A risk register can look like control without providing any.
If nobody reviews it, updates it or acts on it, the document gives directors false comfort. It suggests that the project team understands its exposure when the opposite may be true. It also creates a weak record if the commercial position is later challenged.
A live risk register does more than list problems. It connects uncertainty to actions, forecasts, programmes and decisions.
That is the difference between project controls for contractors and paperwork.
What a project risk actually is
A risk is an uncertainty that could affect cost, time, quality or performance.
It may be a threat. For example:
- design information may arrive late;
- a key subcontractor may lack capacity;
- access may be restricted;
- an interface with another contractor may disrupt your sequence.
It may also be an opportunity. For example:
- an alternative construction method may reduce cost;
- early procurement may improve availability;
- a revised sequence may release programme float.
A register that only lists threats is doing half the job. You need to understand both downside exposure and credible opportunities.
The central test is practical: what could happen, what would cause it and what would be the consequence?
“Risk of delay” tells nobody enough to act. A usable entry might say:
If the cladding design is not approved by 15 October, the installation team cannot release the north elevation, which may delay follow-on trades and increase preliminaries.
That wording gives the team something to manage.
Identify risks early and write them properly
Risk identification should involve the people closest to delivery. Use a focused workshop at the right stage, then hold short regular reviews rather than relying on one large exercise at the start.
Look across:
- design and information release;
- procurement and long-lead materials;
- subcontractor and supply chain capacity;
- access, logistics and site constraints;
- interfaces with other work packages;
- labour, plant and specialist resources;
- weather and ground conditions;
- regulatory and approval requirements;
- commercial and contractual matters.
Write each risk as cause, event and consequence. Avoid labels that describe only the outcome.
Every risk should then have a status, probability, impact, response, owner and next action. Keep the system proportionate. A small contractor does not need an oversized governance process. You do need enough structure to see movement early.
Score risks to prioritise action
Most project teams start with a qualitative assessment. Score probability and impact using a simple scale, such as 1 to 5, and use the combined score to prioritise attention.
Scoring is a prioritisation tool. It is not a science.
A score does not remove judgement. It helps the team identify which risks need immediate action, which need monitoring and which do not justify disproportionate management effort.
Keep two positions separate:
- Inherent risk: the exposure before mitigation.
- Residual risk: the exposure that remains after agreed mitigation.
This distinction matters. If the team installs temporary access, changes the procurement route or adds a design review, the exposure should change. Record that movement rather than leaving the original rating in place.
Only residual risk should drive the live contingency allowance. Otherwise, you may hold money against risks that the project has already reduced while missing risks that are now becoming more serious.
Qualitative and quantitative risk analysis
A qualitative register gives you a scored view of the project’s main exposures. It supports regular team reviews and works well for many small and medium-sized projects.
Quantitative risk analysis goes further. It models cost and programme uncertainty to produce a range of possible outcomes.
A Monte Carlo simulation runs many possible combinations of risks to show the spread of potential outcomes. It does not make poor input data reliable. If the register is stale or the assumptions are weak, the output may look precise while remaining wrong.
Two terms often appear in the results:
- P50: the outcome you have a 50% chance of beating.
- P80: the outcome you have an 80% chance of beating.
Choosing P50 or P80 as the basis for contingency is a risk appetite decision. It should be made deliberately, agreed with the relevant decision-makers and recorded. It should not appear as an unexplained number in a report.
Quantitative analysis is not automatically necessary on every job. For a smaller project, a well-maintained qualitative register with sensible cost allowances may be more useful than a complex model nobody refreshes.
Contingency is an allowance, not spare profit
Contingency is a deliberate allowance for identified uncertainty. It is not spare profit and it is not an emergency fund for any cost that management did not anticipate.
A properly established contingency process answers four questions.
How much should you hold?
Use the residual risk position and, where appropriate, the quantified range of outcomes. Consider the project stage, risk appetite, contract form and the quality of the available information.
Do not apply an unexplained percentage simply because that is what the last job used.
Who holds it?
Give contingency a clear owner. Define who can recommend a drawdown and who must approve it.
What qualifies as a drawdown?
Set out the conditions. A drawdown should relate to an identified risk that has materialised or requires an agreed response. Record the risk reference, amount, reason, approval and effect on the remaining allowance.
When can it be released?
Release contingency when the related exposure has been retired or reduced and the remaining position supports doing so. Contingency should reduce as the project becomes more certain.
A contingency that never moves is not necessarily under control. It may mean the allowance is disconnected from the risk process.
