Purpose of a risk register: Here's what a risk register is used for
What is a risk register?
A risk register (which can sometimes be referred to as a risk log) is a project management tool which helps managers and companies document risks, track risks and address them through preventative controls and corrective actions.
A risk register is typically created at the start of a project (before it begins), and is regularly referenced and updated throughout the life of a project through deliberate risk monitoring and control.
Almost all project based companies - especially those in heavy industries like constructions, oil and gas, mining etc. - because managing risk is a major part of delivering any project on time and on budget, and because the risk register is the ultimate source of truth for understanding and assessing risk.
The purpose of a risk register
The main purpose of a risk register is to serve as the database for specific risks. These risks might be safety risks, commercial risks, financial risks, environmental risks and more - and you may have specific registers for each type of risk - or consolidate more than one functional risk into a general project management risk register.
The risk register enables a project manager or company to list all possible or potential risks into rows, and then identify and outline important components of these risks in the associated columns.
The purpose of a risk register does evolve slightly during the course of a project too. At the start of a project, it's purpose is to provide a brainstorming framework whereby the project manager and other managers and stakeholders can come together and establish risks.
The key part of this initial analysis centres on 'scoring' and prioritising the outlined risks. For most risk registers, this involves scoring each risk on two major dimensions:
- The likelihood of that risk turning into an incident
- The severity of the incident should that risk become a reality
Understanding these two dimensions helps companies to prioritise which risks need to be addressed or monitored more closely. If the likelihood of a risk turning into an incident is high and the severity is also high, then the company will look for corrective actions and controls which serve to mitigate the chance of it occurring or reduce the severity in the case of an incident.
During the course of a project, the risk register is more of a reference point and live document which needs to be updated with new risks. Those risks will once again be assessed and then dealt with accordingly.
And at the end of a project, the risk registers purpose shifts slightly again and becomes more about assessing how well the risks were 'assessed' at the beginning of a project; was the likelihood of each risk accurate (did it actually occur), and was the severity of that risk or accident correctly estimated (how bad was it).
As you can see, the purpose of a risk register is important from project start to finish.
What does a risk register look like?
Now that we know what the purpose of a risk register is, we can take a look at what an actual risk register looks like (this is a proven risk register template)
This specific risk register is looking at the general and 'macro' level risks associated with the running and managing of the project.
We also have examples specifically for construction, mining, oil and gas and building here.
The reason that risks are placed and displayed in a register is that the register serves as a great and digestible framework for listing each risk and its associated properties.
As you can see from this example, each risk in this register lists the:
- Description of the risk
- The impact that the risk can have on a project
- Related function for that risk (if it is multi-functional)
- An assessment on the likelihood and severity of each risk
- The resulting 'grade' of this assessment which is scored using a risk matrix
- The date of the last risk review (for that specific risk) and the result of that review (to see if the risk score has got better or worse - if you have made improvements or done nothing)
- The mitigating actions which will be taken to reduce the likelihood or severity of that risk
You'll notice that there are is a number of columns or sections for the risk score and mitigating actions.
It's incredibly important to score your risks appropriately, and then create mitigating actions which get actioned. Documenting who is responsible for the mitigating actions as well as when those actions will be 'complete' is a great way to keep everyone honest and ensure risks are properly managed.
The best way to destroy the the purpose of a risk register is to make a tick and flick exercise or document which gets created and then filed away. It should be an actionable document which informs decision making.
Use this smart risk register for free now.
Connecting your project management risk registers to what's happening on site in real-time
Many companies create and maintain their risk registers using excel and other spreadsheet tools. This works quite well at the beginning of a project, when the risk register isn't being updated based on new and evolving site risks, and when it is being updated and managed by the one or two people responsible for this part of project planning.
The major problems of using rigid spreadsheets for your risk register arise when the project begins, when a project manager or administrator is being inundated with new risks and information which have been documented on word docs and PDFs and need to be transferred to the register.
This requires a lot of manual data entry and admin, and also increases the chance that information is going to be inaccurate and out-of-date.
To solve this problem, many companies today are using tools which connect the site and in the office in real-time. What does this look like?
Instead of documenting new and evolving site risks using paper or PDFs, workers today can use an electronic device like a mobile or tablet. This is great, because it reduces paperwork, but the real value comes from what happens when all of this data is organised and stored in a register format.
Once a site worker documents a risk or hazard, that risk or hazard is automatically synced to the system which houses the risk register. If the risk is associated with specific activity, then that activity's risk register will be updated automatically - so you'll have a new row with all of it's properties automatically.
If it's from a different functional risk, then you (or a designated project manager) will receive a notification about the new risk automatically, which enables them to make a call as to whether the master register should be updated.
In addition, all of your risk register records stay stored and searchable online, and all of them can also be exported when required.
As an additional bonus, you can even track how many risks are arising on certain projects, the type and severity of the risks being identified and more using real-time analytics which aggregate and display all of that real-time information.
For obvious reasons, this type of control and functionality is dramatically more effective than a simple register spreadsheet - and can really enhance and boost the quality of risk identification and assessment on your projects - which is the true purpose of a risk register.
People in 80+ countries use this software to better manage safety, commercial, financial and other risks.