5 Risk Registers and Ongoing Monitoring
Learn how to build and maintain a project risk register, monitor changing exposure, coordinate responses, and report risks that need action.
Build a useful
A is a shared, working record of project uncertainties, their possible effects, assessments, owners, and planned responses. It helps the team make decisions and track whether risk exposure is changing. Entries should be added, updated, closed, or transferred as circumstances require.
Write each risk so its cause, uncertain event, and possible effect are distinct. One useful pattern is: “Because of [cause], [event] may occur, resulting in [effect on an objective].” Clear statements make risks easier to assess and help the team choose relevant responses.
Keep entries concise and current. A focused register tied to project decisions and plans is more useful than a long list of vague risks or completed actions without owners and dates.
Record assessments, ownership, and responses
Record enough information to support action and decisions. Common register fields include:
ID and description: A unique identifier and a clear cause–event–effect statement.
Category and affected objective: For example, schedule, cost, quality, safety, or benefits.
Likelihood, impact, and priority: Use the project's agreed rating scale, and record the basis for an estimate when helpful.
Owner: Identify the accountable for monitoring the risk and coordinating its response.
Response and actions: Record the chosen approach, specific tasks, action owners, and due dates.
and contingency: Record observable warning signs, thresholds, or events that prompt a response.
Status and trend: Note whether the risk is open, triggered, realized, or closed, and whether exposure is rising, stable, or falling.
Review date and notes: Record the latest assessment, decisions, and any escalation.
A is an observable sign that a risk may be approaching or has occurred. It indicates when to review or activate a response. Make triggers specific enough to check: “supplier has not confirmed shipment by 15 May” is more specific than “supplier delay.” Record who will watch for the and what that person should do if it appears.
Turn the chosen response into trackable actions. Each action needs an owner and target date, and its status should be updated during reviews. The oversees the risk and response; action owners complete particular tasks. If a response is late or ineffective, reassess the risk and decide whether to change the plan or escalate it.
Example register entry
Risk: Because the supplier has not yet completed qualification, a shipment may arrive late, delaying system testing.
: Qualification is still incomplete four weeks before the planned shipment date.
Owner: Procurement lead.
Response action: Confirm qualification milestones weekly; prepare an approved backup supplier.
and due date: Procurement analyst; backup-supplier review due 1 June.
Monitoring note: Qualification remains incomplete; exposure has increased. Escalate if the is reached.
Monitor changing risk exposure
Risk review is ongoing, not a one-time exercise. At planned intervals and when significant changes occur, check whether each risk is still valid, whether new risks have emerged, whether triggers are near or reached, and whether actions are on track. Reassess likelihood and impact using the same agreed criteria so changes are meaningful. Check whether responses are reducing exposure; revise them if they are not. Close a risk when it no longer needs active management, and document why.
Set review frequency to suit the project's pace, uncertainty, and risk level. High-exposure or fast-changing risks may need frequent checks; other risks can be reviewed less often. Include risk review in regular project meetings and reassess at significant milestones or phase changes.
A risk that has happened is now an : record and manage the actual problem, while retaining any remaining uncertainty as a risk if appropriate.
Report risks and escalate decisions
Risk reporting should help people act rather than merely repeat register entries. Summarize the most significant risks, changes in exposure, triggers reached or approaching, overdue or ineffective responses, decisions needed, and risks that exceed agreed tolerance.
Escalate risks when they require authority, resources, or decisions beyond the project team. Share updates with people who own responses and those responsible for project decisions, while keeping the register accessible as the common record.
A useful register connects clear risk statements to assessments, owners, triggers, and dated response actions. Regular review, updates to exposure and response status, appropriate escalation, and clear reporting keep risk management connected to ongoing project work.