Monitoring risks, issues and reserves

A risk register is a snapshot that starts ageing the moment it is approved. Some risks pass without occurring, some occur, new ones appear, and responses work better or worse than expected. Monitoring risks keeps the register and the reserves honest. This lesson covers risk reviews and audits, triggers, workarounds, reserve analysis, and the relationship between the risk register and the issue log, where risks that have materialized are managed. It follows Project Compass through its first six months, the same period as PMP-130's earned value analysis.

What monitoring risks involves

Monitoring risks means tracking identified risks, watching triggers, implementing and evaluating responses, identifying new risks, and checking whether the project's assumptions and risk exposure have changed. It answers questions such as: have any triggers fired? Are the agreed responses being carried out, and are they working? Has the probability or impact of any risk changed? Have new risks emerged? Is the remaining reserve adequate? Are risk management processes being followed?

A risk audit is different from a risk review. The review looks at the risks themselves; the audit looks at the process. An audit might find that half the risks have no trigger defined, that owners never update status, or that opportunities are never discussed. Those findings lead to improvements in how risk management is done, on this project and on future ones.

The first six months of Project Compass

The project reached its month 6 status date with several risks resolved one way or the other. R02, the permit delay, occurred: the permit arrived three weeks late. Part of the cause was that the submission checklist had not been completed (lesson 5), so the city asked for two rounds of additional drawings. The contingency response, re-sequencing interior design work to proceed in parallel, limited the critical path delay, and $22,000 of contingency paid for extended site overheads. R01, asbestos, was closed when the intrusive survey found none. R03 occurred in a form the team had recorded as a residual risk: a tariff surcharge on imported tags, passed through under the supplier's terms, cost $19,000, more than the $15,000 allowed for that risk.

# Month 6 reserve analysis for Project Compass ($000)
contingency = {"R01 asbestos": 30, "R02 permit delay": 24, "R03 tag price": 15, "R04 app rework": 11}
events = [  # (month, risk, outcome, amount drawn from the contingency pool)
    (2, "R02 permit delay", "occurred: permit 3 weeks late", 22),
    (3, "R01 asbestos", "closed: intrusive survey found none", 0),
    (4, "R03 tag price", "occurred: tariff surcharge on tags", 19),
]
pool = sum(contingency.values())
print(f"Contingency pool at baseline: {pool}")
print("Month  Risk               Outcome                              Draw  Pool left")
for m, r, what, draw in events:
    pool -= draw
    print(f"{m:5d}  {r:18s} {what:36s}{draw:5d}{pool:10d}")
earmarked = contingency["R04 app rework"]
print(f"\nStill earmarked for open risks: {earmarked}; unallocated after closures: {pool - earmarked}")
bac, eac, mr = 2400, 2605, 120
print(f"EAC {eac:,} vs BAC {bac:,}: forecast overrun {eac - bac}")
print(f"EAC vs BAC plus management reserve ({bac + mr:,}): shortfall {eac - bac - mr}")

Contingency pool at baseline: 80
Month  Risk               Outcome                              Draw  Pool left
    2  R02 permit delay   occurred: permit 3 weeks late          22        58
    3  R01 asbestos       closed: intrusive survey found none     0        58
    4  R03 tag price      occurred: tariff surcharge on tags     19        39

Still earmarked for open risks: 11; unallocated after closures: 28
EAC 2,605 vs BAC 2,400: forecast overrun 205
EAC vs BAC plus management reserve (2,520): shortfall 85

Of the $80,000 contingency, $41,000 has been drawn and $39,000 remains. Eleven thousand is earmarked for R04, the app store rework risk, which is still open; the remaining $28,000 is unallocated because the risks it was set aside for have closed. The library's risk management plan keeps released contingency in the project pool for new or changed risks, recorded in the reserve log, rather than returning it immediately; other organizations return it to the sponsor. Either approach works if it is stated in the plan and the log shows where every dollar is.

