What is the difference between a risk register, a RAID log, and an issue log?

A risk register records uncertain events with probabilities, owners, triggers, and funded responses. A RAID log holds risks, assumptions, issues, and dependencies in one workbook view, because the four interact daily. An issue log records what has already materialized, with resolution plans and dates. Materialized risks move from the register to the issue log; leaving them scored as percentages is the most common way registers start lying.

How often should an implementation risk register be reviewed?

On three cadences: weekly for triggers and above-tolerance risks, monthly for the full register (pruning, exposure movement, reserve position), and at every phase gate for re-identification, because each phase creates its own risk species. The standards agree the process is continuous — ISO 31000:2018 builds monitoring and review into the cycle itself — so "reviewed at kickoff" is not a compliant answer under any framework.

How do I size contingency reserve without inventing a number?

From the register: sum the probability-weighted exposure of the risks the sponsor accepts carrying, cross-check against any quantitative analysis and against your reference class of comparable finished programs, and present the result as a range with its reasoning attached. A flat percentage may still be chosen by the sponsor, but it is recorded as their decision beside the register-derived figure — and the burn rate will arbitrate between the two over time.

When is a Monte Carlo simulation worth running?

When a real decision depends on it — a go-live date's confidence level, a reserve's size, a phased-versus-big-bang comparison — and when the input distributions can be defended by their owners and the drivers of the output can be explained. If inputs are guesses, a reference-class check and an honest range are more truthful than a precise simulation.

What is reference class forecasting, in one paragraph?

Estimating from the outside view: instead of forecasting only from your project's internal plan, you compare it with the actual outcomes of a class of comparable finished projects and position your forecast within their distribution. Bent Flyvbjerg formalized it for project practice (Project Management Journal, 2006) to counter optimism bias and strategic misrepresentation. On implementations without industry base rates — including HCM — your reference class is built locally: your organization's and your references' finished programs.

Who should own a risk — the project manager or the business?

Whoever is closest to its cause and can act on it — often the business owner for interpretation and capacity risks, the delivery lead for build risks, the sponsor for appetite and tolerance decisions. The project manager owns the risk process, not the risks. A register where the project manager owns everything is a warning sign, not a diligence signal.

Should the register include opportunities, or only threats?

Both, with the same ownership discipline, weighted toward threats by the asymmetry of implementation work: a single incorrect live payroll damages trust that many small wins cannot rebuild. Managed opportunities get owners, responses, and triggers — a rehearsed example in Part 5 shows released parallel-test days funding the adoption workstream because the upside had been planned for.

How do ISO 31000, COSO ERM, and PMI risk management relate?

They describe the same cycle from different altitudes. ISO 31000:2018 (February 2018) supplies principles, framework, and the generic process. COSO ERM (2017) organizes the governance and strategy integration around it, in five components and twenty principles. PMI's processes (PMBOK Guide, 6th edition, 2017; principles in the 7th, 2021) operationalize it inside project delivery, and PMI's Standard for Risk Management in Portfolios, Programs, and Projects (2019) extends it above the project level. This guide runs all three without conflict: COSO for governance, ISO for process shape, PMI for project execution.

What are the three leading indicators you would watch first?

Decision latency (aging governance decisions), the data-quality trend across migration or reconciliation passes, and reserve burn against exposure retired. Each is computable from data the program already produces, each moves before the damage it predicts, and each has a pre-agreed action attached — which is what makes an indicator a trigger rather than a chart.

A sponsor says risk work slows delivery. How do you answer?

With the program's own arithmetic, from Part 2: organizations waste 9.9 percent of project dollars on poor performance (PMI, 2018) and large technology programs average 45 percent over budget (McKinsey–Oxford, 2012). The register is not overhead on top of that exposure; the exposure is the cost of skipping the register. Then offer the honest trade: the frame is one workshop and a plan; the weekly review is thirty minutes on triggers only. Risk work that cannot justify itself at that price is being done wrong.

What does "residual risk" mean at go/no-go?

The exposure that remains after funded responses, stated plainly: what is knowingly carried into production, owned by whom, with what contingency and expiry review. The sponsor signs it (Template 6). A go-live with unnamed residuals has not been decided on evidence; the residuals exist regardless — the statement only chooses whether they are governed.

Is there a reliable statistic for how often HCM implementations fail?

No, and be wary of anyone who quotes one. As Part 2 documents, circulating figures trace to analyst forecasts about business-case attainment, self-selected consultancy surveys, or shifting definitions of failure — none of which is a measured HCM failure rate. The defensible practice is to state that absence, build your reference class from comparable finished programs, and measure your own program's trigger performance, exposure trend, and surprise classification instead.

Risk Management for Enterprise Implementations

Manage implementation risk as a system: verified failure data, the 5A discipline, an 8-step method, 12 analyzed risks, reserves, triggers, and templates.

How to Manage Conflicting Stakeholder Priorities
Activating Your Executive Sponsor
Stakeholder Analysis for Implementations
HCM Platform Comparison & Selection Guide

Site navigation

Karim Chaouki — AML and ADP Workforce Now Implementation Consultant

Senior Implementation Consultant. AML compliance, ADP Workforce Now HCM, payroll systems. PMP Certified. Bilingual EN/FR. Toronto, Canada.

About Karim Chaouki
Blog — AML & HCM Implementation Insights
AML Compliance Consulting
ADP Workforce Now Implementation US/CAN
Payroll Systems PM
Bilingual Implementation Manager