Risk register: what could go wrong, and what you are doing about it

What is a risk register?

A risk register is an overview of what could go wrong in a project or in a team's work. For each risk, it shows how big it is, who owns it and what you are doing about it. A risk log is the same thing: two names for one overview.

Alongside risks, it also holds issues: things that are already going wrong. A risk could still happen; an issue is already here. For a risk, you look for a measure to prevent it or limit the consequences. For an issue, you look for a solution.

Why a register?

Because everyone in a team sees risks, but they rarely come together in one place. The site manager sees that frost could halt the concrete pouring. The work planner knows the subcontractor is short of people. Without a register, that stays in people's heads until it goes wrong.

Which teams it suits

A project team that wants to know what could go wrong, and any team whose work has something at stake: a delivery that is delayed, a system that has to keep running, a deadline that is fixed. For example, a project team renovating an apartment block that reviews its risks every month.

Carrying out a risk analysis: how to go about it

1. Collect what could go wrong

Do it together. Ask everyone: what could delay this project or this work, make it more expensive or make it turn out worse? Write down each risk separately. Including what is already going wrong.

2. Describe each risk

What could happen, and what would the consequence be? "Heat pump delivery is delayed, so the installations in block A will be finished later" is better than "supplier".

3. Decide how big it is

Look at two things: the likelihood that it happens, and the consequences if it does. Discuss a risk with a high likelihood and serious consequences first. A simple scale of low, medium and high is enough. It is about the order, not a precise number.

4. Give every risk an owner

One person who keeps an eye on it and arranges the measure. Not the person who spotted the risk, but the person who can do something about it.

5. Choose a measure

Prevent it, reduce the consequences, or accept the risk deliberately. Accepting is also a decision: add a note explaining why.

Likelihood times impact: how big is a risk?

The size of a risk depends on two things: how likely it is to happen, and how bad it would be if it did. This is often called likelihood times impact.

Keep it simple

Score the likelihood and the impact as low, medium or high. A risk with a high likelihood and a high impact goes to the top. A risk with a low likelihood and a low impact does not need to be discussed every month. It is about the order: what does the team need to deal with now?

Impact is more than money

Look at what it affects in the project or the team: time, money, quality, safety, and the people you are doing it for. In a housing renovation, that includes the residents. Noise during demolition costs no money, but it does affect them.

A score is not a decision

The score helps you choose what gets attention first. The decision on what to do about it is the team's: prevent it, reduce the consequences or deliberately accept the risk. Write that decision down, with the reason.

An example: a risk register in construction

A project team is renovating an apartment block. On the risk board, under Identified: frost in January could halt the concrete pouring. Under Response under way: the heat pump delivery is delayed, and the electrical subcontractor is short of people. The first is stuck and has a red border. Accepted is the noise nuisance for residents during demolition: it comes with the job, and residents have been informed. Resolved is the scaffolding that was not delivered on time.

The measure for the heat pumps is an action: find another supplier. That action is not on the risk board but on the project board, with the work. That is where the team sees it every day.

A risk register as a board

A register in a spreadsheet has one drawback: only whoever opens it sees it. On a board you can see at a glance which risks are still open, and who owns them.

• Identified: new, not yet discussed.
• Response under way: there is a measure, and it is being carried out.
• Accepted: the team has decided to accept the risk.
• Resolved: the risk has gone, or the issue has been resolved.

What to record for each risk

What could go wrong, what the consequence would be, how likely it is, who the owner is and what measure you are taking.

How often should you review the risks?

Every month, all open risks: has it grown or shrunk, and are we still doing the right thing? A new risk with serious consequences does not wait for the next meeting: discuss it straight away.

Keeping the register up to date

• Start with the new risks: who becomes the owner, and what do we do?
• Then go through the open risks, the biggest first.
• Check whether the measures are being carried out. A measure that has been agreed but not taken is not a measure.
• Remove whatever has been resolved. Nobody reads a register full of old risks.

Common mistakes with a risk register

• Filling it in once and never updating it. After a month it is out of date.
• A name without ownership. Every risk has someone's name on it, but nobody feels responsible. Agree what the owner does.
• Only talking about it when it goes wrong. A risk that has been on the list for a long time still happens, because nobody discussed it.
• Measures that disappear. They are agreed and then get lost among the other work. Put them with the work, with a name and a date.

Together with other boards

Project

The project's work, the project meeting and the risks. Boards: Project board, Project meeting and Risks and issues.

Start with this combination