Risk register
Every project keeps a risk register. It is a simple list that makes risks visible early, so they can be handled before they become problems.
What goes in the register
| Field | What to write |
|---|---|
| Risk | One sentence describing what could go wrong |
| Cause | Why it might happen |
| Likelihood | 1 (unlikely) to 5 (almost certain) |
| Impact | 1 (minor) to 5 (severe) |
| Score | Likelihood multiplied by impact |
| Owner | One named person responsible |
| Response | What you will do: avoid, reduce, accept or hand over |
| Review date | When it will next be looked at |
Scores and what they mean
| Score | Level | What to do |
|---|---|---|
| 1 to 7 | Low | Monitor |
| 8 to 14 | Medium | Plan a response |
| 15 and above | High | Raise it in the weekly status report and with your delivery manager |
When to review
- Review the register every week, in time for the status report due 17:00 on Thursday.
- A high risk appears in the report's escalation section; it can turn the project amber or red.
- Add new risks at any time, especially when a change request is accepted; see Change requests.
Typical risks at Northwind
- A key person is unavailable (leave, illness).
- A customer is slow to accept a deliverable. For Acme, the acceptance window is 10 business days.
- A release lands near a freeze period; see Release process.
- Data residency, for example Orion Energy data must stay in the US.
Closing the project
Move open risks into the lessons learned during the closing phase; see How we run projects.
Owner: Henry Brandt - Last updated: 2026-09-14