Most risk registers die two weeks after kickoff ā a spreadsheet filled in for the audit, never opened again. A working register is different: it drives decisions, owns money (contingency), and changes as the project changes.
The minimum useful columns
| Column | Why it matters |
|---|---|
| ID & title | Traceability |
| Cause ā Risk ā Effect | Forces clear thinking: "Because of X, Y may occur, leading to Z" |
| Probability (1ā5) | Likelihood before response |
| Impact (1ā5) | On cost, time, quality, safety ā score the worst |
| Score (PĆI) | Ranking |
| Response strategy | Avoid / Transfer / Mitigate / Accept |
| Response actions & owner | A named person, not a department |
| Post-response P & I | Shows whether the response is worth its cost |
| Status & review date | Keeps it alive |
Scoring: the 5Ć5 matrix
Define the scales in project terms, not adjectives. For a ā¹50 crore project, impact might be: 1 = under ā¹5 lakh, 3 = ā¹25ā75 lakh, 5 = over ā¹2 crore (and equivalent bands for schedule days). Without calibrated scales, "high" means whatever the loudest person says.
Scores of 15ā25 need active mitigation and management attention; 8ā12 need monitoring and a contingency allowance; below 8, accept and watch.
The four response strategies (threats)
- Avoid ā change the plan so the risk can't occur (redesign, re-sequence, different method).
- Transfer ā insurance, bonds, back-to-back subcontract terms. The risk still exists; someone else pays.
- Mitigate ā reduce probability or impact: early procurement, trial pits, prototypes, extra QA.
- Accept ā for low scores, document and move on. Active acceptance sets aside contingency.
Opportunities mirror these: exploit, share, enhance, accept.
Quantifying: from register to contingency
Expected Monetary Value (EMV = probability Ć impact) summed across the register gives a first-cut contingency. Better: run a Monte Carlo simulation on the cost and schedule models so correlation and ranges are handled properly ā point EMVs understate tail risk.
Keeping it alive
- Review top-10 risks in the weekly meeting ā five minutes, scores and actions only.
- Full register review monthly, retiring dead risks and adding new ones.
- Tie drawdown of contingency to specific register entries ā money leaves when a risk realises, not silently.
- Track realised risks vs register at close-out; it's the best calibration data you'll ever get.
Start with our free Risk Register template ā pre-built with the columns and matrix above.