Risk Charters

The creation of a risk charter is a more formal identification of risks than the listing of red flag items. Typically, it is completed as part of a formal and rigorous risk management plan. The risk charter provides project managers with a list of significant risks and includes information about the cost and schedule impacts of these risks. It also supports the contingency resolution process described in Chapter 6 by tracking changes in the magnitude of potential cost and schedule risk impacts as the project progresses through the development process and the risks are resolved.

A risk charter is a document containing the results of a qualitative or quantitative risk analysis. It is similar to a list of red flag items, but typically contains more detailed information about the potential impact of the risks and the mitigation planning. The risk charter contains a list of identified risks, including description, category, and cause. It may contain measurements of magnitude such as the probability and impact of occurrence. It may also include proposed mitigation responses, "owners" of the risk, and current status. This method may be more effective than simply listing potential problem areas through red flagging because it integrates with the risk monitoring and control processes. The terms "risk charter" and "risk register" are synonymous in the highway industry.

A risk charter is used as a management tool to identify, communicate, monitor, and control risks. It provides assistance in setting appropriate contingencies and equitably allocating risks. As part of a comprehensive risk management plan, the risk charter can help control cost escalation. It is appropriate for large or complex projects that have significant uncertainty.

The charter organizes risks that can impact cost estimates and project delivery. A risk charter is typically based on either a qualitative or quantitative assessment of risk, rather than simple engineering judgment. The identified risks are listed with relevant information for quantifying, controlling, and monitoring. The risk charter may include relevant information such as the following:
Risk description
Status
Date identified
Project phase
Functional assignment
Risk trigger
Probability of occurrence (percent)
Impact ($ or days)
Response actions
Responsibility (task manager)

Two examples of risk charters are in Appendix D. The first example, from Caltrans, is a spreadsheet that forms the basis of the agency's risk management plan.The spreadsheet contains columns for identification, analysis, response strategy, and monitoring and control. The second example is from an FTA report on risk assessment, which uses the term risk register synonymously with risk charter.The FTA risk register contains more quantitative risk assessment information than the Caltrans example, but the goal of the documentation is similar. FTA adds issues such as correlation among dependent components, type of distribution used to model the risk, and expected value of the risks.