Risk Register & Risk Management

The stale-register pathology

It is built for the kickoff deck. It is populated in a workshop, colour-coded, and screenshotted into a slide. And then it is never touched again — until closeout, when somebody opens it to write the lessons-learned and discovers that most of the risks either happened or became irrelevant, and nobody recorded which.

That register is not a control. It is a talisman: an object whose function is to have been produced. And its existence is worse than its absence, because it allows everyone to believe the risk was managed.

The fix is not a better template. It is a cadence — risk as a standing agenda item, with movement tracked at every review. What is new. What escalated. What was retired, and on what evidence. A register where nothing has moved in three months is not a stable project. It is an unattended one.

And the base rate is not encouraging. Flyvbjerg’s research across more than sixteen thousand capital projects found that only a small minority — around 8.5% — come in on both cost and schedule. That figure is discussed on our capital-planning page, and it is worth reading as a statement about risk management rather than about execution: most of the damage was done before anyone started building.

What a working register actually requires

• Size it honestly — with ranges, not a universal “3×3, medium”. Probability times impact is fine as a sorting device and useless as a number. The top risks need quantifying with ranges, because that is what connects the register to money: contingency should be set against a confidence level, P50 or P80, rather than against a percentage that felt about right. And the drawdown should be tied to risk REALISATION — a materialised, documented risk — which is the control-account doctrine the budget process already runs on.

• Ownership means the person who can act. “The commercial team” owns nothing. A department cannot be chased, cannot be escalated to, and cannot explain why the mitigation is forty days late. A named person with a dated response action can. Risk responses are tasks, and they should be tracked exactly like tasks — which most registers conspicuously do not do, because a task has an awkward habit of being visibly incomplete.

• Choose a response, and say which one it is. Avoid, mitigate, transfer, accept. Four options, and “accept” is a legitimate one that almost never gets written down — because writing it down means somebody has to agree, in advance, to the thing going wrong. That is precisely why it is worth writing down. An accepted risk that materialises is a plan. An unacknowledged one that materialises is a crisis.

• A realised risk becomes a record — with a clock attached. This is the linkage most registers do not have, and it is the expensive one. When a risk lands it becomes an event: a variation, a claim, a notice obligation. Under FIDIC 2017 the notice window is short and it is a genuine time bar, not a formality — and a register sitting in a spreadsheet beside the contract machinery, rather than connected to it, is a register that will watch a risk materialise and serve nothing. The most expensive risk on any project is the one you correctly predicted and then failed to notify.

• The register that only holds threats systematically underprices the upside. Opportunities are risks with a positive sign, and they have owners, actions and dates in exactly the same way — an early-procurement window, a value-engineering candidate, a sequence that could be compressed. A register with no opportunities in it is not being conservative. It is being half-used, and it is quietly telling you that this project has no upside, which is never true.

How registers fail

Built once, never revisited — so the review is a reading, and the risks that mattered were the ones nobody thought of in the workshop.

Everything scored “medium”, so nothing is prioritised and contingency is a round number defended by confidence. Ownership assigned to functions rather than people, so no one is late because no one is responsible.

And the realised risk that nobody notified. The register said it might happen. It happened. And the entitlement that would have followed died in a drawer, because the register was a document rather than a mechanism.

How Zepth runs risk

A living register with owners, responses, review cadences and a full audit trail — where a risk that has not been touched through its own review window flags itself, rather than waiting for someone to notice the silence.

Heatmaps for the conversation, and movement dashboards for the signal: what is new, what escalated, what was retired. Realised risks route into the event, notice and claim machinery rather than sitting beside it. And contingency reconciles against the risks it was actually held for.