The bigger picture is less comfortable. PMP-130's earned value analysis forecast an estimate at completion of about $2.6 million, $205,000 over the BAC of $2.4 million and $85,000 more than the BAC plus the entire management reserve. The overrun comes mainly from construction unit costs and slower tagging, not from the listed risk events. That matches the quantitative risk analysis in lesson 4, which showed only a 22 % chance of finishing within the baseline. The contingency pool cannot absorb this, because contingency is for identified risks, and the overrun is a performance problem across the estimates.

Reserve analysis and when to escalate

Reserve analysis compares the reserve remaining with the risk remaining. If identified risks still open have a combined EMV greater than the contingency left, or the forecast exceeds the budget including reserves, the project manager must act: by strengthening responses, finding corrective actions, or asking the sponsor for a decision. Waiting until reserves are exhausted removes options.

At month 6, the Project Compass threshold is clearly crossed: a forecast more than $50,000 over the baseline must be reported to the sponsor within two working days. The project manager reports the position, the causes and the options: corrective actions on tagging (a third encoding station, which became change request CR-02), value engineering of remaining finishes, release of management reserve, and additional board funding if needed. Management reserve is not the project manager's to spend; the sponsor decides whether to release it, and once released it is added to the cost baseline through change control. Lesson 11 follows the change requests and lesson 12 the outcome.

Reserves also apply to schedule. A project may hold contingency time, sometimes visible as a buffer before a milestone, and the same logic applies: track consumption against remaining schedule risk, and escalate before the buffer is gone. Project Compass's schedule contingency before soft opening was five working days; the permit delay used three of them.

Workarounds

A workaround is an unplanned response to a risk that has occurred, either because it was not identified or because it was passively accepted. It differs from a contingency response, which was planned in advance. When the mall's water main burst in month 5, a risk nobody had identified, the team improvised: it moved furniture deliveries to a storage unit for two weeks and dried out the unit with rented equipment. That was a workaround. Because the lease made the landlord responsible for building services, the landlord's insurer reimbursed the costs, so no reserve was needed: risk had been transferred by a lease clause nobody had thought of as a risk response. The event also added a new lesson to the register, and a new risk: that the mall's ageing services could fail again before opening. Frequent workarounds suggest that risk identification has gaps.

Issues and the issue log

An issue is a current condition or situation that may affect project objectives. A risk that occurs becomes an issue; so do problems that were never risks, such as a disagreement between two departments or a team member's long absence. Issues are recorded in an issue log, which tracks a description, the date raised, who raised it, a priority, an owner, a target date for resolution, status and the final resolution. Issues need resolution, not monitoring: an owner works to remove the obstacle, escalating if necessary.

The 2026 exam outline includes the task of removing impediments and managing issues, and PMP-120 covered the people side: removing obstacles so the team can work. In adaptive teams, issues often surface as impediments in daily stand-ups, and the team lead, scrum master or project manager is expected to clear them quickly. An impediment board, a column on the team board or a short list in the stand-up notes plays the role of the issue log. Whatever the form, issues should have owners and target dates; an issue that sits unresolved for weeks is a schedule risk in its own right.

Issues often lead to change requests. The late permit did not require one, because contingency covered the cost and the delay stayed within schedule contingency. The cost overrun, by contrast, will require changes to the cost baseline. Lesson 11 explains how such changes are controlled.

Reporting risk

Stakeholders need a concise view of risk, not the whole register. The project's monthly board report includes the top five risks with trends, any risks that crossed thresholds, the remaining contingency and management reserve, and the overall confidence of meeting the budget and opening date. Adaptive teams sometimes use a risk burndown chart, plotting the total risk exposure (sum of EMVs or of scores) over time: a falling line shows that risk is being retired as the product takes shape. Good risk reporting is honest about bad news early; the board that heard about a 22 % confidence level at baseline was not surprised by the month 6 forecast.