A risk register is a maintained record of what might go wrong, what remains unknown, and what the team may need to do about it. Establish it at the start of the project alongside a shared document repository. Its purpose is to make uncertainty visible before it becomes an unplanned delivery cost. section 2.2
Add a risk when an assumption needs checking or a delivery constraint may change the plan:
- Record unanswered questions about data access, contents, and quality. Where a contract is involved, put consequential assumptions in the statement of work; insufficient data knowledge may also require time and funding contingency. section 2.4
- Record potential security or privacy obstacles even when the resolution is not yet known. Determine whether they require a contractual assumption or affect project viability and cost. section 2.5
- Record gaps between promised and available infrastructure, or a resourcing plan that can no longer be staffed. Work through mitigations such as a workaround, a scope change, replanning, or replacement resources. section 4.4.2 section 4.2
Review the register when preparing the resource estimate. Identify possible mitigations or workarounds, estimate their cost and confidence, and allow for that uncertainty in the budget. Check especially for high-impact risks with no clear path to resolution. Brief an accountable officer, obtain sign-off on the proposed budget and risk, and document the decision. During delivery, a weekly stakeholder review can keep the register current. section 3.2.3
Pricing an uncertain mitigation
If a mitigation is estimated at $500, a low-confidence estimate with a 100% risk premium becomes $1,000 in the project budget. A high-confidence mitigation with a 30% premium becomes $650. These figures make the cost of uncertainty explicit rather than leaving it outside the estimate. section 3.2.3
