The Two Risk Worlds

GreenVee uses the word “risk” in two completely different ways. Before you work with any part of this section, you need to understand this split. Confusing the two is the most common mistake new users make.

The core distinction

Project Risk is something bad that might happen on a specific project. A contractor might pull out. A regulatory approval might be delayed. A cost estimate might be wrong. Project teams manage these day to day. They live on the project, belong to a project, and are mitigated by actions on the project.

Portfolio Risk Factor is a strategic evaluation dimension defined at the portfolio level — something like “Regulatory exposure” or “Supply chain fragility” or “Technology maturity.” Portfolio leaders define these criteria once. Then each project gets scored against each factor. Portfolio Risk Factors are a scoring framework, not an event register.

Side-by-side comparison

	Project Risk	Portfolio Risk Factor
What it is	A specific bad thing that might happen on one project	A strategic risk dimension used to evaluate projects
Scope	One project	Entire portfolio
Who manages it	Project Manager / Risk Owner	Portfolio leadership
Schema name	risk	risk_contribution
Score / measure	Likelihood %, possible value, degree of risk	An answer (score/rating) per project
Score record name	— (on the risk itself)	Risk Factor Score (risk_contribution_assessment)
Linked to actions?	Yes — Risk Actions, which can block Gate sign-off	No
When it closes	When the risk occurs or is no longer relevant	When the portfolio framework is retired or updated

They are not connected

Caution

Portfolio Risk Factors do not automatically aggregate from Project Risks. Scoring a project’s “Regulatory exposure” factor has no link to any specific regulatory risk logged on that project. They are independent systems — one operational, one strategic.

This is intentional. Strategic evaluation criteria are stable and defined top-down. Operational risks are volatile and emerge bottom-up. Mixing the two would make both less useful.

A practical rule

If a colleague says “we need to look at the risk on this project” and you are not sure which they mean, ask:

“Do you mean the project risk register, or the portfolio risk scorecard?”

Caution

Never assume “risk” means the same thing in both contexts. A project with no entries in its risk register can still have a high Portfolio Risk Factor score — and vice versa.

Where to go next

• To manage operational risks on a project → Project Risks
• To define or score portfolio-level criteria → Portfolio Risk Factors
• For the positive equivalents (upside) → Project Opportunities and Portfolio Targets