Risk Register — Risk Management for Azure DevOps

Complete risk lifecycle management, built directly into Azure DevOps. Identify, assess, ROAM, mitigate, and report — without ever leaving your workflow.

At the core is a Risk Register giving your team a dedicated risk table purpose-built for risk meetings, management reviews, and weekly updates — sortable, filterable, with inline editing so you can update state, severity, owner, and category without ever opening the ADO work item form.

Built on top of that foundation is a full suite of connected views: an interactive risk matrix, a live analytics dashboard, a SAFe ROAM board, and a mitigation roadmap with drag-and-drop sprint planning — all reading from your existing Azure DevOps work items.

No data duplication. No separate database. No migration. Your work items, made powerful.

🆕 What's New in Version 2

Version 2 is a complete rebuild — the core risk register view is significantly improved, and six major new capabilities have been added on top of it:

⚡ Everything in One Hub

📋 Risk Register — Multi-Register Management

Organise risk management across your entire project with multiple query-backed registers.

• Create as many registers as you need — one per delivery stream, team, workstream, or phase
• Favorites — star frequently used registers to pin them to the top; persists across sessions
• Real-time search — filter registers by name or description as you type
• Navigate directly from any register into its risk table, dashboard, ROAM board, or roadmap

📝 Risk Table — Full Control, No Context Switching

The risk table is where day-to-day risk management happens. It's built for risk meetings, management reviews, and weekly updates.

• Sortable, filterable table across all risks in a register — paginate at 7, 10, 25, or 100 per page
• Expand any risk row to reveal all linked mitigation work items with state and progress
• Right-click context menu to update — without opening the ADO work item form:
  • State · Severity · Impact · Likelihood · Category · Owner
  • Add a comment or create a new mitigation action
• Dual severity view — toggle between Current (residual) and Initial (pre-mitigation) severity to track risk reduction over time
• Mitigation progress bar on every risk showing percentage of mitigations complete
• CSV export — full risk and mitigation data, locale-aware date formatting, one click
• Share link — generate a direct URL to a specific register or risk for emails and meeting notes
• Every risk and mitigation links back to its ADO work item with a single click

📊 Analytics Dashboard — Instant Visibility

Stop building pivot tables. The dashboard delivers live visual insight across the entire register.

Risk Matrix Heat Map

• Fully interactive 3×3, 4×4, or 5×5 risk matrix — your choice
• Color-coded cells from low (green) to critical (red) based on actual risk count
• Click any cell to drill down into the risks at that exact severity intersection; paginated table opens inline

Risk Health Scorecard Five health dimensions, automatically calculated from your live risk data:

Click any dimension to drill into the affected risks and take action — assign owners, add categories, create mitigations — without leaving the dashboard.

Completion & Coverage Charts

• Donut chart showing overall risk completion (Not Started / In Progress / Done)
• Category distribution bar chart
• Mitigation progress by category and severity — spot where action is concentrated
• Mitigation breakdown by Area Path and Sprint — see completion rates across teams and iterations

🎯 ROAM Board — Built for SAFe and PI Planning

Bring the industry-standard ROAM framework directly into Azure DevOps. Perfect for PI Planning events and regular risk review ceremonies.

• Drag and drop risks between columns — the corresponding ROAM-R/O/A/M tag is applied to the ADO work item automatically
• Progress bar shows what percentage of risks have been classified out of the unallocated pool
• Each card shows title, severity, category, owner, and latest comment
• Right-click card actions: change owner, add comment, open in ADO, view detail
• Unallocated pool collects newly added risks awaiting classification

🗓️ Mitigation Roadmap — Connect Risks to Sprint Planning

A visual timeline of all mitigation work items mapped across sprints — making it easy to spot bottlenecks, unscheduled work, and delivery risk before it becomes a problem.

• Timeline grid — risks as rows, sprints as columns; mitigation boxes sit in their assigned sprint
• Backlog column — all unscheduled mitigations collected in one place
• Drag and drop — move mitigations from Backlog into a sprint, or between sprints to reschedule; ADO iteration path updates automatically
• Current sprint highlighted — always visible so teams know where they stand
• Filters — narrow by title, state, assignee, area path, iteration, severity, or category; active filter count shown as a badge
• Sort by state, severity, progress, category, or owner; click a third time to clear
• Zoom and pan — Ctrl+Scroll to zoom (30%–300%), click-drag on empty space to pan, click the percentage label to reset to 100%
• Completion flag 🚩 appears on a risk row when all its mitigations have been scheduled

💼 Use Cases

Project Management Offices (PMOs) Maintain authoritative risk registers per project or programme. Use the dashboard to produce weekly health reports. Export to CSV for board-level packs. The data is always current because it lives in ADO.

