Management has asked you to perform a risk audit and report back on the results. Bonny, a project team member asks you what a risk audit is. What do you tell Bonny?

Reviewing risks that have yet to occur and assessing their probability describes ongoing risk monitoring or risk reassessment activities, not a formal audit of response effectiveness.

A risk audit examines and documents the effectiveness of risk responses in dealing with identified risks and their root causes, evaluating whether the planned responses produced the intended outcomes. It is a distinct process from risk reassessment or monitoring because it focuses on auditing the risk management process itself rather than tracking risk status. This formal evaluation helps determine if adjustments to risk response strategies are needed.

Reviewing risks that have already occurred and their actual impact describes a lessons-learned or post-mortem review, which is separate from auditing whether responses were effective.

Reviewing probability and impact for risks still active in the project describes risk reassessment, a separate process from auditing the effectiveness of existing risk responses.