The project risk register
A risk register is a list of what may go wrong, with a rating and a plan for each item. It is often set up to tick a box and then forgotten. Here is how to make it something people use.
Risk, problem and assumption are not the same
- A risk is an event that may happen: “the supplier may deliver the hardware late”.
- A problem is what has already happened: “the supplier delivered the hardware two weeks late”.
- An assumption is what we take as true without checking: “the test bench will be free in November”.
They are easy to keep in one register: an assumption that fails becomes a risk, and a risk that fires becomes a problem.
Which fields you need
The minimum:
- Description as “cause → event → consequence”. “Because the contractor’s team is busy, integration may start late, which would move the pilot.”
- Probability on a scale of 1 to 5.
- Impact on time, money or quality, also 1 to 5.
- Owner — one person, not a department.
- Response — what we do to lower the probability or the impact.
- Review date — when we look at the risk again.
- Link to the plan — the work the risk affects.
The risk matrix
Probability times impact gives the risk score. A 5 × 5 matrix sorts risks into zones:
- Red zone — high probability and impact. These are handled now and reported at every status meeting.
- Amber zone — watched, with responses prepared.
- Green zone — accepted and reviewed from time to time.
The matrix shows on one screen where the danger is concentrated, rather than a long list.
How to keep it from becoming a formality
- Review it regularly, say weekly, and close risks that no longer apply.
- Link risks to work. Nobody will remember “integration may start late” a month on if it isn’t tied to the integration task.
- Bring the red zone up — into the project overview and the portfolio, not a separate file.
- Record decisions. If a risk is accepted, it should be clear who decided it and when.
Where to do it
In Etapero the register of risks, problems and assumptions sits next to the plan: each item has a rating, an owner and links to the work, the risk matrix is built automatically, and red-zone risks show in the project overview and the portfolio. Jira issues about to miss their deadline show there too.