From Risk Registers to Portfolio Intelligence: Connecting the Risks That Matter
Why a common risk taxonomy can help organisations identify shared exposures, coordinate responses and strengthen portfolio-level decision-making.
By Oladapo Famuyiwa, BOF Consults · October 2026
When individual risk registers tell only part of the story
A programme director reviews the monthly risk reports from six projects.
Each project has an experienced risk owner, an up-to-date register and a defined escalation process. Yet the consolidated report reveals little about the relationships between the risks.
One project reports supplier delivery problems. Another identifies component shortages. A third highlights a potential procurement delay. A fourth reports rising costs associated with alternative sourcing.
Individually, each concern is understandable. Collectively, they may point towards a shared exposure affecting the programme’s delivery commitments.
But unless the organisation can connect the information, the portfolio view remains incomplete.
This is one of the challenges facing PMOs and programme governance teams: a collection of well-maintained risk registers does not automatically provide integrated risk intelligence.
The opportunity is to move beyond consolidating risk reports towards understanding the relationships between exposures across projects, programmes and organisational functions.
Why portfolio risk aggregation is difficult
Organisations often use different terminology, categories, assessment scales and reporting conventions across their delivery environments.
One team classifies a risk under procurement, another under logistics and another under schedule. Each classification is reasonable locally, but together they make cross-project analysis difficult.
Three problems commonly arise.
First, the same exposure is recorded differently. Different descriptions can conceal potential duplication or a shared underlying cause.
Second, related risks are separated. Several projects can depend on the same supplier, technology platform, specialist resource or regulatory decision without those dependencies being visible in the consolidated report.
Third, risk scores are not comparable. Different assessment scales, assumptions or definitions can make a simple aggregation of ratings misleading.
The answer is not to merge all similar-looking entries or calculate a single portfolio score without understanding what it represents. Effective integration requires consistent definitions, meaningful relationships and appropriate professional judgement.
Establish a common risk language
A common risk metalanguage provides a foundation for improving the consistency of risk information.
A structured description distinguishes the cause, uncertain event and potential effect on objectives. A taxonomy provides a shared way of classifying the exposure. Metadata adds the information required to understand ownership, assessment, controls and relationships.
We make the case for a common language in Why Better Risk Management Starts with a Common Language, and show how to write decision-ready statements — drawing on lessons from a large-scale data centre project/programme — in The Hidden Danger of the “Lazy Risk”.
For example, an organisation might use the following classification:
Supply chain risk → Logistics → Critical component availability
Several project risks could be associated with this category while retaining their specific circumstances and management arrangements.
The taxonomy is not intended to replace local risk registers. It creates an additional way to examine the information collectively.
The distinction is important: portfolio intelligence depends on connecting risks without losing the context needed to manage them.
Map relationships, not just categories
Classification is useful, but the most valuable insights often emerge from relationships.
Consider a programme with three projects:
- Project A depends on a specialist component from a single supplier.
- Project B requires the same supplier’s production capacity during the same period.
- Project C depends on a technology platform that cannot complete integration until both components are available.
These dependencies create the possibility of interconnected exposure.
A supplier interruption might affect two projects directly and delay a third through an integration dependency. The combined implications may be more significant than any one project register suggests.
A connected risk model helps the programme team investigate these relationships and determine whether they represent a common cause, separate events with shared consequences, or a wider systemic exposure.
The resulting analysis can inform coordinated supplier engagement, alternative sourcing, schedule sequencing, contingency planning and escalation.
These are potential benefits of a structured approach, not guaranteed outcomes. The organisation still needs evidence to establish the relationships and evaluate the available responses.
Connect risk to controls and accountability
Integrated risk information is only useful if it leads to coordinated action.
When several projects depend on the same supplier, for example, each project typically has its own mitigation plan. But those plans could rely on the same alternative supplier, compete for the same capacity or leave a common vulnerability unresolved.
Portfolio-level analysis should therefore examine not only the risks themselves, but also the controls, actions, owners and dependencies associated with them.
Useful questions include:
- Are multiple projects relying on the same control or mitigation?
- Does a proposed treatment create a new dependency elsewhere?
- Who has the authority to coordinate a response across projects?
- Which risks require escalation beyond individual project governance?
- What evidence would demonstrate that the treatment is working?
A shared taxonomy can help expose these questions, but governance arrangements must establish who decides and who acts.
The PMO’s role is particularly important here. It can provide consistent standards, challenge the quality of risk information, facilitate cross-project analysis and ensure that significant dependencies reach the appropriate decision-makers.
Link portfolio risks to strategic objectives and benefits
Portfolio risk management should not become an exercise in classifying data for its own sake.
