According to the PMBOK® Guide, specifically within the Identify Risks process, the primary output is the Risk Register. This document serves as the central repository for recording all individual project risks identified during the project lifecycle.
The Identify Risks process is the act of determining which risks may affect the project and documenting their characteristics.
Initial Documentation: The process initiates the transformation of uncertainty into documented data. The Risk Register starts as a simple list of identified risks and potential responses during this process.
Evolution of the Document: While created in this process, the Risk Register is a living document. It is subsequently updated in the Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis, and Plan Risk Responses processes as more information is gathered.
Key Content at this Stage: At the conclusion of the Identify Risks process, the register typically contains:
List of identified risks: A description of the event, the cause, and the effect.
List of potential risk owners: Stakeholders who might be best suited to manage specific risks.
List of potential risk responses: Initial ideas on how to handle the risk if it occurs.
A. Risk management plan: This is an input to Identify Risks. It is the output of the Plan Risk Management process and defines how risk activities will be structured and performed, but it does not contain the actual risks themselves.
C. Change requests: Identifying a risk might eventually lead to a change request if a preventive action is needed, but they are not a primary output of the initial identification process.
D. Risk response plan: Specific strategies (Avoid, Transfer, Mitigate, Accept, etc.) are formalized during the Plan Risk Responses process, which happens after risks have been identified and analyzed.
In more recent editions of the PMBOK® Guide, the Identify Risks process also produces a Risk Report. While the Risk Register focuses on individual risks, the Risk Report provides information on sources of overall project risk and summary information on the identified individual project risks.
