Almost every capital project has a risk register. Far fewer have one that anyone uses. The typical register is built in a workshop at the start of design, filled with forty generic risks, scored once and filed. Six months later, the risks that actually hit the project weren't on it, or were on it with "mitigate" in the response column and nobody assigned to do anything.
A register that works is smaller, sharper and tied to money. This guide explains how to structure one, how to score risks without fooling yourself, who should own them, how to choose responses and how to connect the register to your contingency and schedule.
What a risk register is for
A risk register has one job: to make sure the risks that could hurt the project are known, owned and being dealt with, and that the owner is carrying enough contingency for the ones that remain. Everything in it should serve that purpose.
It isn't an issues log. An issue has already happened; a risk might happen. Once a risk occurs, it moves to the issues log or the change process, and its cost moves from contingency into the forecast. Mixing the two makes the register impossible to read.
Structure: the columns that matter
A register that owners actually use has fewer columns than most templates. These are the ones we'd keep:
- ID and title. Short and specific: "Switchgear delivery late", not "Procurement risk".
- Description in cause, event, effect form. "Because the switchgear has a long manufacturing lead time, delivery may slip past energization, delaying commissioning and occupancy." This one sentence does more work than any other field.
- Category. Design, site conditions, procurement, approvals, contractor, owner or market. Useful for spotting patterns.
- Risk owner. One named person, not a company or a committee.
- Probability and impact. Scored on agreed scales, with cost and schedule impact estimated separately.
- Response and actions. The chosen strategy, the specific actions, who does them and by when.
- Trigger. The early warning sign that the risk is starting to happen.
- Residual rating and status. The score after actions, and whether the risk is open, closed or has occurred.
Twenty well-described, owned risks beat a hundred vague ones. If the register has more lines than the team can review in an hour, it's too long.
Probability-impact scoring, and its limits
Most registers rate probability and impact on five-point scales and combine them in a matrix. That's a reasonable way to rank risks quickly, provided everyone uses the same definitions. Write the scales down. "High probability" should mean the same thing to the architect, the contractor and the board, for example "more than 70% likely", and "high impact" should be tied to dollars and weeks for this project.
The method has known weaknesses. Roger Graves, writing in PMI's PM Network, warned that a score such as "impact 2, likelihood 4" can imply more precision than the estimate really has, and that cutting the list at a fixed "top 10" can miss severe risks or waste time on minor ones. He also suggested weighting impact more heavily than likelihood, so that a severe but unlikely risk isn't buried. A 2012 PMI conference paper by A. Osundahunsi argued for adding a third dimension, risk velocity, meaning how quickly a risk would affect the project once triggered.
Score cost and schedule separately. A risk with a modest direct cost can still delay occupancy by weeks, and for a retail or institutional owner the cost of a late opening, such as lost rent, lost sales or paying for two premises at once, can dwarf the construction cost. Carry the schedule effect into the schedule risk analysis rather than converting everything to dollars too early.
The practical lesson: use the matrix to sort, not to decide. A risk that scores medium but could stop the project, such as a utility connection that can't be made, deserves attention regardless of its colour.
View the data
| ID | Risk | Probability | Cost impact | P score | I score | P × I |
|---|---|---|---|---|---|---|
| R1 | Unforeseen soil conditions | 30% | $600k | 2 | 4 | 8 |
| R2 | Switchgear delivery late | 50% | $400k | 3 | 4 | 12 |
| R3 | Design coordination gaps | 60% | $140k | 4 | 2 | 8 |
| R4 | User scope changes | 40% | $300k | 3 | 3 | 9 |
| R5 | Permit approval delay | 25% | $200k | 2 | 3 | 6 |
| R6 | Trade price escalation | 50% | $160k | 3 | 3 | 9 |
Owners: one name per risk
Every risk needs a single owner, the person responsible for watching it and making sure the response happens. The owner should be the person best placed to manage it, not the person who raised it. Design risks belong with the design lead, permit risks with whoever manages approvals, market and funding risks with the owner's own team.
On programs we've supported, the most common failure is that the owner's team accepts ownership of nothing. Every risk is assigned to the contractor or the consultants, including risks that only the owner can manage, such as late decisions, scope changes from users and funding approvals. Those owner-side risks are often the largest on the register. They need an owner-side name next to them.