Its purpose is to help leaders understand uncertainty in relation to what the organisation is trying to achieve.
A risk affecting a project milestone may have consequences for a programme dependency. A programme delay may postpone business change. Delayed business change may defer benefits, increase transition costs or reduce the period during which value can be realised.
These relationships should be examined rather than assumed.
For example, if a transformation programme depends on several projects completing before a new operating model can be introduced, the portfolio risk view should make those dependencies visible. Leaders can then assess how a delay in one project might affect the wider change plan and the timing of expected benefits.
This connects risk management with programme controls, business change and benefits realisation.
The aim is to ensure that risk decisions reflect not only the delivery of outputs, but also the outcomes and value those outputs are intended to enable.
Use technology after establishing the information model
Risk platforms, reporting tools and analytical technologies can help organisations work with larger and more complex datasets.
A structured information model can support consistent reporting, relationship mapping and the identification of potential duplication or patterns. Knowledge graphs and AI-assisted analysis may provide further capabilities where the data, architecture and governance arrangements are suitable.
However, technology cannot compensate for unclear definitions or unreliable information.
An automated system may group two risks because they use similar words even when their causes differ. Conversely, it may miss two related risks because they are described differently.
Organisations should therefore establish validation processes, retain traceability to source records and ensure that competent people review material analytical conclusions.
Technology should enhance risk judgement, not replace accountability for risk decisions.
A practical roadmap for building portfolio risk intelligence
A staged approach can help organisations move towards a more connected view of risk.
1. Establish common definitions
Agree the core terminology, risk statement structure and taxonomy. Define the information required for cross-project analysis while allowing functions to retain relevant specialist detail.
2. Improve data quality
Review existing registers, identify inconsistent classifications and improve descriptions where needed. Preserve ownership, source information and historical traceability.
3. Map cross-project dependencies
Identify shared suppliers, resources, systems, assumptions, controls and milestones. Validate the relationships with the relevant project and functional owners.
4. Establish portfolio governance
Define escalation thresholds, decision rights, coordination responsibilities and the circumstances in which risks should be managed collectively.
5. Integrate reporting and analysis
Configure the existing reporting environment to present the relationships that matter to decision-makers. Use automation where it provides demonstrable value and maintain appropriate human validation.
6. Measure and refine
Monitor information quality, reporting efficiency, confirmed duplicate records, significant dependencies identified and actions taken. Use assurance reviews and lessons learned to improve the model.
Measure the value of integration
A connected risk model should be evaluated by whether it improves decisions, not simply by how many relationships it can display.
Useful indicators include the completeness of risk ownership and control information, the proportion of material dependencies with an agreed response, the time needed to prepare portfolio-level analysis and the number of cross-project actions completed.
Where possible, organisations should establish a baseline before implementation and assess whether the changes produce measurable improvements.
Care is needed when interpreting the results. Identifying more related risks may indicate better visibility rather than deteriorating performance. A reduction in reported risks is not necessarily evidence of reduced exposure.
The emphasis should remain on better-informed decisions and more effective responses.
The real objective is connected decision-making
Risk registers remain important. They provide a structured record of uncertainty, ownership, assessment and response.
But for complex programmes and portfolios, individual registers are only part of the picture.
Organisations also need to understand how risks connect, where exposures accumulate, which controls are shared and how uncertainty could affect strategic objectives and expected benefits.
A common risk language provides a practical foundation for that work. Combined with reliable data, sound governance and competent analysis, it can help PMOs move from reporting individual risks towards supporting integrated risk decisions.
The question for portfolio leaders is not simply how many risks are red. It is whether they understand how the risks that matter most connect — and what they need to do about them.
BOF Consults helps organisations strengthen project and programme delivery, PMO and project controls, risk management, assurance and benefits realisation. To explore how connected risk information could strengthen your portfolio decisions, get in touch to book a free 30-minute Initial Consultation. Where portfolio risk ultimately lands on benefits, our Benefits Management & Realisation course shows how to protect them.
Read next: Why Better Risk Management Starts with a Common Language · The Hidden Danger of the “Lazy Risk”
About the author. Oladapo Famuyiwa leads BOF Consults. He is a P3M consultant with more than 22 years’ experience across defence, aerospace and space, nuclear, infrastructure and government programmes, and holds the PMI Risk Management Professional (PMI-RMP) and Management of Risk (MoR) certifications alongside PMP, MSP, PRINCE2 and Managing Benefits Practitioner.
Work with a Partner Focused on Value, Not Just Delivery
If you are responsible for significant investment, complex change, or professional development, BOF Consults is ready to support you.