Every project, from launching a website to renovating an office, faces uncertainty. Suppliers deliver late, key people get sick, budgets change and requirements shift. You cannot remove uncertainty, but you can manage it. One of the simplest and most widely used tools for doing so is the risk register: a living document where the team lists what might go wrong, how serious it would be and what to do about it.
What is a risk register?
A risk register is a table, often kept in a spreadsheet or project management tool, that records each identified risk along with information that helps the team decide how to respond. A risk is an uncertain event that, if it happens, affects project objectives such as time, cost, quality or scope. Notice the word “uncertain”: something that is already happening is not a risk but an issue, and it belongs in an issue log instead.
Step 1: Identify the risks
Gather the people who know the work best and ask a simple question: “What could prevent us from finishing on time, within budget and with the expected quality?” Useful techniques include brainstorming, reviewing lessons learned from past projects, checking the project plan task by task and interviewing experts or stakeholders. Describe each risk clearly using a cause, event and effect format, such as: “Because the supplier is new (cause), the delivery may be delayed (event), which would push back the launch date (effect).”
Step 2: Assess probability and impact
Not all risks deserve the same attention. For each one, estimate how likely it is to occur (probability) and how much damage it would cause (impact). Many teams use a simple scale from 1 to 5 for both. Multiplying the two numbers gives a risk score that helps you rank the list.
| Score (Probability × Impact) | Level | Typical action |
|---|---|---|
| 1 to 5 | Low | Accept and monitor occasionally |
| 6 to 12 | Medium | Plan a response and assign an owner |
| 15 to 25 | High | Act immediately and report to the sponsor |
Step 3: Choose a response strategy
For threats, there are four common strategies:
- Avoid: change the plan so the risk cannot happen, for example by choosing a proven supplier.
- Mitigate: reduce the probability or impact, for example by testing early or adding a backup resource.
- Transfer: shift the consequences to another party, such as through insurance or a fixed-price contract.
- Accept: do nothing for now, but stay aware, and possibly set aside a contingency reserve.
Projects also face positive risks, called opportunities, such as finishing early because a new tool works better than expected. Strategies for opportunities include exploiting, enhancing, sharing or simply accepting them.
Step 4: Assign owners and triggers
A risk without an owner is a risk nobody watches. Assign one person to each significant risk, responsible for monitoring it and carrying out the response. Add a trigger, an early warning sign that the risk is about to occur, such as “the supplier has not confirmed the order by the 10th”. Triggers turn vague worry into clear action points.
What columns should a register have?
You can keep it simple. A practical starting layout includes the following columns:
- ID number for easy reference;
- Risk description in cause, event and effect form;
- Category, such as schedule, cost, technical or people;
- Probability and impact scores;
- Total risk score;
- Response strategy and specific actions;
- Owner and due date;
- Trigger or warning sign;
- Status, such as open, mitigated, occurred or closed.
Step 5: Review it regularly
A risk register that is filled once and forgotten is useless. Put it on the agenda of your regular project meetings. Update scores as conditions change, close risks that can no longer happen, and add new ones as the project evolves. Record what actually occurred, because these notes will be valuable for future projects.
A short example
Imagine a team building a customer portal. One risk reads: “Because the payment provider’s interface is new to the team, integration may take longer than planned, which could delay launch by two weeks.” Probability is 4 and impact is 3, so the score is 12, a medium risk. The response is to mitigate: schedule a small prototype in the first week and assign a senior developer as owner. The trigger is that the prototype is not working by day five. With this single row, the team has transformed a vague concern into a plan.
Common mistakes to avoid
Teams often write risks that are too vague, such as “the project may fail”, which cannot be acted upon. Others list dozens of tiny risks and lose focus; concentrate on the top ten or fifteen. Another mistake is treating the register as paperwork for managers instead of a shared tool for the whole team. Encourage everyone to speak up, since the people doing the work often see the problems first.
Conclusion
A risk register brings structure to uncertainty. By identifying risks, scoring them, choosing responses, assigning owners and reviewing the list regularly, you give your project a much better chance of staying on track. To go further into planning, scheduling and risk management, explore the project management courses available at Cursa and build the skills teams look for in good project leaders.