Responses: stop defaulting to "mitigate"
PMI's framework gives five responses to a threat: avoid, transfer, mitigate, escalate and accept. An article on MPUG's site, which uses that framework, makes the point that "mitigate" has become a reflex. Registers often show it on nearly every line, chosen before anyone has thought about the alternatives.
- Avoid: change the plan so the risk can't happen, such as relocating a service room away from a known flood-prone area.
- Transfer: shift the financial consequence to another party through the contract, insurance or a bond. The risk still exists; you've changed who pays.
- Mitigate: reduce probability or impact, such as releasing an early equipment order or doing extra geotechnical investigation.
- Escalate: hand it to a level of the organization with the authority to deal with it, when it's outside the project's control.
- Accept: take the risk knowingly. The same MPUG article argues that active acceptance needs a reserve, a trigger and a fallback plan. Without those, "accept" just means nobody is doing anything.
Transfer deserves a caution. Pushing a risk onto a contractor who can't control or price it usually comes back as a higher bid, a claim or both. Allocate risk to the party best able to manage it, and get legal advice on the contract wording.
Linking the register to contingency
This is the step most registers skip, and it's the one that makes the register matter to executives. Contingency is the owner's money set aside for risk. If the register and the contingency figure aren't connected, one of them is fiction.
The simplest link is expected value: probability times cost impact for each risk, summed across the register. It's a crude starting point, but it forces a discussion. If the risks you've identified add up to more than the contingency you're carrying, you have a problem before anything has gone wrong.
The better method is quantitative. The U.S. GAO's Cost Estimating and Assessment Guide describes a risk-driver approach in which each register risk has a probability and a range of cost effect, applied to the relevant parts of the estimate in a Monte Carlo simulation. The result is a distribution of total cost. The owner picks a confidence level, such as the 80th percentile, and the gap between that figure and the base estimate is the contingency. Our posts on how much contingency to carry and schedule risk analysis explain the cost and time sides of that approach.
View the data
| Risk | Probability | Full impact | Expected value |
|---|---|---|---|
| R2 Switchgear delivery late | 50% | $400k | $200k |
| R1 Unforeseen soil conditions | 30% | $600k | $180k |
| R4 User scope changes | 40% | $300k | $120k |
| R3 Design coordination gaps | 60% | $140k | $84k |
| R6 Trade price escalation | 50% | $160k | $80k |
| R5 Permit approval delay | 25% | $200k | $50k |
| Total | $1800k | $714k |
The GAO guide also warns against double counting. If an uncertainty is already built into the estimate's ranges, it shouldn't appear again as a discrete risk. Keep a clear line between estimating uncertainty (how wrong the quantities and prices might be) and discrete risks (events that may or may not happen).
Keeping it alive
A register is only useful if it changes. A few habits keep it current:
- Review it monthly, in a short meeting focused on the top risks, new risks and overdue actions, not a line-by-line read.
- Report it upward. The top five risks, their trend and the contingency position belong in the monthly executive report.
- Close risks deliberately. When a risk passes, close it and release its share of contingency through a formal decision, rather than letting the money quietly fund something else.
- Record what happened. When a risk occurs, note it, move it to the change or issues process, and capture what the register got right or wrong for the next project.
What owners should do
- Cut the register to the risks that matter, written in cause, event, effect form, with one named owner each.
- Define your scoring scales in dollars and weeks for this project, and use the matrix to sort, not to decide.
- Challenge every "mitigate". Ask what the alternatives were, and require a reserve, trigger and plan for anything accepted.
- Put owner-side names on owner-side risks: decisions, scope, funding and approvals.
- Tie the register to contingency, at least through expected value, and through a quantitative analysis on larger projects.
- Review monthly and report the top risks upward alongside the contingency balance.
The bottom line
A risk register is worth the effort only if it changes what people do and what the owner holds in reserve. Keep it short, specific and owned, connect it to contingency and the schedule, and review it every month. A register that never changes isn't tracking risk. It's documenting the start of the project.
Want an independent look at your risk register and contingency? Book a 30-minute call with Benjamin R. Consulting.
Sources: Graves, R., Qualitative risk assessment, PM Network (PMI, 2000); Osundahunsi, A., Effective project risk management using the concept of risk velocity, agility, and resiliency (PMI Research and Education Conference, 2012); MPUG, Why "mitigate" is the most dangerous word on your risk register; U.S. GAO, Cost Estimating and Assessment Guide: Cost Risk Analysis with Risk Drivers. The worked example is illustrative. This article is general information, not financial or legal advice. Get legal advice on your contract and specific circumstances.