A short risk register people actually use

A risk register answers "which ones matter?" with one row per risk: the statement (cause, event, consequence), probability, impact, owner, trigger and next action. No more columns than people will fill in.

The first column already causes trouble. Danylo marked the contractor being late as "likely", and so did Vira for her review. Same word, same worry? No: for Vira "likely" meant almost certain, for Danylo one in three.

So the scale is written down at the top of the register, and everyone picks from the same four: rare 5 %, unlikely 20 %, possible 50 %, likely 80 %.

The percentages aren't measurements; they are still judgment. Their job is to make the words mean the same thing for everyone who scores a risk, so the conversation is about the risk, not about vocabulary. They start the discussion rather than replace it.

Impact needs a unit, and the best units are the ones the project already counts. Days: working days of schedule lost if nothing is done. Money: extra UAH against Hanna's 600,000 ceiling. Write both definitions at the top of the register, next to the probability scale.

Then risk exposure is probability times impact, an expected loss you can rank. Vira's review: possible, 50 %, times 7 days lost = 3.5 days. Danylo's rescored risk, "because the contractor works for two other clients, his checkout release may come late": possible, 50 %, times 10 working days = 5 days.

Keep the two numbers apart in your head. 10 days is the impact, what you lose if it happens. 5 days is the exposure, the average loss across all the ways things might go. 0.5 alone is just the probability. Ranking by exposure tells you where attention pays off first.

Money risks work the same way as schedule risks: exposure = probability × impact in UAH. Hanna's ad risk is likely, 80 %, times 30,000 UAH of extra spend = 24,000 UAH.

The tempting next step is to add it to Vira's 3.5 days to get one total. Don't. Days rank with days, and money with money. A day of delay and a hryvnia of overspend aren't the same thing, and a sum of them means nothing. Keep two short rankings, or convert one into the other only with an explicit, written rate that the sponsor agrees to.

The second trap is worse: multiplying a 1-to-5 score by a probability and calling the result money. "Impact 4 × 50 % = 2" is a number with no unit, and treating it as hryvnias or days turns a guess into a fake figure. If impact is in days or money from the start, this mistake can't happen.

Ranking by exposure has one blind spot. Hanna adds a risk: the payment provider may hold Klasna's account while it reviews a new product line. Rare, 5 %, times 30 days = 1.5 days: the bottom of the list.

But exposure is an average over many imagined projects, and you run only one. If the hold happens, nobody buys any package, physics or English, for weeks. February is gone, and no average helps.

So after ranking by exposure, ask one more question of every row: "If this happens, can we still open, or still reach the result?" Any "no" stays on the short list, whatever its exposure, and gets a response, such as a second payment route agreed in advance.

This is the risk version of a familiar rule: never hide a catastrophic low-probability event behind an average.

Every row needs one owner, and the right owner isn't the most senior person or whoever raised the risk. The risk owner is the person best placed to notice it starting and to act.

For the contractor's late release, that's Danylo: he works with the contractor and sees the test site. For Vira's review, it's Vira. The owner doesn't fix everything alone, but nobody else waits for someone to notice.

A full row for the contractor risk reads: probability possible (50 %); impact 10 working days lost; owner Danylo; trigger "no working checkout on the test site by 4 January"; next action "ask the contractor for a demo of the checkout every Friday". Each column answers a different question: how likely, how bad, who watches, what tells us it's starting, and what we do this week.

Two columns turn a register from a description into a plan.

A risk trigger is an early sign with a date and a number: something anyone can check that says the risk is starting, early enough to act. "Keep an eye on it" isn't one; neither is the event itself. For Vira's review, due by 15 December, a usable trigger is "fewer than 9 of 12 topics reviewed by 8 December": a week's warning, and nobody has to judge anyone's mood.

The next action is what happens this week, before the trigger fires, in one line: "Vira sends topics 1 to 6 to two tutors for a parallel read by Friday." It lowers the chance or the impact now, instead of waiting to react.

Together they answer the questions the sponsor will ask: how will we know, and what are we already doing about it?

A register dies the same way the forty-line list did: it grows until nobody reads it. Three habits keep it alive.

• Keep it short: about ten live risks. Adding every concern anyone mentions "so nothing is forgotten" turns it back into a list where real risks drown.
• One named owner per risk: a row without a name is a row nobody watches.
• Clean it as dates pass: a risk whose date has passed gets closed; a risk that happened becomes an issue with an owner and a fix.

And resist columns. Every scoring method the team has heard of adds a column, and every column is something people must fill in, so they stop filling in any. Statement, probability, impact, owner, trigger, next action: that's enough.

Danylo's test is a good one: fifteen minutes a week he can do; a monthly risk workshop he can't.

A register is only as current as its last review, so put the review on a rhythm people already keep: fifteen minutes each week, inside the written status. Three questions: what fired, what to close, what is new?

Then the status names the top three risks by name, each with its owner and the state of its trigger: "Contractor release (Danylo): demo on Friday worked, trigger 4 January not fired. Provider hold (Hanna): second payment route agreed. Evening slots (Roman): confirmed slots due 10 January." A reader knows in ten seconds what could still break the opening and who is on it.

"Risks: green" says none of that, the whole register pasted in buries it, and a separate monthly meeting reacts weeks too late.

How it fits together: a written scale, impact in days or money, a catastrophe check, owners, triggers and a weekly review make a register people use. The next lesson decides what to do about each risk, finds the ones nobody mentioned with a pre-mortem, and builds quality into the work.