20 Common Project Risks – Example Risk Register
- Want to a kick start to your Risk Management?
- Want to make sure you have identified key project risks?
- Not sure what actions you can take to reduce the likelihood of key project risks?
- Look no further!
What is included in the risk register?
Not a blank template
20 common project risks are already included
| ID | Risk description | Likelihood | Impact | Severity | Owner | Status |
|---|
✓ Start with 20 common project risks already written for you
- 20 common project risks that can affect schedule, cost, quality, scope, suppliers, approvals, resources and stakeholders.
- Example likelihood, impact and severity ratings for each risk.
- Suggested risk owners, including project sponsor, project manager and team manager roles.
- Mitigating actions to reduce the likelihood or impact of each risk.
- Contingency actions to use if the risk happens.
- Progress and status fields for tracking risk actions during project delivery.
- Excel .xlsx and legacy .xls download options.
20 Common Project Risks
These are the 20 common project risks which we have included in the risk register along with suggested mitigating actions and contingency actions- Project purpose and need is not well-defined.
- Project design and deliverable definition is incomplete.
- Project schedule is not clearly defined or understood.
- No control over staff priorities.
- Consultant or contractor delays.
- Estimating and/or scheduling errors.
- Unplanned work that must be accommodated.
- Lack of communication, causing lack of clarity and confusion.
- Pressure to arbitrarily reduce task durations and or run tasks in parallel which would increase risk of errors.
- Scope Creep.
- project conflicts not resolved in a timely manner.
- Business Case becomes obsolete or is undermined by external or internal changes.
- Delay in earlier project phases jeopardizes ability to meet fixed date. For example delivery of just in time materials, for conference or launch date.
- Added workload or time requirements because of new direction, policy, or statute.
- Inadequate customer testing leads to large post go live defect list.
- Legal action delays or pauses project.
- Customer refuses to approve deliverables/milestones or delays approval, putting pressure on project manager to 'work at risk'.
- Theft of materials, intellectual property or equipment.
- Acts of God for example, extreme weather, leads to loss of resources, materials, premises etc.
- Stakeholder action delays the project. For more on the damage stakeholders can do see our case studies of real world projects that faced costs running into millions, because of stakeholder actions.
Completed risk register with 20 project risks you need to manage
The completed example below shows how each risk is recorded in the register. Each row includes the risk description, likelihood, impact, severity, owner, mitigating action, contingency action, progress and status.
Tip: Treat the ratings and owners as examples. Review and adjust them for your own project, organisation, suppliers, stakeholders and delivery environment.
| ID | Risk description | Likelihood of the risk occurring | Impact if the risk occurs | Severity | Owner | Mitigating action | Contingent action | Progress on actions | Status |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Project purpose and need is not well-defined. | Medium | High | High | Project Sponsor | Complete a business case if not already provided and ensure purpose is well defined on Project Charter and PID. | Escalate to the Project Board with an assessment of the risk of runaway costs/never-ending project. | Business case re-written with clear deliverables and submitted to the Project Board for approval. | Open |
| 2 | Project design and deliverable definition is incomplete. | Low | High | High | Project Sponsor | Define the scope in detail via design workshops with input from subject matter experts. | Document assumptions made and associated risks. Request high risk items that are ill-defined are removed from scope. | Design workshops scheduled. | Open |
| 3 | Project schedule is not clearly defined or understood | Low | Medium | Medium | Project Manager | Hold scheduling workshops with the project team so they understand the plan and likelihood of missed tasks is reduced. Share the schedule and go through upcoming tasks at each weekly project progress meeting. |
Revisit the schedule with the project team.
