Project risk management is not about predicting every problem before work begins. It is a practical way to recognise uncertainty early, make informed decisions and give the project team a clear response when conditions change.
Risks can affect scope, time, cost, quality, people, suppliers, technology, safety and stakeholder confidence. A useful process keeps these risks visible without turning the risk register into paperwork that no one uses. This approach can be adapted to many workplace projects.
Free project risk register template in Excel
Download an editable risk register for a small workplace project. It includes a blank register, three fictional examples, rating and status lists, action owners, due dates, review dates and residual risk fields. No email address is required.
Download the free Project Risk Register (Excel .xlsx)
How to use the risk register
- Save a working copy and enter the project name, register owner and the risk criteria your organisation uses.
- Describe each risk as a cause, uncertain event and possible effect. Record existing controls before assigning likelihood, consequence and the current rating.
- Give each response an action owner and due date, then agree a trigger, contingency and review date.
- Review whether controls worked, record the residual rating and keep decisions up to date.
Ratings are entered manually using your organisation’s approved definitions. The example ratings are illustrative; adapt the dropdown labels if your organisation uses different categories. This general project register does not replace a required WHS risk assessment or specialist process.
Example entry
| Field | Fictional example |
|---|---|
| Risk | Reviewers may respond late, delaying the induction guide launch. |
| Response and owner | The team leader sends an early draft and confirms a backup reviewer. |
| Trigger and review | No comments by 5 October: escalate to the sponsor. Review on 6 October. |
Connect treatment actions to your project plan and task tracker, or browse all free workplace templates and checklists.
1. Start with the project objectives and context
A risk only makes sense in relation to an objective. Before identifying risks, confirm what the project is expected to deliver, the important deadlines, the available budget and resources, the quality requirements and the people who can approve decisions.
Then consider organisational priorities, legislation, internal policies, customer expectations, supplier arrangements, technology dependencies and competing work. The Australian Government’s guidance on making a risk management plan recommends deciding what matters most and consulting stakeholders before analysing and treating risks.
For a workplace project, useful context questions include:
- What result must the project achieve, and how will success be confirmed?
- Which deadlines, costs or quality requirements have limited flexibility?
- What assumptions does the current plan depend on?
- Which decisions sit within the project manager’s authority, and which require escalation?
2. Identify risks with the people closest to the work
Risk identification is stronger when it includes the people who understand the work, not only the person managing the project. Team members, customers, subject matter experts, suppliers and other stakeholders may each see different threats, dependencies and opportunities.
Review the scope, schedule, resource plan, budget, quality requirements, stakeholder expectations and lessons from earlier projects. Ask what could prevent each deliverable from being completed as planned. It can help to scan several categories, such as:
- scope and requirements;
- schedule, approvals and dependencies;
- budget, procurement and suppliers;
- people, capability and availability;
- quality, systems, data and information security;
- communication and stakeholder expectations; and
- work health and safety, legal and organisational requirements.
Write each risk so that other people can understand it. A simple structure is: because of a cause, an uncertain event may occur, which could affect an objective. For example: “Because the approval group meets only once a month, final review may be delayed, which could move the implementation date.” This is more useful than a vague entry such as “approval risk”.
3. Analyse likelihood and consequence
After identifying risks, assess which ones require attention. Many organisations use a likelihood-and-consequence matrix. The purpose is not to create false precision; it is to apply an agreed method consistently enough to compare risks and set priorities.
Consider the likelihood of the event, the possible consequence for project objectives and the effectiveness of controls already in place. Use the organisation’s approved definitions and risk criteria where they exist. Record assumptions and seek specialist advice when the consequence could be serious or the team lacks reliable information.
Prioritisation matters because projects rarely have enough time or resources to treat every uncertainty in the same way. High-priority risks should have timely decisions, visible ownership and clear escalation arrangements. Lower-priority risks may only need monitoring.
4. Select a proportionate response
For each priority risk, decide what action is appropriate and who can approve it. Common responses include:
- Avoid: change the plan so the threat no longer applies.
- Reduce: lower the likelihood, the consequence or both.