SAFe / ART Teams and PI Planning Use the ROAM board during PI Planning to classify and allocate risks in real time. The progress bar shows facilitation progress at a glance. After planning, the roadmap shows how mitigation effort is distributed across sprints and teams.

Teams Running Multiple Delivery Streams Create one register per workstream or product, backed by a different saved query. Flip between them from the register list. Favourites ensure high-priority registers are always one click away.

Risk and Compliance Functions Use Initial vs Current severity to demonstrate how mitigations have reduced risk scores over time. The health scorecard surfaces ungoverned risks — no owner, no mitigation plan — before they become incidents.

Scrum Masters and Iteration Managers The roadmap connects mitigation work directly to sprint planning. Move unscheduled mitigations from the Backlog into the right sprint and track completion across iterations — all without leaving the extension.

🔧 Requirements

• Azure DevOps Services (cloud) — not currently supported on Azure DevOps Server (on-premises)
• Project permissions — the installing user needs at least Contributor access
• A Risk Work Item Type in your ADO process with custom picklist fields for Severity, Impact, Likelihood, and Category
• Numeric picklist values — Severity, Impact, and Likelihood fields must have values starting with a number (e.g. 1. Low, 2. Medium, 3. High). The extension reads the leading integer to position risks on the matrix
• A Mitigation Work Item Type — can be a custom type or an existing type (e.g. Task, Issue)

⚙️ Setup Guide

Step 1 — Design your Risk Work Item Type

Decide on your matrix size first, as it determines how many picklist values your custom fields need.

Step 2 — Add Custom Fields in ADO Process Settings

Go to Project Settings → Process → [Your Process] → [Your Risk Work Item Type] and add the following custom fields:

Required — Severity, Impact, Likelihood (Picklist String fields)

Each value must begin with its number. Descriptive text after the number is shown to users and can be anything. Example for a 3×3 matrix:

Example for a 5×5 matrix, all three fields would use: 1. Very Low · 2. Low · 3. Medium · 4. High · 5. Critical

Important: The starting digit is what drives the matrix. 1. Low and 1. Minimal are both valid; Low without the leading number is not.

Required — Category (Picklist String field)

Any values you choose. Examples: Schedule · Budget · Reputation · Compliance · Technical · Resource

Optional — Initial Severity fields (for before/after comparison)

Add three additional picklist fields with the same numeric values as above — e.g. Original Severity, Original Impact, Original Likelihood. These must be separate fields from the current severity fields.

Mitigation Work Item Type

No custom fields are required on the mitigation type. You can use an existing type (Task, Issue, User Story) or a custom one.

Step 3 — Open Extension Settings

Once the extension is installed, a Risk Register hub appears under Boards in your project navigation.

Open the Risk Register hub and click the gear icon in the bottom-left corner to open Settings.

Step 4 — Configure the Extension

Work through each setting in order:

Step 5 — Validate and Save

Click Validate. The extension calls the ADO API to confirm that each selected field exists on the work item type and that its picklist values match the chosen matrix size. Any field that fails is cleared and the error is shown on the Validate button.

Click Save once validation passes.

Validation fails? The most common cause is picklist values that don't start with a number, or a gap in the sequence (e.g. 1, 3 but no 2). Open Project Settings → Process → [Field], check the allowed values, and re-run Validate.

Step 6 — Create your First Risk Register

1. Return to the Risk Register hub
2. Click New Register
3. Give it a name, an optional description, and select the saved ADO query that returns your risk work items
4. Click Save — the register appears in the list immediately
5. Click the register to open the risk table and start managing risks

✅ You're Ready to Go!

• Dashboard — click the chart icon from the risk table header to open the analytics dashboard
• ROAM Board — click the ROAM button to open the SAFe classification board
• Roadmap — click the Roadmap button to open the mitigation sprint timeline
• Help — click the ? button on any page for a step-by-step guide to that view

📬 Support & Documentation

• Detailed setup guide: e9-agile.com/riskmanagementconfiguration
• Support: e9-agile.com/extensionsupport
• More information: e9-agile.com/riskmanagement

Risk Register — Free Trial Version. See the marketplace listing for licensing details.