The Register Nobody Owns
A 14-month systems replacement project has just completed its second gateway review. The project manager maintains a 180-line risk register in a spreadsheet. Of these, 96 risks are marked 'low', 61 'medium', 18 'high' and 5 'critical'. The register was last updated 11 weeks ago. The risk owner column is populated for 40% of entries, with the same three names repeating. The project board receives a one-page summary showing only the count of risks by rating, and the summary has shown '18 high' for four consecutive months. Two of the five critical risks relate to a supplier whose contract expires in month 9. When challenged, the project manager says the register is 'a compliance document for the PMO' and that real risk thinking happens in the weekly team stand-up. The PMO audits registers quarterly against a template checklist.
1. Assess the extent to which this project has a functioning risk management framework as opposed to a risk register. Justify your assessment with reference to the specific evidence in the scenario.
Read the worked answer
A framework is the set of interlocking processes, roles, and decision rights that cause risk information to change decisions. A register is one artefact within it. The evidence here points to an artefact without a framework:
Evidence of a broken framework
- No ownership: 60% of entries have no owner, and the 40% that do are concentrated in three people - ownership is nominal, not accountable.
- No currency: 11 weeks without update on a 14-month project means the register cannot reflect the current risk profile. The static '18 high' for four months is a symptom: a live profile would move.
- No escalation path: two critical supplier risks with a month-9 contract expiry are not visibly driving board action; the board sees counts, not content.
- Wrong purpose: the PM is explicit that the register exists for PMO compliance. That inverts the framework - the register should serve decisions, and the PMO audit should test decision quality, not template completeness.
- Disconnected practice: risk thinking happens in stand-ups but does not feed the register, so the register is not the single source of truth.
Verdict: the project has a reporting artefact and a compliance control, not a risk framework. The stand-up conversation is the only live risk process, and it is invisible to governance.
2. The PMO proposes tightening the quarterly audit to check that every register line has an owner, a date, and a response. Explain why this intervention is likely to fail, and propose two alternative interventions that would strengthen the framework.
Read the worked answer
Why it will fail: the audit would reinforce exactly the behaviour causing the problem. The PM already treats the register as a compliance document; adding more compliance checks makes the register more of a tick-box exercise and gives no reason for anyone to use it. Filling owner and date fields mechanically would produce 180 lines of plausible-looking data with no decision value - the same failure mode as the static '18 high' count. Audits test conformance to a template; the defect is that the template is disconnected from decisions.
Better interventions
- Make the register a decision input at the board. Replace the count summary with a short 'top risks and what we are asking the board to decide' paper. Each critical/high risk must state the decision or resource needed. This creates demand-pull: the board asks questions, the PM must keep the register current to answer them.
- Assign accountable owners at the right level. Critical and high risks owned by named individuals with authority to act (not three overloaded people), with a defined review cadence tied to the risk's velocity. The two supplier risks should be owned by whoever holds the supplier relationship, with a contract-expiry action plan.
Supporting change: shift the PMO audit from template completeness to sampling - pick three high risks and ask the owner to explain the current position and next action. That tests whether the framework is alive.