'Relaunch' the project schedule. |
Workshops scheduled. | Open |
| 4 | No control over staff priorities | Medium | Medium | Medium | Project Manager | The Project Sponsor will brief team managers on the importance of the project. Soft book resources as early as possible and then communicate final booking dates asap after the scheduling workshops. Identify back ups for each human resource on the project. | Escalate to the Project Sponsor and bring in back up resource. | Project Sponsor has agreed to hold briefing. Now making arrangements for a meeting room. | Open |
| 5 | Consultant or contractor delays | Medium | High | High | Project Manager | Include late penalties in contracts. Build in and protect lead time in the schedule. Communicate schedule early. Check in with suppliers regularly. Query '90% done'. Ask again and again if they need anything else. |
Escalate to Project Sponsor and Contracts Manager. Implement late clauses. | Lead time from each contractor built into the project schedule. Late penalties agreed to and contracts signed. | Open |
| 6 | Estimating/or scheduling errors | Medium | High | High | Project Manager | Break this two risks 'cost estimating' and 'scheduling errors'. Use two methods of cost estimation, and carefully track costs and forecast cost at completion making adjustments as necessary. Build in 10% contingency on cost and scheduling. Track schedules daily and include schedule review as an agenda item in every project team meeting. Flag forecast errors and/or delays to the Project Board early. |
Escalate to project sponsor and Project Board. Raise a change request for changes to budget or schedule. Pull down contingency. |
Contingency agreed by Project Board. | Open |
| ID | Risk description | Likelihood of the risk occurring | Impact if the risk occurs | Severity | Owner | Mitigating action | Contingent action | Progress on actions | Status |
|---|---|---|---|---|---|---|---|---|---|
| 7 | Unplanned work that must be accommodated | Low | High | Medium | Team Manager | Attend project scheduling workshops. Check previous projects, for actual work and costs. Check all plans and quantity surveys. Document all assumptions made in planning and communicate to the project manager before project kick off. |
Escalate to the Project Manager with plan of action, including impact on time, cost and quality. | Team managers attending scheduling workshops. | Open |
| 8 | Lack of communication, causing lack of clarity and confusion. | Medium | Medium | Medium | Project Manager | Write a communication plan which includes: the frequency, goal, and audience of each communication. Identify stakeholders early and make sure they are considered in the communication plan. Use most appropriate channel of communication for audience e.g. don't send 3 paragraph email to Developers, have a call instead. |
Correct misunderstandings immediately. Clarify areas that are not clear swiftly using assistance from Project Sponsor if needed. | Communication plan in progress. | Open |
| 9 | Pressure to arbitrarily reduce task durations and or run tasks in parallel which would increase risk of errors. | Low | High | Medium | Project Manager | Share the schedule with key stakeholders to reduce the risk of this happening. Patiently explain that schedule was built using the expertise of subject matter experts. Explain the risks of the changes. Share the Dennis Lock quote at Why you should never arbitrarily reduce task durations. |
Escalate to Project Board with assessment of risk and impact of the change. Hold emergency risk management call with decision makers & source of pressure and lay out risk and impact. |
Awaiting completion of the schedule. | Open |
| 10 | Scope Creep (the adding of features and functionality without assessing the impact on time, costs, and resources, or without customer approval). |
Medium | High | High | Project Manager | Document the project scope in a Project Initiation Document or Project Charter and get it authorised by the Project Board. Refer to it throughout the project and assess all changes against it also ensuring alignment of any changes with the Business Case. | Document each and every example of scope creep NO MATTER HOW SMALL in a change request and get authorisation from the Project Board BEFORE STARTING WORK. This includes ZERO COST changes. | Scope clearly defined in the PID. | Open |
| 11 | Unresolved project conflicts not escalated in a timely manner | Low | Medium | Medium | Project Manager | Hold regular project team meetings and look out for conflicts. Review the project plan and stakeholder engagement plan for potential areas of conflict. | When aware immediately escalate to Project Board and gain assistance from Project Sponsor to resolve the conflict. | Project team meetings scheduled. | Open |
| 12 | Business Case becomes obsolete or is undermined by external or internal changes. | Low | High | High | Project Sponsor | No ability to reduce likelihood, but make sure early warning is given by reviewing the business case on a regular basis with the Project Board. | Initiate escalation and project close down procedure. | Project close down procedure confirmed with Project Board. | Open |
| 13 | Delay in earlier project phases jeopardizes ability to meet fixed date. For example, delivery of just in time materials, for conference or launch date. | Medium | High | High | Project Manager | Ensure the project plan is as accurate as possible using scheduling workshops and work breakdown structure. Use Tracking Gantt and Baseline to identify schedule slippage early. | Consider insurance to cover costs and alternative supplier as a back up. | Awaiting completion of the schedule. | Open |
| 14 | Added workload or time requirements because of new direction, policy, or statute | Low | Medium | Medium | Project Sponsor | No ability to reduce likelihood. | Consider insurance and use Project Board to get advance notice if possible. | Project Board reviewing insurance options. | Open |
| 15 | Inadequate customer testing leads to large post go live snag list. | High | High | High | Project Manager | Ensure customer prepares test cases/quality checks and protect testing/quality assurance window. | Raise risk immediately and raise issue if it is clear testing inadequate. Customer could extend testing & bring in additional resource. | Customer preparing test cases. | Open |
