The Project Risk Register Nobody Uses
A utility's capital program has 14 active projects worth $900 million. Each project maintains a risk register in a spreadsheet; the corporate risk function compiles them quarterly into a 60-page report. A post-implementation review of a $120 million substation project found that its two largest overruns-a 9-month permitting delay and a 22% steel price increase-were both listed in the register but rated low and never escalated. Project managers say the register is a compliance artifact completed for the gate review; the corporate report is read by no one on the executive team. The board's audit committee has asked why risk management is not preventing overruns. The chief risk officer must respond with a redesign proposal within a month.
1. Diagnose why the risk registers failed to influence outcomes, and what the redesign must change.
Read the worked answer
The registers did not fail for lack of content; they failed at three points: assessment, escalation, and use.
Assessment: the two risks that materialised were rated low. That suggests scoring was done by rote-probability times impact, no scenario thinking, no reference to comparable projects. A 9-month permitting delay on a substation is not a low-probability event in most jurisdictions; a 22% steel move is within historical range. The redesign must require evidence-based assessment: what would cause this, what is the early warning, what is the range of impact, and what is the basis for the rating.
Escalation: even correctly listed, risks stayed local. There was no threshold or trigger that forced a project-level risk onto the program or executive agenda. The redesign needs defined escalation criteria-for example, any risk with potential schedule impact over 60 days or cost impact over a set percentage goes to the program board with an owner and a response plan.
Use: the register was a gate-review artifact and the corporate report was unread. A risk process that exists to satisfy a checkpoint will be completed minimally. The redesign must tie the register to decisions the project actually makes-contingency sizing, schedule float, procurement strategy-and to a short executive report of top program risks with owners and trends, not a 60-page compilation.
Finally, accountability: name risk owners who are senior enough to act, and review the top risks at the same forum that approves changes.
2. The CRO has one month and limited authority over project managers, who report through the delivery organization. What should the redesign proposal prioritise to be credible and achievable?
Read the worked answer
With one month and no line authority, the CRO should propose a small number of high-leverage changes and demonstrate value quickly rather than launch a large framework.
Prioritise a single program-level risk view: the top ten risks across the 14 projects, each with an owner, a rating with its basis, an early-warning indicator, and a response. This replaces the 60-page compilation and gives the executive team something it will actually read. Getting the executive to use it once is the credibility test.
Introduce escalation triggers tied to the change-control process project managers already respect. If a risk crosses a threshold, it must appear in the change request. This embeds risk in a decision they cannot avoid, without requiring new governance.
Pilot evidence-based assessment on two or three projects, ideally ones with visible overrun exposure, and show the difference between a scored guess and a scenario-based rating. Use the substation post-implementation review as the case study.
Build the coalition: the delivery director and finance must co-sponsor, because the triggers and contingency sizing affect their decisions. The CRO should present the proposal jointly where possible.
Finally, set measures-percentage of top risks with named owners and current indicators, escalation timeliness, and whether contingency draws match assessed risks-and report them to the audit committee quarterly. Commit to a review in six months rather than claiming the redesign is complete.