Component Deep-Dive

Probability x Impact Risk Matrix: The Charter Risk Register That Escalates the Right Risks

The charter risk register captures the top 3 to 5 risks with P x I scoring. It is not a full risk management plan. It is the escalation trigger that tells the sponsor which risks need their attention before the project starts.

Updated 11 April 2026

Charter Risk Register vs Full Risk Management Plan

DimensionCharter Risk RegisterProject Plan Risk Register
Number of risksTop 3 to 515 to 30+
Detail levelOne-sentence description + P x I scoreFull description, triggers, response plan, owner, budget
Response typeCharter-level: one-line actionPlan-level: mitigation strategy, contingency, residual risk
AudienceSponsor and steering committeeProject team and functional leads
PurposeFlag risks that could stop the project before it startsManage risks throughout execution
Update frequencyOnly if charter is revisedWeekly or at each phase gate

The 3x3 Probability x Impact Matrix

Use the 3x3 matrix for charter risk registers and small projects. Use 5x5 for enterprise risk management and regulated industries where finer granularity is required.

Low ImpactMedium ImpactHigh Impact
High ProbLowLowModerate
Medium ProbLowModerateHigh
Low ProbModerateHighCritical

Low (1-2)

Monitor. No action in charter.

Moderate (3-4)

Include in charter. PM manages.

High (6)

Escalate to sponsor. Needs mitigation before start.

Critical (9)

Go/no-go decision. May require charter revision.

Scoring Guide: What Makes a Risk "High"?

Probability and impact ratings should be data-backed, not gut feelings. Use historical project data when available.

RatingProbability GuideImpact Guide
LowUnder 20% chance of occurring. No historical precedent in similar projects.Schedule slip under 1 week. Budget impact under 5%. No scope change required.
Medium20 to 60% chance. Has occurred in 1 out of 3 similar projects historically.Schedule slip 1 to 4 weeks. Budget impact 5 to 15%. Minor scope adjustment needed.
HighOver 60% chance. Has occurred in most similar projects. Current indicators suggest likely.Schedule slip over 4 weeks. Budget impact over 15%. Significant scope change or project cancellation risk.

5 Charter Risk Register Examples by Industry

IndustryRiskPISeverityCharter Response
ITAPI integration fails during production cutoverMediumHighHighSchedule integration audit and dry-run cutover in Week 2
MarketingCampaign launch delayed by creative approval cycleHighLowModerateSet 3-day approval SLA with auto-approve clause
ConstructionPermit approval delayed by city planning office backlogMediumHighHighSubmit permits 4 weeks early; identify alternative sequencing
HealthcareNursing staff resistance to barcode scanning workflowHighMediumHighAssign clinical champion; pilot with volunteer unit first
FinanceRegulatory change invalidates compliance approach mid-projectLowHighModerateMonthly regulatory scan; 15% contingency earmarked for re-work

Charter-Level vs Plan-Level Risk Response

Example: API Integration Failure Risk

Charter Response (1 line)

"Schedule API integration audit and dry-run cutover in Week 2 to validate integration feasibility before committing to full development."

Plan Response (full mitigation)

"Week 2: API integration audit (2 days, assigned to Technical Lead). If audit identifies breaking changes: escalate to steering committee for scope adjustment. Fallback: build REST adapter as middleware layer (add 3 weeks, $18K). Week 6: dry-run cutover in staging environment. Success criteria: 99.9% data transfer accuracy, under 4 hours downtime. If dry-run fails: revert to current system, schedule root cause analysis."

Full Charter Writing Guide →See Risk Registers in Context →DMAIC Risk Considerations →