting in a Monday trading delay costing about £60,000 a day.
03Context
Give the background a reader needs to judge the rating, plus links to the plan, tests or decision behind it.
[Background in two or three sentences.] Links: [plan], [test results]
Example
Rehearsal 2 migrated 70% of the data in 34 hours. The window leaves no slack for a failed validation run. Links: Cutover plan v4, Rehearsal 2 report
04Category
Pick one so the register can be filtered. Use your own categories if these don't fit.
- [Delivery / Scope / Cost / Security / Compliance / Operational]
Example
- Delivery
05Likelihood
Choose from your scale and say what you based it on. Evidence beats instinct.
- [Rare / Unlikely / Possible / Likely / Almost certain]: [basis]
Example
- Likely: both rehearsals ran over projected time
06Impact
Rate the impact if it happens, not the chance that it does. Keep the rating tied to the consequence you wrote above.
- [Low / Medium / High / Critical]: [basis]
Example
- High: one day of lost trading and a customer-facing apology
07Risk Rating
Combine likelihood and impact using your own risk matrix. State the matrix result rather than a new opinion.
[Overall rating] ([likelihood] × [impact])
Example
High (Likely × High)
08Triggers / Early Warning Indicators
List what you'd see first if this is about to happen. They should be things you can watch, not feelings.
- [Observable signal and threshold]
Example
- Rehearsal 3 runs longer than 30 hours
- Validation failures above 2% in any batch
09Mitigation Plan
Actions that lower the likelihood or the impact now. Each has an owner and a date, and each should be its own ticket.
- [Action], [owner], [date]
Example
- Split migration into three parallel streams, Dev lead, 12 Dec
- Pre-load static reference data the week before, Data lead, 5 Dec
10Contingency Plan
What you'll do if it happens anyway, and who decides. Agree the decision point in advance.
- If [trigger], then [action]. Decision owner: [name]
Example
- If cutover passes hour 40 without validation complete, roll back and reschedule. Decision owner: programme director
11Owner
One named person who watches this and pushes mitigation along. Not a team.
[Name, role]
Example
Marcus Webb, Data migration lead
12Review Cadence
Say how often and when next. High risks are reviewed more often than the steering group meets.
[Frequency]; next review [date]
Example
Weekly until cutover; next review 28 Nov
13Acceptance Criteria
Check the risk is written well enough to act on, not that it's solved.
- [ ] Risk is documented with clear cause, event, and impact. - [ ] Owner assigned and mitigation actions defined. - [ ] Review date set and linked work created as needed.
Example
- Cause, event and impact agreed with the programme director.
- Owner assigned; two mitigation tickets created.
- Reviews scheduled weekly in the programme calendar.
14Definition of Done (DoD)
A risk record is done when it's in the register, its actions are tracked, and the right people know.
- [ ] Risk logged in the agreed register or repository. - [ ] Mitigation and contingency actions captured and tracked (linked Jira items). - [ ] Stakeholders notified if risk rating is High or Critical. - [ ] Next review scheduled.
Example
- Logged in the programme risk register as RSK-37.
- TSK-512 and TSK-513 linked.
- Steering group notified on 22 Nov.
- Review booked for 28 Nov.