> For the complete documentation index, see [llms.txt](https://portavi.gitbook.io/portavi-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://portavi.gitbook.io/portavi-docs/governance/risks.md).

# Risks

A risk is something that might go wrong. Portavi tracks it, scores it, and records what you plan to do about it.

<figure><picture><source srcset="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-6aada3004e13a5637442cb57da0be8d0191769ab%2Fgovernance-risks-dark.png?alt=media" media="(prefers-color-scheme: dark)"><img src="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-8a342b100b267059a0eb8bf0c2f23bb91a90f725%2Fgovernance-risks.png?alt=media" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Governance holds the workspace's registers: the [RAID log](/portavi-docs/governance/raid-log.md) (risks, [assumptions](/portavi-docs/governance/assumptions.md), [issues](/portavi-docs/governance/issues.md), [dependencies](/portavi-docs/governance/dependencies.md)), the [decisions log](/portavi-docs/governance/decisions-log.md), lessons, benefits and [change requests](/portavi-docs/governance/change-requests.md). Objectives and the strategy map moved to their own **Strategy** page; see [Objectives and strategy reviews](/portavi-docs/strategy/objectives-and-strategy.md).
{% endhint %}

## Where risks live

A risk belongs to exactly one parent: a **project** or a **programme**, never both at once. You manage them from that entity's **RAID** tab, on **Risks**.

<figure><picture><source srcset="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-36caa6abe0dc09043eeaf13a2713f20d8fff5c1d%2Fmodal-create-risk-dark.png?alt=media" media="(prefers-color-scheme: dark)"><img src="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-a5bfa0b0e17d795d7be2a3618b7c02152b444b6b%2Fmodal-create-risk.png?alt=media" alt=""></picture><figcaption></figcaption></figure>

The **Governance** page in the sidebar aggregates every risk in the workspace into one register, and its [RAID dashboard](/portavi-docs/governance/raid-log.md#the-raid-dashboard) counts the open risks scoring **6 or more** out of 9 as high exposure.

## Adding a risk

From **RAID → Risks**, select **Log risk**:

* **Title**: what might go wrong
* **Description**: the detail
* **Impact**: low, medium or high: how bad it would be
* **Likelihood**: low, medium or high: how probable it is
* **Category**: schedule, budget, technical, scope, resource or external (optional). [Issues](/portavi-docs/governance/issues.md) and [assumptions](/portavi-docs/governance/assumptions.md) use the same six
* **Mitigation**: what you are doing to prevent or reduce it

Impact × likelihood gives the risk a **score**, which is how the register sorts and how heat is shown.

**Description** and **Mitigation** both accept rich text, and both can be rephrased, shortened or expanded for you. See [AI in Portavi](/portavi-docs/ai/ai-in-portavi.md).

## When a risk happens

Mark it **occurred**. It stays in the register with that state, so the record shows what actually materialised rather than quietly disappearing, which is most of the value of keeping a register at all.

Marking it occurred also asks **what was decided in response**: one line each. They go into the [decisions log](/portavi-docs/governance/decisions-log.md) with the risk as their source and show on the risk afterwards, where **Edit decisions** changes them. Un-marking a risk that has decisions asks for confirmation first, because they are removed with it.

The same dialog offers **Also raise an issue**: ticked, it logs an open, high-priority [issue](/portavi-docs/governance/issues.md) named after the risk, in its category and linked to it, because a risk that has happened is now something to fix.

<figure><picture><source srcset="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-b168e91e1495ed4d2c4f0d8b5396a728aff6f84e%2Fmodal-risk-occurred-dark.png?alt=media" media="(prefers-color-scheme: dark)"><img src="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-f1e2aeabe6e307a0f2abb107313522b930055c13%2Fmodal-risk-occurred.png?alt=media" alt=""></picture><figcaption></figcaption></figure>

<figure><picture><source srcset="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-f94a5998d0653f8602b780c906a8da8cfff7938e%2Fmodal-risk-decisions-dark.png?alt=media" media="(prefers-color-scheme: dark)"><img src="https://4189291014-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fx6fERvLd0cQQBYlynE5O%2Fuploads%2Fgit-blob-6e5bde251eca629cf2e655e2497a4853d5a8b154%2Fmodal-risk-decisions.png?alt=media" alt=""></picture><figcaption></figcaption></figure>

## Promoting a project risk to its programme

A project risk that matters at programme level can be **promoted**. It then appears in both registers, still owned by the project.

To reverse it, choose **Remove from programme**. That unmarks the promotion without deleting the risk; it stays on the project.

{% hint style="info" %}
Deleting behaves differently depending on origin. A promoted project risk removed from a programme survives on its project. A risk created natively on a programme is deleted outright. Portavi's confirmation wording tells you which you are doing.
{% endhint %}

Promoting a risk is itself logged in the [decisions log](/portavi-docs/governance/decisions-log.md), as an escalation dated that day; taking the risk back off the programme removes the entry.

## Who can edit

The owner of the project or programme, or a PMO manager.

## The Risk Register

**Governance → Risk Register** shows every risk across the workspace, with its parent, score, category and state: for looking across everything rather than project by project.

Selecting a risk opens it in full: description, mitigation plan and everything the row does not have space for. It is read-only here: a risk is edited on the project or programme that owns it, which is where the register links to. The same panel opens from those pages, where you can edit it.

The small **Logged by** credit names who wrote the risk. Their avatar carries their role colour, and selecting it opens their [profile](/portavi-docs/tracking-delivery/member-profile.md).