- Share or transfer: allocate part of the exposure through contracts, insurance or specialist support, while recognising that accountability may remain with the organisation.
- Accept: consciously retain the risk, usually with monitoring, a trigger and a contingency response.
A response should be specific enough to implement. Record the action, responsible person, due date, resources, expected change to the risk rating and evidence that will show the action is complete. Where the response changes scope, cost, schedule or quality, use the project’s approval and change-control process.
5. Assign a risk owner and an action owner
A risk owner is responsible for monitoring the risk, coordinating the response and escalating it when required. An action owner is responsible for completing a particular treatment activity. These may be the same person, but they do not have to be.
Confirm that each owner understands the responsibility and has enough authority, information and time to act. If an important risk has no appropriate owner, escalate it to the project sponsor.
6. Connect the risk register to the project plan
The risk register should influence everyday project decisions. A supplier risk may require an earlier procurement milestone. A resource risk may require cross-training. A technical risk may require a prototype or additional testing. A stakeholder risk may change the communication plan.
Link treatment actions to the schedule, budget and responsibility assignments so they are managed as real work. If you are still defining these project controls, see our guide to building a practical project plan for the workplace.
Keep risks and issues separate. A risk is uncertain; an issue has already occurred. When a risk event happens, move or copy the relevant information into the issue-management process, activate the agreed response and assess the effect on project objectives.
7. Monitor triggers, changes and response effectiveness
Risk management continues throughout the project. Review priority risks at a frequency that matches the pace and exposure of the work. A short review can confirm:
- whether the likelihood or consequence has changed;
- whether response actions are complete and effective;
- whether any agreed trigger has occurred;
- whether a risk should be escalated, converted to an issue or closed; and
- whether changes have created new risks.
Use evidence such as schedule updates, quality results, incident reports, supplier information, stakeholder feedback and change requests. Record why a closed risk is no longer relevant or has reached an accepted level.
What to include in a practical risk register
The format should suit the size and complexity of the project. A practical register commonly records:
- a unique reference and date identified;
- a clear cause-event-impact description;
- the project objective or category affected;
- existing controls;
- likelihood, consequence and current rating;
- the selected response and treatment actions;
- risk owner, action owner and due dates;
- triggers, escalation thresholds and contingency actions;
- review date, status and residual rating; and
- notes about decisions or lessons learned.
A smaller register that is current and discussed is more valuable than a long register copied from a template and rarely reviewed.
WHS risks require the correct workplace process
General project risk management does not replace an organisation’s work health and safety duties. Safe Work Australia describes a WHS risk management process of identifying hazards, assessing risks where necessary, controlling risks and reviewing control measures, with consultation at each step. Its guidance also states that elimination is the best control and, where elimination is not possible, risks must be minimised so far as is reasonably practicable.
Project teams should follow the WHS laws, regulator guidance, policies and approved procedures that apply to their workplace and jurisdiction. Refer to Safe Work Australia’s risk management guidance and seek competent advice where required.
Common risk management mistakes
- Using vague labels: describe the cause, uncertain event and possible effect.
- Listing risks without action: connect priority risks to owners, dates and project work.
- Ignoring existing controls: assess what is already operating before deciding what else is needed.
- Confusing risks with issues: manage problems that have already occurred through the issue process.
- Reviewing only at the start: update risks when assumptions, scope, suppliers or conditions change.
- Keeping the register private: involve the people who can identify changes, implement responses and make decisions.
Developing project risk management capability
Risk management becomes more useful when it is integrated with scope, schedule, cost, quality, communication and governance rather than treated as a separate administrative task. The nationally recognised unit BSBPMG536 Manage project risk covers identifying, analysing, treating and monitoring risks that may affect project objectives.
To explore structured learning across these connected project management areas, review the BSB50820 Diploma of Project Management. You can also learn how online study works at WorkForward, browse more Career Resources, or contact the WBS course advice team for current course information and entry requirements.
This article provides general educational information. It is not legal, safety or professional advice. Project methods, workplace procedures and legal requirements vary. Confirm the requirements that apply to your organisation, jurisdiction and project.