Risk Audit vs Risk Review: Differences, Examples, and When to Use Each

This guide compares the two side by side, gives a review agenda, a decision table for choosing between them, a calendar, and the PMP exam cues.

What Is the Difference Between a Risk Audit and a Risk Review?

A risk audit looks backward and tests whether the risk management process and its responses worked. A risk review looks forward and reassesses risks, finds new ones, and closes old ones. Audits run at set intervals. Reviews run every reporting cycle.

What Is a Risk Review?

A risk review is a scheduled meeting where the team documents the effectiveness of responses, identifies new risks, reassesses current ones, closes outdated ones, examines issues from risks that occurred, and records lessons. The PMBOK Guide requires periodic risk reviews.

The PMBOK Guide Sixth Edition lists risk review meetings as a Monitor Risks technique. PMI prefers separate risk review meetings, and it allows a combined status and risk meeting when the risk management plan says so. Either way, the project must review risk periodically.

A review covers 6 topics:

• Effectiveness of responses against overall project risk and individual risks.
• New risks, including secondary risks that responses create.
• Reassessment of current risks, such as watch-list items that now merit a response.
• Closure of outdated risks and release of their reserves to the contingency pool.
• Issues that came from risks that occurred.
• Lessons for the remaining phases.

What Is a Risk Audit?

A risk audit is a formal examination of how well the project manages risk. It tests plan compliance, identification completeness, response effectiveness, and reserve use, then reports findings. The project manager ensures audits run at the frequency in the risk management plan.

PMTI’s guide Project Risk Management Process, Tools & Templates walks through the risk processes, including Monitor Risks, where both the audit and the review sit.

An audit samples evidence. It asks whether the register, the response records, and the reserve log match what the plan promised. A review asks what the register must say today. An audit asks whether the process that fills the register is sound.

How Do Audits and Reviews Work as Quality Assurance and Quality Control?

The review is the quality control of risk management: it checks results such as ratings and response outcomes. The audit is the quality assurance: it checks the process that produces them. PMI suggests holding the two meetings separately.

Reviews find a risk problem. Audits find the process problem behind it. A team that only reviews keeps fixing symptoms.

What Does a Risk Review Meeting Agenda Look Like?

A 60-minute risk review covers 7 items: a recap, the top risks, triggers, new risks, closures, issues from occurred risks, and lessons with actions. The chair records every decision and updates the register before the meeting ends.

PMTI’s guide What is a Risk Register in Project Management? covers the register that the meeting updates.

Send the top-10 list ahead of time. A review that spends 20 minutes reading the register aloud has no time left to decide.

When Do You Use an Audit and When Do You Use a Review?

Use a review when the question is about a risk: is the rating right, is the trigger close, is the response working. Use an audit when the question is about the process: is the method followed, can the sponsor trust the register.

How Often Do You Run Each?

Run reviews at every reporting cycle, often every 2 weeks or monthly. Run audits less often: once on a small project, at each milestone or phase gate on a large one. Set both frequencies in the risk management plan.

Example calendar for a 12-month project: review every 2 weeks, an audit at month 6 (after the design gate), and an audit at month 11 (before closure). The month 6 findings change the risk management plan for the second half.

How Do Audit Findings and Review Outputs Feed Each Other?

Review outputs become audit evidence, and audit findings change the review. The register history, closed risks, and lessons from reviews show the auditor what happened. Findings add agenda items, owners, or training, which the next review carries out.

The cycle closes when a finding becomes a review action and the next audit confirms the fix.

Who Runs and Who Attends Each One?

The project manager chairs the risk review with the team, risk owners, and experts. The audit needs an auditor, the project manager, and the risk owners it interviews. The sponsor receives the audit report and attends reviews only for escalations.

The auditor can be the PMO, the quality function, a peer project manager, independent experts, or an external party. The PMBOK Guide does not fix who audits. Independence raises assurance and cost.

What Is a Risk Portfolio Audit?

A risk portfolio audit examines risk management across a group of projects or programs. It samples projects, compares their practices, checks that exposure rolls up consistently, and reports common gaps and the top risks for executive attention.

One PMI conference paper on a telecom supplier describes an audit that benchmarks projects against each other and lists the top 10 risks in the organization from key projects. Use the same approach at portfolio level:

The PMO or enterprise PMO usually commissions the portfolio audit, and its findings feed the enterprise risk report.

What Does “Risk” Mean in Auditing?

In financial auditing, audit risk is the chance that an auditor issues a clean opinion on statements containing a material misstatement. It equals inherent risk times control risk times detection risk. A project risk audit examines project risk management instead.

The words overlap and the disciplines do not. Project teams audit their risk process. Financial auditors audit the risk of misstatement.

How Do Audits and Reviews Work in Agile and Hybrid Projects?

Agile and hybrid teams run the review as a short recurring session, often inside sprint planning or the retrospective, and the audit at release boundaries or quarterly. The review updates backlog risks. The audit checks the practice.

• Fold a 10-minute risk review into sprint planning, or run it in the retrospective.
• Update risk items in the backlog at every review.
• Audit at each release boundary, or every 3 months on long-running products.
• Sample the top risk items and every risk that occurred.

Approximately 60% of the July 2026 PMP exam targets agile or hybrid approaches, so exam scenarios use both vocabularies.

How Are the Risk Audit and the Risk Review Tested on the PMP Exam?

PMP questions test the direction and the subject. A backward look at whether the risk process and responses worked is an audit. A forward look that reassesses risks and updates the register is a review. Both sit in Monitor Risks.

Ask 1 question: does the scenario test the process or the risks? 

PMTI’s Project Risk Management Course (24 PDUs) covers project risk management in depth for middle and upper management. Max Wideman, a PMI Fellow who led the first PMBOK Guide effort, designed the course and delivers it online.