| 16 | Legal action delays or pauses project. | Low | Medium | Medium | Project Sponsor | Ensure all contracts signed before starting the project. Follow all regulatory requirements and complete stakeholder management plan. | Escalate to Project Board who will notify legal department. Follow instructions from legal. | Contracts issued. | Open |
| 17 | Customer refuses to approve deliverables/milestones or delays approval, putting pressure on project manager to 'work at risk'. | Medium | Medium | Medium | Project Manager | Ensure customer decision maker with budgetary authority is identified before project start and is part of the Project Board. Communicate dates for sign-off points up front. | Escalate to Project Board and recommend action e.g. to stop the project. | Customer project manager is confirming their sponsor / senior supplier. | Open |
| 18 | Theft of materials, intellectual property or equipment. | Low | High | High | Project Manager | Follow security procedures, ensure Non-Disclosure Agreements, & compliance certificates are in place. Verify all physical security measures in place. Secure insurance. | Notify appropriate authorities e.g. police, Project Board and initiate internal investigations. | NDAs issued. Security certificates confirmed for contractors. | Open |
| 19 | Acts of God for example, extreme weather, leads to loss of resources, materials, premises etc. | Low | High | High | Project Manager | Check insurance is in place. Familiarise project team with emergency procedures. When cost effective put back up systems in place e.g. generators. | Notify appropriate authorities. Follow health and safety procedures. Notify stakeholders and Project Board. | Public Liability Insurance confirmed along with additional premises insurance at site B. | Open |
| 20 | Stakeholder action delays project. | Low | High | High | Project Manager | Identify stakeholders, analyze power and influence and create a Stakeholder Engagement Plan. Project Board to authorise the plan. Revisit the plan at regular intervals to check all Stakeholders are managed. Consider getting insurance. | Notify appropriate authorities and follow internal procedures e.g. for activist demonstrations. | Stakeholder Analysis in progress. | Open |
Common mistakes when using a risk register
A risk register is only useful if it is actively reviewed and updated. Avoid these common mistakes when adapting this example for your own project.
- Copying risks without tailoring them. Use the 20 risks as prompts, then rewrite them so they match your project, suppliers, stakeholders and constraints.
- Confusing mitigation with contingency. Mitigation is action taken before a risk happens; contingency is the backup plan if it happens.
- Leaving risks without owners. Every important risk needs a named owner who can monitor it and progress actions.
- Using ratings once and never reviewing them. Likelihood, impact and severity should change as the project changes.
- Recording vague actions. A good action should say what will be done, who will do it and when it will be reviewed.
- Not escalating high risks. High risks that threaten cost, schedule, scope or benefits should be visible to the project sponsor or project board.
Help using this risk register
The risk register includes likelihood, impact, severity, owners, mitigating actions and contingent actions. These guides explain how to use those fields properly.
How to use a risk register in Excel
Learn what each column means, how to add risks, assign owners and keep the register useful.
Likelihood, impact and severity
Understand how likelihood and impact combine to produce a Low, Medium or High severity rating.
Mitigation vs contingency
See the difference between action taken before a risk happens and the backup plan if it happens.
Download a complete risk register of common project risks
Download the template, review the example risks, then edit the descriptions, scores, owners and actions so they fit your own project. The .xlsx version is recommended for most users.
Excel 1997 - 2003 download (.xls) - FREE Risk Register of Common Risks
Excel download (.xlsx) - FREE Risk Register of Common Risks
MindMap download - FREE MindMap of Common Project Risks
Video - How to edit the risk register
Related risk management templates and guides
How to Use a Project Risk Register in Excel
Likelihood, Impact and Severity in a Risk Register
Mitigation vs Contingency in Project Risk Management
The Top 50 Business Risks and how to manage them!
Checklist of 30 Construction Risks
Download a Risk Register template
Overall Project Risk Assessment Template
Simple Risk Register Template
Frequently asked questions
What are common project risks?
Common project risks include unclear scope, poor communication, supplier delays, scheduling errors, inadequate testing, lack of resources, late approvals, stakeholder action and changes that undermine the business case.
What should be included in a project risk register?
A project risk register should include the risk description, likelihood, impact, severity, owner, mitigation action, contingency action, action progress and status. Some organisations also include trigger points, residual risk and review dates.
What is the difference between mitigation and contingency?
Mitigation is action taken before a risk happens to reduce its likelihood or impact. Contingency is the backup action used if the risk actually happens.
Can I use this risk register in Excel?
Yes. The template is provided as an Excel download and can be edited for your own project. The .xlsx file is the best option for most users, while the .xls file is included for older versions of Excel.
Should I use all 20 risks on my project?
No. Use the list as a starting point. Delete risks that do not apply, rewrite risks that need more context and add risks that are specific to your project, organisation, supplier or stakeholder environment.
Resources used in this article
Lock, D. (2007) Project Management Ninth Edition, Aldershot, England and Brookfield, Vt: Gower Publishing Limited© 2008 - 2099 T Morphy. stakeholdermap.com.