Case: the launch risk register

The case starts where Risk, issue, assumption or dependency? left off: a real list, written by six people, with nobody's name next to any line. The first job is to sort before you score.

The test for each line is the same. True today? An issue: R10 (the diagnostic test has 40 questions and the spec says 60), R15 (booking by subject shows physics tutors under math), R32 (the illustrator invoice is unpaid and the drawings are on hold). A belief the plan rests on? An assumption: R13, each vetted tutor can take about 15 new learners. Work you wait for? A dependency: R26, demo lessons wait for Vira's final curriculum. A possible future event with a consequence? A risk: R22, a vetted tutor may leave in January for a school job.

Across the whole list the result is stark: 18 issues, 7 assumptions, 6 dependencies and only 9 risks, 22.5 % of the forty lines.

One of the nine "risks" in the raw list is R34: "Something may go wrong with the platform." It names no cause, no event and no consequence, so it can't be scored: any probability or impact you gave it would be invented.

There are only two honest moves. If a real risk sits behind the worry, rewrite it as cause, event and consequence. Here the likely candidate is the contractor building checkout for a release in January, and that may already be R35, in which case R34 is a duplicate. If nothing concrete sits behind it, drop it.

Keeping it "to cover anything the other lines miss" is tempting and useless: a catch-all line gives nobody anything to watch and makes the list look more complete than it is. The real gaps, as the case shows next, are specific risks nobody wrote at all.

With the nine risks sorted out, score them on the written scales: probability from rare 5 % to likely 80 %, impact in working days or in UAH, and exposure = probability × impact, compared only within one unit.

Six risks have an impact in days:

• R35, the contractor's release is late: possible, 0.5 × 10 = 5.0 days;
• R14, Vira's review slips: 0.5 × 7 = 3.5;
• R22, a vetted tutor leaves: 0.5 × 6 = 3.0;
• R01, checkout fails the provider's review: unlikely, 0.2 × 10 = 2.0;
• R19, the illustrator is late: 0.5 × 4 = 2.0;
• R37, the provider holds the account: rare, 0.05 × 30 = 1.5.

Together 17.0 days of exposure, against an 11-day buffer. The total isn't a forecast (not all of them will happen), but it shows why the buffer needs watching and where attention pays first: the contractor and the review.

Hanna asked for anything that costs money in UAH, because she can't plan a reserve from "high". Two of the nine risks have a money impact:

• R28, ad prices rise in the January exam season: likely, 0.8 × 30,000 = 24,000 UAH;
• R21, the test places learners at the wrong level: possible, 0.5 × 24,000 = 12,000 UAH.

Together 36,000 UAH of exposure. Set that beside the 50,000 UAH contingency reserve for named risks, and Hanna can see whether the reserve covers what the team expects.

The figure stays apart from the 17.0 days. As Hanna says, don't hand her a single number that mixes them: a day of delay and a hryvnia of overspend aren't the same, and a sum of the two means nothing. Two short totals, each in its own unit, are what the page for Leo carries.

By exposure, R37 comes last: the provider holding the account, rare, 30 days, 1.5 days of exposure. Five slots on Leo's page, nine risks: the obvious cut.

Read the line again, as Hanna does: if the provider holds the account, nobody pays for anything, physics or English, for weeks, in February. Ask the second question from A short risk register people actually use: if it happens, can we still open, or still reach 120 learners? For R37 the answer is no, so it stays in the top five.

Its response is beyond the project's authority: choosing a second payment route is a company decision. So it is escalated with a recommendation. Hanna owns it, and Leo agrees a second payment route before January; as he says, an hour now beats losing February to one email.

Inflating its probability to make it rank higher would falsify the register, and leaning on a contact at the provider isn't a response at all.

A sorted, scored list can still miss the risks that matter most. Read it as a tutor on a February evening, as Vira suggests, and two gaps appear.

Nothing covers outages and air-raid alerts cutting live evening lessons in February. And nothing covers evening slots filling up, although Roman warned that strong tutors teach at schools and are free only after school hours, exactly when families want lessons. Both hit precisely the hours when physics will be taught.

The items that are on the list, such as Vira's review (R14), the provider's review (R01) and a tutor leaving (R22), aren't the gap. The gap is what felt like normal life to everyone who wrote a line.

Add both as full rows: cause, event, consequence, scored on the same scales, with an owner and a response. Danylo can't fix outages in code, but a booking rule that moves a lesson cut by an alert reduces the impact. Roman owns the slots risk, and his confirmed slot count is its trigger.

Some risks are best answered by quality, not money. R21: the diagnostic test may place learners at the wrong level, costing 24,000 UAH of refunds and tutor switches if it happens. Vira spots a link: R10, an issue, says the test still has 40 questions instead of the agreed 60. That issue feeds this risk.

So the two lines get different treatment. R10 goes to the issue list, owner Danylo, fixed this week. R21 stays in the register with a quality response: complete the 60 agreed questions, then have five learners at known levels take the test in January and compare the result with Vira's placement. That lowers the probability before any family sees the test.

The alternatives deal with the failure, not its cause. A 24,000 UAH refund reserve only pays for it. Asking families after the first lesson finds it late. Removing the test drops a deliverable from the brief.

Leo asked for one page he can read on his phone: the five risks that could stop the opening, who watches each, what you do and what tells you it's starting.

One line on the rest: what happened to the other thirty-five lines. 18 issues went to owners on the issue list, 7 assumptions back to the brief with check dates, 6 dependencies into the schedule, and the remaining risks stay in the register. Without that line, Leo can't tell whether problems were dropped.

Five rows, each with an owner, one concrete response and one trigger with a date and a number, including R37 and the two risks the list forgot. Scales on the page and units on every number, days and UAH kept apart. And one line on keeping it alive: fifteen minutes in every weekly status, closing what has passed and adding what's new.

How it fits together: sorting, scoring in units, the catastrophe check, the missing risks and quality responses turn forty lines into a page Leo can act on. The next module runs the work in January, when one of these triggers is going to fire.