A Risk Register That Maps the Meeting, Not the Risk
A regional utility is replacing its billing system. The risk register has 96 entries: 61 were contributed by the IT workstream, 4 by Finance, none by the contact-centre operations manager who will absorb the largest process change, and none by the works council, whose consultation is legally required before any role changes. The last two risk workshops were attended by the same seven people. In an interview you ran, the contact-centre manager said 'nobody asks us anything' and then listed three concrete failure modes in under a minute. The sponsor considers stakeholder engagement complete because the communication plan shows weekly status emails were sent and opened by 84% of recipients.
1. What does the distribution of register entries tell you, and what do you do next?
Read the worked answer
What it tells me: 61 / 4 / 0 is a map of who was in the room, not a map of where the risk is. A register skewed to one workstream is a stakeholder-engagement defect showing up as a data artefact.
- The contact-centre absorbs the largest process change and has zero entries. That is where adoption, retraining and workaround risk lives. Zero entries does not mean zero risk; it means nobody asked.
- The works council carries a statutory consultation obligation. Zero entries means a schedule and compliance risk exists that the register cannot see.
- Same seven people twice means the workshops have become an echo chamber; the marginal new information per session is falling.
- Weekly emails at 84% open rate measure communication output, not engagement. The test of engagement is whether the stakeholder's knowledge has entered the risk process. On that test, engagement with the operational business is at zero.
What I do next:
- Redo the stakeholder analysis with risk-relevant dimensions, not just influence/interest: exposure to impact, domain expertise, control over causes, willingness to speak in a group.
- Targeted elicitation with contact-centre operations - a structured interview or small facilitated session, not another general workshop they must be invited to a third time.
- Register the works council explicitly: a dated consultation milestone in the schedule, plus a risk about consultation outcomes and timing.
- Change the workshop design: rotating invitees by risk category, prompt lists circulated in advance so quieter groups can contribute in writing, and a rule that every RBS category must be represented by someone who does the work.
I would present this to the sponsor as a coverage problem, not as a criticism of the workshops.
2. Set out the risk-engagement approach for the contact-centre manager and the works council, and state how you will know it worked.
Read the worked answer
Contact-centre manager
- A 45-minute structured interview against a prompt list organised by process step (intake, exception handling, billing queries, escalation, training), rather than an open 'any risks?' question.
- Give them ownership, not just a listening session: risk owner for the top two or three operational risks, with a defined response and review cadence.
- Seat them in the monthly risk review, and ask them to nominate two team leads for a pre-mortem on go-live.
- Purpose: convert their operational knowledge into owned risks within two weeks, while their frustration is still actionable.
Works council
- Engage HR and legal immediately; treat this as a compliance dependency, not a stakeholder-nicety.
- Add a schedule milestone (consultation opens by date X, allowing Y weeks before go-live) and a risk covering a delayed or adverse consultation outcome, with a trigger date.
- Track it as a schedule milestone, not only as a register line - a risk line cannot delay a go-live, a milestone can.
How I will know it worked - measures, not vibes:
- Number and quality of new risks contributed per stakeholder group per cycle (a usable risk has a cause, an effect, an owner).
- Proportion of those risks that have an approved response and an owner by the next cycle.
- Whether the ops manager's three failure modes have owners and actions within two weeks.
- Consultation milestone status against the trigger date.
What I will not count as evidence: emails sent, open rates, meeting attendance, or the sponsor's satisfaction with the communication plan.
3. The sponsor says engagement is complete because the emails were sent and opened. How do you respond without simply arguing about definitions?
Read the worked answer
Do not litigate the meaning of 'engagement'. Show the consequence in the sponsor's own currency - schedule, regulatory exposure and go-live confidence.
The argument I make:
- The group absorbing the largest process change has contributed zero risks to a 96-line register. That is not because they have no risks; it is because the process never collected them.
- In a single unstructured conversation, that manager produced three concrete failure modes in under a minute. They were available all along. That is a finding about our process, and it is cheap to fix.
- The works council consultation is a legal prerequisite with no date in the schedule. If consultation is not opened in time, go-live moves whether or not we register it - silence here is schedule risk, not stakeholder satisfaction.
What I propose: a bounded, cheap test. One 45-minute session, one schedule milestone, two weeks. If nothing material comes out, the sponsor's position is validated and we have spent an hour. If it does, we have avoided discovering it at cutover.
If the sponsor still declines: record it as an accepted risk with the sponsor as owner, the rationale, and the date. A sponsor is entitled to accept a risk; they are not entitled to make it invisible. If the risk threatens the consultation deadline, use the escalation path defined in the risk management plan - and if no such path exists, that absence is itself something to raise with the PMO.