The ten line register
Cap the register at ten live risks per project. The cap is the method: it forces the team to rank, and ranking is the analysis. Each line carries five things: the risk in one sentence of cause and effect, the single score, the owner, the current mitigation with a date, and a trigger, the observable event that turns this risk into an issue.
Retire risks aggressively. A register where closed risks outnumber open ones is a register the team trusts, because it visibly reflects today.
Score on one axis
Probability times impact matrices produce false precision and long arguments. Score each risk on the one question that matters: if this lands, does it end the project, delay it, or annoy it? Three levels, named plainly. The ranking conversation takes five minutes, and the top of the list is where mitigation money goes.
This mirrors the broader trend in operational risk practice toward simple, frequently refreshed judgments over elaborate, stale quantification, a trade that favors small companies, whose advantage is speed of honest conversation, not analytical staffing.
Mitigation is a task, the risk minute is the ritual
A mitigation without an owner and a date is a hope. Write mitigations as ordinary work items: who, what, by when, tracked with the rest of the plan. Then spend one minute per project in the weekly review on three questions: any trigger fired, any score changed, any mitigation slipped? That minute, kept every week, outperforms the quarterly risk workshop because risk is a moving picture and the register only has value while it is current.
When a trigger fires, the risk converts to an issue with the same owner, and the response plan is already the mitigation you funded. That continuity is the entire payoff of the discipline.
A register that lives where the work lives
The PMO Desk’s risk register is part of the project record: ten line discipline, single axis scoring, owners and dated mitigations, and triggers that convert risks to issues without retyping. Open risks surface in My Day and the steering pack automatically, so the weekly risk minute is prepared before you arrive.
Velora drafts the initial register from the charter, which beats a blank page, and flags risks with no owner or stale mitigations. Risk practice that a two person team keeps up, on the workspace built for teams that size.
Frequently asked questions
How many risks should a project track?
Ten live risks at most. The cap forces ranking, and ranking is where the actual analysis happens. Retired and converted risks stay in the history, not the working view.
What is the difference between a risk and an issue?
A risk might happen; an issue has happened. Each risk carries a trigger, the observable event that converts it, and the funded mitigation becomes the response plan.
How often should the register be reviewed?
One minute per project, weekly, inside the standing review. Frequency beats depth: a current simple register outperforms a sophisticated stale one every time.