The OTR GroupA risk register is simply a shared list of things that could affect your project, with a note of who is looking after each one. Done well, it turns vague worry into clear action. This guide gives practical steps for a small project team. Where it refers to government guidance, it draws on HM Treasury''s Orange Book, the Government Finance Function''s guidance on the management of risk.
What the Orange Book says
The Orange Book sets out five main principles. In summary, they are: governance and leadership (risk management should be an essential part of how an organisation is led); integration (it should be built into all activities, not run as a separate exercise); collaboration and best information (involve others and use the best available evidence); risk management processes (identify, assess, treat, monitor and report, as an iterative cycle); and continual improvement (learn from experience and review regularly).
Step 1: Set up the columns
A spreadsheet is enough. Useful columns are: a reference number, a short description, the cause, the possible effect, an owner, a rating, the planned response, and the date you last reviewed it.
Step 2: Capture risks with the team
Hold a short workshop and ask, "What could stop us delivering?" Include people who see the work from different angles, such as the person who orders materials or the person who talks to the customer. This reflects the Orange Book''s emphasis on collaboration.
Step 3: Write each risk clearly
A helpful pattern is: "Because of [cause], [event] might happen, leading to [effect]." This keeps the entry specific and avoids one-word entries such as "delay".
Step 4: Rate and decide
Give each risk a simple rating, for example high, medium or low for likelihood and for impact. The Orange Book also talks about comparing analysis against the organisation''s risk appetite, meaning how much risk it is willing to accept. For a small project, agree in advance what level needs a response.
Step 5: Name an owner and a response
Every risk needs one named person. Typical responses are to avoid the risk, reduce it, share it, or accept it knowingly. Write down the next action and a date.
Step 6: Review on a rhythm
Put the register on the agenda of your regular meeting. Close risks that have passed, add new ones, and note what you learned. That is the continual improvement principle in practice.
Common pitfalls
- A register written once and never reopened.
- Risks with no owner.
- Long lists with no ratings, so nothing stands out.
Keep it short, keep it live, and keep it where the whole team can see it.