# Epic OP-8862 - Risk management module

Project: OpenProject
Status: in specification
URL: https://community.openproject.org/work_packages/OP-8862

## Detailed specification

### Motivation and background information

Currently project managers create a work package of type \("Risk"\) with custom fields\. This allows flexible configuration, but prevents us from doing better analysis and aggregation of risks\.

Effective risk management is a core component of both the PM² methodology \(developed by the European Commission\) and the PMflex framework \(a customizable, flexible project management approach\)\. Both emphasize the need to:

- Identify, assess, and document project risks
- Evaluate likelihood and impact
- Define and apply risk controls and treatment strategies
- Track the residual risk after mitigation efforts
- Maintain transparency and accountability through a structured workflow and status lifecycle

The purpose of this Epic is to design and implement a Risk Management module that aligns with these principles, enabling project teams to effectively manage risks throughout the project lifecycle\.

Key objectives:

- Support for risk assessment via impact and likelihood
- Modeling of initial and residual risk levels
- A notion of ongoing treatments and actions of a risk that impacts its residual risk value
- Visualization support \(e\.g\. risk matrix, heat map, stacked graphs\)
- A basic workflow of risks
- Auditing and reporting

This will allow organizations to standardize risk management across projects and ensure compliance with internal or external frameworks\.

### Acceptance criteria

### Risk register

*   Users can create and describe a risk with built-in and custom fields, including.
    
*   Each risk includes two built-in numeric fields:
    
    *   `Likelihood` (1–5 scale)
        
    *   `Impact` (1–5 scale)
        

### Scoring

*   We calculate
    
    *   **Initial Risk Score** = Likelihood × Impact
        
*   We derive a **Residual Risk Score**, either:
    
    *   Manually entered, or
        
    *   Calculated from linked controls/treatments
        

### Risk Treatment and Actions

*   Users can add multiple **Actions** and **Treatment Items** to each risk.
    
*   These items could define deltas on likelihood and impact, causing an observable reduction of the risk over time
    
*   These items could be work packages or other items
    
*   Residual risk values can be shown and visualized
    

### Workflow and Status

*   Risk items follow a preconfigured status workflow
    
*   Changes to the attributes are journalized
    
*   Risks can be commented on
    
*   A risk has an owner, and should receive notifications
    

### Reporting

*   All changes to:
    
    *   Status
        
    *   Risk scores
        
    *   Linked items
        
    *   are logged for traceability.
        
*   PDF Reports can be generated by:
    
    *   Status
        
    *   Owner
        
    *   Risk score
        

### Project Integration

*   Risks are linked to a project or sub-project.
    
*   Optional linking to:
    
    *   Work packages
        
    *   Meetings
        
    *   Documents
        

### 9\. User Permissions

*   Permissions configurable by role:
    
    *   View risks
        
    *   Manage Risks
        
    *   TBD: Additional more fine-grained permissions
        
        <br>

### Out of scope

  - Migrations of existing work packages to the new "protected" risk objects

  - Automatic calculation of the risk value (implemented in <mention class="mention" data-id="28704" data-type="work_package" data-text="##FND-2" data-display-id="FND-2">\#\#FND-2</mention>)

| Attribute | Value |
| --- | --- |
| Mockups |  |

## Planning

| Attribute | Value |
| --- | --- |
| Roadmap |  |
| Date |  |
| Votes | 19 |
| List | cProject, PM² PMflex |
| Target versions | Wish List |
| Sprint |  |
| Backlog bucket |  |
| Relevance | Important — Required Short-Term |

## Subitems

| ID | Type | Subject | Status | Assignee | Target versions | Project | Priority | Spent time |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| OP-17519 | Feature | Risk register | new |  | Product Backlog | OpenProject | Medium |  |
| OP-17769 | Feature | Risk matrix | new |  | Product Backlog | OpenProject | Medium |  |
| OP-17771 | Feature | Comments for Risks | in specification |  | Product Backlog | OpenProject | Medium |  |
| OP-17573 | Open Point | Modeling of Risks (and Goals, Milestones etc) as fixed types | decided |  |  | OpenProject | Medium |  |

## Bugs and other work packages

| ID | Type | Subject | Status | Assignee | Target versions | Module |
| --- | --- | --- | --- | --- | --- | --- |
| OP-17690 | Open Point | Where do we want to show built-in types such as risks,goals, milestones together with custom work packages? | rejected |  |  |  |
| OP-17573 | Open Point | Modeling of Risks (and Goals, Milestones etc) as fixed types | decided |  |  |  |

## Details

| Attribute | Value |
| --- | --- |
| Module | Modules and project features / Risks |
| Enterprise plan | Enterprise / Corporate (COR) |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Rosanna Sibora |
| Product manager | Rosanna Sibora |
| Designer | Marc Alcobé |
| Developers | OP Dev Polaris Team |
| Requested by |  |
| Interest by | Home (224196000003952096) |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work | 50d 0h · Σ 98d 0h |

## Description

**As a** project manager

**I want to** track my risks in OpenProject

**So that I** have everything in one place and don't need a separate tool for that.