RAID log

What it is

RAID stands for risks, assumptions, issues and dependencies. It is one shared register, usually a spreadsheet or a project tool, that keeps these four types of item visible:

• A risk is an uncertain event that could affect objectives if it happens, such as a key vendor missing a delivery.
• An assumption is something treated as true for planning without proof, such as test environments being available in March.
• An issue is a problem that has already happened and needs action, such as a delayed data feed.
• A dependency is a link to work outside the project’s control, such as a release by another programme.

Each entry records a description, owner, impact, likelihood (for risks), mitigation or action, due date and status.

Why it matters

Change projects in finance rarely fail for a single reason; they fail when small risks and unchecked assumptions combine. A RAID log forces the team to write them down, name an owner and track action. It is also the main input to governance: steering committees review the top risks and issues and decide on escalations. Auditors and second-line risk teams often check that RAID logs exist, are current and show closed actions.

Worked example

Illustrative numbers. A payments upgrade has a RAID log with 40 entries. Risks are scored on impact and likelihood from 1 to 5, and the score is the product. A risk that the new message format is late from a third party has impact 5 and likelihood 3, a score of 15, above the escalation threshold of 12. The PMO flags it as red for the steering committee. The committee approves a mitigation: test with a simulator so the project does not wait. Two weeks later the assumption that test data would be ready by week 6 proves false, so it is closed as an assumption and opened as an issue with a new owner and a fix date.

Who uses it

PMO analysts maintain the log, chase owners and prepare RAID summaries for reports. Project and programme managers use it to decide what to escalate and where to spend time. Change managers record adoption risks, such as low training attendance. Workstream leads, business analysts and vendors add and update entries in their areas. Steering committee members read the top items and approve mitigations or extra resources.

Common confusions

Risks and issues are often mixed up. A risk may happen; an issue has happened. When a risk materialises, it should move to the issue list. Another confusion is to treat the log as a reporting form filled in before a meeting: it only works when actions are tracked between meetings. Finally, project RAID logs complement the firm’s operational risk register; they do not replace it.