I sometimes wonder whether the humble Risk Register has become one of the most misunderstood documents in project management.
Not because it’s difficult to understand. Quite the opposite. It’s actually a very simple idea. The trouble is that somewhere over the years we’ve managed to convince ourselves that producing a Risk Register is the same thing as managing risk. It isn’t. Creating the document takes minutes. Using it properly throughout the life of a project is where the real value lies.
Let me explain what I mean.
I’ve reviewed plenty of projects where the Risk Register looked absolutely magnificent. It was colour coded, every column was completed, every risk had a number, and somebody had obviously spent hours making it look professional. Then I would ask a simple question.
“When did the team last sit down and discuss it?”
The answer was often an uncomfortable silence.
That silence tells me almost everything I need to know.
A Risk Register isn’t there to impress an auditor or satisfy a project methodology. It’s there to help you make better decisions before problems appear. If it isn’t changing the conversations your team is having every week, then it isn’t doing its job, no matter how attractive the spreadsheet looks.
So, if you’re creating a new Risk Register, or perhaps wondering why your existing one seems to gather more dust than useful information, let me suggest a different way of looking at it.
Forget Excel for a moment.
Seriously.
Don’t start by opening a spreadsheet because that’s where many project managers go wrong. Risks don’t begin life in spreadsheets. They begin life in people’s heads. They start as that little nagging doubt somebody has but hasn’t quite voiced yet. They start with the engineer who’s quietly wondering whether two systems will integrate properly, or the procurement manager who’s beginning to lose confidence in a supplier, or the business representative who’s worried that users haven’t really bought into the change.
That’s where your Risk Register starts.
So instead of asking your team to “identify project risks”, try asking a different question.
“What could stop us achieving what we’ve set out to do?”
It’s a subtle change, but it completely alters the discussion.
People stop thinking about filling in a document and start thinking about the project itself. Before long you’ll hear comments such as, “I’m a bit worried about…”, or, “Have we considered what happens if…?” That’s exactly the conversation you want because now you’re uncovering genuine concerns instead of writing theoretical risks that nobody really believes will happen.
Only once you’ve had that conversation would I begin writing the Risk Register.
Keep it simple.
One of the biggest mistakes I see is trying to capture every possible detail. Before long the document becomes so complicated that nobody enjoys updating it. In my experience, simplicity nearly always wins. Describe the risk in plain English so that anybody joining the project can understand it immediately. Then write down why it matters. If it happened tomorrow, what effect would it have on the project? Would it delay delivery? Increase costs? Reduce quality? Affect customer confidence?
Now comes the most important question of all.
“So what are we going to do about it?”
This is where risk management either comes to life or quietly dies.
Far too many Risk Registers identify problems without ever deciding what action will be taken. That’s rather like visiting your doctor, being told you have high blood pressure and then walking out without discussing treatment. Identifying the problem is only the beginning.
Sometimes the right answer will be to reduce the likelihood of the risk happening. Sometimes you’ll prepare a contingency plan so that, if it does occur, everybody already knows what to do. Occasionally you’ll decide that the risk is so small it simply isn’t worth spending time or money trying to eliminate it.
There’s nothing wrong with accepting a risk.
There is something wrong with accepting it by accident.
Every significant risk deserves a conscious decision.
While we’re talking about significant risks, let me mention another lesson that has served me well over the years. Never leave an important risk without one named owner.
Notice I said one.
Not the Project Team.
Not Engineering.
Not Procurement.
One person.
That doesn’t mean they’re responsible for causing the risk. It simply means they wake up every morning knowing they’re the person keeping an eye on it. If circumstances change, they’re the first to say, “I think we need to look at this again.”
It’s amazing how often that one simple habit prevents risks quietly drifting out of sight until they suddenly become tomorrow’s crisis.
Talking of crises, let’s clear up another area that causes endless confusion.
A risk is not the same thing as an issue.
People often use the words interchangeably, but they’re describing two completely different situations.
A risk is something that might happen.
An issue is something that already has happened.
Why does that matter?
Because the conversation changes completely.
When you’re discussing a risk you’re asking, “What can we do now to stop this happening?”
When you’re discussing an issue you’re asking, “How do we recover from what’s already happened?”
If you mix the two together, your project meetings become muddled because half the room is trying to prevent problems while the other half is trying to solve them.
Keep them separate and your thinking becomes much clearer.
Another temptation is to produce the longest Risk Register in the organisation. I’ve seen registers containing well over a hundred risks and, if I’m honest, I don’t think anybody understood half of them. A shorter register containing the ten or fifteen risks that could genuinely derail your project is far more valuable than pages of remote possibilities that will never be discussed.
Remember, the purpose isn’t to prove how many risks you’ve identified.
The purpose is to prevent unpleasant surprises.
Finally, don’t file the Risk Register away until the next monthly review.
Bring it into your conversations.
Every time the team meets, ask yourselves whether anything has changed since the last discussion. Has a new supplier concern appeared? Has a technical problem become more likely? Has one of your mitigation actions worked so well that a risk can now be downgraded? Has a risk become an issue and therefore moved into the Issue Log?
Those discussions are where the real value lies.
The spreadsheet simply records the outcome.
If I could leave you with one thought, it would be this.
Don’t judge your Risk Register by how many rows it contains.
Judge it by how many problems never happen because your team spotted them early enough to do something about them.
That’s what good risk management looks like.
Not predicting the future.
Being ready for it.
Monday Morning
Here’s something I’d genuinely encourage you to try this week.
Don’t start your next project meeting by opening the Risk Register.
Start by asking everyone in the room one simple question.
“What is worrying you most about this project today?”
Let the conversation flow naturally. Don’t interrupt it and don’t rush people. When everyone has spoken, open your Risk Register and compare it with what you’ve just heard.
If your team has raised concerns that aren’t in the register, add them.
If the register contains risks that nobody is worried about anymore, review them.
I think you’ll find that fifteen-minute conversation does more to improve your project’s chances of success than another hour spent tidying a spreadsheet.
Over to You
I’d love to hear how your organisation approaches risk management.
Is your Risk Register something the team genuinely uses to make better decisions, or has it gradually become another document that’s only updated because the process says it should?
Leave a comment below and share your experience. The best ideas in project management nearly always come from practitioners comparing notes rather than simply reading another textbook.
Learn More
If practical project management is what you’re looking for, rather than theory for theory’s sake, you’ll find a range of online courses at Projex Academy covering PMP, PRINCE2, APM PMQ, Scrum and other recognised project management disciplines. My aim has always been to help project managers apply techniques confidently in the real world, because that’s where projects succeed or fail.