Choose the response that fits the risk
Do not default to “monitor”. Decide what the project will do.
| Response | What it means | Contractor example |
|---|---|---|
| Avoid | Change the plan so the risk no longer applies. | Change the installation method to remove work at height in an exposed location. |
| Reduce | Lower the probability or impact. | Order a long-lead component early and obtain supplier capacity confirmation. |
| Transfer | Allocate some exposure to another party. | Use insurance, a bond or suitable subcontract terms. Remember: transfer is rarely free and may create a price or administration consequence. |
| Accept | Keep the risk under review because further treatment is disproportionate. | Accept minor weather inefficiency within a defined allowance and review it at each forecast. |
The chosen response should have a practical action and a date. A response with no action is only a statement of intent.
Ownership means names and dates
Every risk needs a named risk owner and a dated action.
The risk owner is accountable for managing the exposure and ensuring the response remains appropriate. The action owner is responsible for completing a specific task.
They may be the same person, but they do not have to be.
“Site team to review” is not ownership. Name the person, define the action and set the date. Shared awareness is not accountability.
When the action is complete, record the evidence. Do not close a risk because it has disappeared from the last meeting agenda.
Connect the register to the rest of the controls system
Risk cannot sit in isolation.
A risk that is not reflected in the forecast is not being managed commercially. A risk that affects the critical path must connect to the programme. A risk that changes scope or entitlement must connect to the change register and commercial position.
This is why project controls work as an integrated discipline. Your cost control process should identify movement early, while your schedule controls should show the effect on critical path, float and records.
Under NEC, the risk process should also connect to early warnings and compensation events. An early warning creates an opportunity to reduce the effect. A compensation event process deals with the contractual assessment where the relevant conditions apply. Keep the records linked but do not treat them as interchangeable.
Read our guide to NEC4 early warnings and the clause 15 process.
On NEC Option C, the connection becomes even more direct. The risk allowance and contingency treatment affect the target cost, forecast outturn and ultimately your pain/gain share position. Poor risk control can therefore affect more than reporting. It can affect the commercial return from the job. Our guide to NEC Option C pain/gain share explains that relationship in more detail.
Review the register often enough to use it
A workable review rhythm for a smaller business is usually short and regular:
- review new and changing risks;
- confirm the current probability and impact;
- check actions against their dates;
- decide whether contingency should move;
- update the forecast and programme where necessary;
- record decisions and evidence.
Do this weekly for active delivery risks, or align it with your regular commercial and programme review where the project is less complex. Do not turn it into a quarterly paper exercise.
Common failures include:
- vague risks that cannot be acted on;
- no owners or target dates;
- registers unchanged for months;
- risks closed without evidence;
- contingency treated as profit or an emergency fund;
- quantitative analysis completed once and never refreshed;
- risk managed separately from the programme and forecast.
The next posts in this project controls cluster will cover change and configuration control, earned value without the jargon, and reporting that gets used. The principle remains the same: truth rather than presentation, and a plan you can act on.
Frequently asked questions
What is the difference between a risk register and a contingency?
The risk register records uncertainty, its potential effect, ownership and response. Contingency is the money or time allowance set aside for the residual uncertainty that remains. The register informs the allowance; it is not the allowance itself.
How much contingency should I hold?
There is no responsible universal percentage. Base it on the residual risks, the project stage, the quality of your information, the contract and your agreed risk appetite. Record how you reached the figure and update it as risks change.
What is a P80?
A P80 is an outcome that you have an 80% chance of beating. It is more conservative than a P50, which you have a 50% chance of beating. The choice between them should be deliberate, not hidden in a spreadsheet.
Do I need quantitative risk analysis on a small project?
Not always. A concise, live qualitative register may provide better control than a complex model that nobody understands or updates. Use quantitative analysis where the project’s uncertainty, value or contractual structure justifies it.
How often should the risk register be reviewed?
Review it whenever a material change occurs and at a regular project controls meeting. For active construction work, a short weekly review is often more useful than a detailed monthly document.
Can I claim a risk that has already happened?
A risk is an uncertain future event. Once it has happened, it becomes an event that must be assessed under the relevant contract process. You cannot create entitlement simply by listing the matter on a risk register. Check the notice requirements, preserve the records and link the event to the forecast, programme and commercial assessment.
Make your risk process usable
A risk register nobody reviews is worse than none because it hides the absence of control.
The answer is not more paperwork. It is a live process with clear wording, named owners, dated actions, honest scoring and a direct connection to cost, programme and contract administration.
BHD Limited provides project controls for contractors across the UK, bringing the commercial discipline of major infrastructure programmes to SMEs and Tier 2 and Tier 3 businesses in a proportionate form. BHD Commercial's team brings 25 years' experience across construction, defence and infrastructure.
Our head office is at 66 Paul Street, London EC2A 4NA, with a regional office at 4–5 Victoria Square, Wolverhampton WV1 1LD.
If you want a straight view of your risk register, contingency or wider commercial controls, request a free Commercial Health Check. It is an initial conversation about what is working, what is exposed and what you can act on next.