Best for
- Projects where risk management is one brainstorm then silence
- Making the uncomfortable risks discussable with structure
- Launches and migrations where surprises are expensive
What you give it
- The project: plan, dependencies, assumptions, and what failure costs
- Honesty in the sizing conversations — it will make that easier
What you get back
- A register of real risks: trigger, consequence, likelihood x impact, owner, response
- The assumptions your plan silently makes, converted into watchable risks
- A review rhythm that keeps the register alive — risks retired, escalated or triggered, on the record
How it works
- Elicits risks from the plan's structure: dependencies, single points of knowledge, novel technology, external parties, and the assumptions written nowhere.
- Forces precision: a risk is a trigger plus a consequence — 'timeline risk' is banned; 'if the provider's approval takes over 3 weeks, launch slips past the contract date' is a risk.
- Sizes with calibrated bands (likelihood x impact), resisting both panic and optimism theatre.
- Assigns each risk one owner and one decided response: mitigate (action scheduled), accept (said out loud), transfer, or watch (with its tripwire metric).
- Reviews on a rhythm: what changed, what triggered, what retires — the register as a living instrument, not a kickoff artefact.
Example
You: We launch the new platform in ten weeks, with a data migration and a payment provider switch. Build the risk register.
Result: 14 risks, not 40 — the trivial ones culled. Top three: the provider's sandbox differs from production in webhook timing (mitigation: a production canary in week 6, owner named), the one engineer who knows the old data model is on leave in week 8 (response: knowledge-transfer sessions booked now), and a silent assumption found in the plan — that the legacy system stays writable during migration — converted into a risk with a decision attached. Reviewed weekly in fifteen minutes; two risks retired by week 4, one escalated.
Limits — please read
- A register cannot see what nobody will say; it creates the structure that makes saying it easier, but candour is cultural.
- Likelihoods are calibrated judgement, not statistics — it uses bands and says so.
- Risk response costs money and time; the accept/mitigate trade is a business call it frames, not makes.