KEVOS
ArticlesServicesCase studiesAboutContact
ArticlesServicesCase studiesAboutContact
← ArticlesRisk Register Example: Website RedesignTemplates & Examples · ExamplesLesson 3/9← PrevNext →
TemplatePublished 16 Jul 2026Updated 13 Aug 202611 min readBy Kevin Joginproject managementriskregisterexample
On this page

Ask about this page

KEVOS AIRisk Register Example: Website Redesign

KEVOS knowledge first · trusted web sources when needed

Templates & Examples / Examples

Risk Register Example:
Website Redesign

A completed risk register detailing both initial analysis and response planning for a corporate website overhaul, featuring 15 identified risks and opportunities.

11 min read 2 sections Example
Project: Mary's Consulting - New Company Website Date Prepared: Aug 15, 2026 Drawn: KEVOS®
In this example:
  1. Identification & Initial Analysis
  2. Response Plan & Monitoring

§1Identification & Initial Analysis

Outputs from identifying risks and performing qualitative risk analysis. Probability and Impact are each scored from 1 to 5. The total score is computed as Probability multiplied by the maximum Impact observed across the four core objectives.

ID Category Risk Statement Owner P Impact Score Level Response Strategy
Sc Qu Sch Co
R-01 Technical CRM API integration may be more complex than expected, delaying lead-form go-live. Bob (Dev) 3 2 2 4 3 12 Med-High Mitigate
R-02 Technical WCAG 2.1 AA audit may surface Severity-1 findings late in the project, requiring rework. Bill (UX) 3 1 5 3 3 15 High Mitigate
R-03 External Frontend contractor may be unavailable when needed, delaying frontend build. Andrew (PM) 2 1 1 3 2 6 Low Mitigate
R-04 Organisational Sponsor (Mary) may delay design approval beyond planned 5-day window, slipping the design milestone (M04). Andrew (PM) 4 1 1 4 2 16 Critical Mitigate
R-05 Organisational Consultants (500+) may not provide bios on time, delaying directory and content launch. Christine 4 4 4 2 1 16 Critical Mitigate
R-06 Organisational Bob, Bill, or Christine may take an unplanned absence (illness, family) during build phase. Andrew (PM) 2 1 2 4 3 8 Medium Mitigate
R-07 External Hosting/CMS vendor outage during cutover (A038) could prevent Go-Live. Bob (Dev) 1 1 1 5 1 5 Low Transfer/Mitigate
R-08 External Legal/Compliance review may identify GDPR or privacy issues late, blocking launch. Andrew (PM) 2 2 3 3 2 6 Low Mitigate
R-09 Project Mgmt Effort estimates for build activities (A024, A025) may be optimistic, exceeding the cost baseline. Andrew (PM) 3 1 1 2 4 12 Med-High Accept (active)
R-10 Technical Site performance may not meet LCP < 2.5s target on image-heavy pages (case studies, directory). Bob (Dev) 3 1 4 2 2 12 Med-High Mitigate
R-11 Organisational Marketing Lead may want to expand scope post-design approval (e.g., add a careers section). Andrew (PM) 4 4 1 3 3 16 Critical Mitigate
R-12 Organisational FY2026 budget pressure could reduce the project's funding mid-stream. Mary (Sponsor) 1 5 2 5 5 5 Low Avoid (Sponsor-managed)
R-13 Project Mgmt IT/Hosting Operations may not be ready to accept handoff at Go-Live, leaving the PM team holding production support. Andrew (PM) 3 1 2 1 3 9 Medium Mitigate
R-14 Opportunity Consultants featured in case studies may proactively share the new site, providing free marketing reach. Marketing Lead 4 1 1 1 -2 8 Medium Enhance
R-15 Opportunity WCAG 2.1 AA compliance may attract clients who require accessibility-compliant vendors (gov, healthcare, education). Sales Lead 3 1 1 1 -3 9 Medium Exploit
↑ Contents

§2Response Plan & Monitoring

Outputs from continuous monitoring routines. The 'Residual Score' represents the risk exposure after the response plan is implemented. Negative cost values outline calculated realisable opportunity.

ID Action Plan Responsible Party Trigger / Symptom Resid. P Resid. Score Status Comments
R-01
  • Schedule a 4-hour CRM-vendor technical call in week 1 of Build (Aug 17).
  • Build a parallel test harness against CRM sandbox.
  • If > 1-week delay risk, fall back to email-form submission with manual CRM entry for launch.
Bob (Dev)-primary; Marketing Lead secondary API discovery during A025 reveals missing fields or undocumented behaviour. 2 4 Mitigating Vendor call booked Aug 18.
R-02
  • Build accessibility checks into the component library (A023).
  • Run automated a11y linting on every PR.
  • Conduct an internal accessibility review at A024 completion (Sep 30) before the formal audit.
Bill (UX); Bob ensures linter in CI Audit report identifies Sev-1 findings. 2 4 Mitigating Internal pre-audit booked Oct 1.
R-03
  • Sign frontend SOW by July 1, 2026.
  • Identify a backup contractor from approved-supplier list (already done: Vendor X).
  • Pre-pay 25% to lock contractor schedule.
Andrew (PM); Procurement Contractor declines or doesn't respond to SOW by Aug 5. 1 2 Closed SOW signed June 28.
R-04
  • Pre-book a 2-hour design review on Mary's calendar for Aug 5 — confirmed with EA.
  • Send an executive summary preview 1 week in advance.
  • Bill presents in person; PM facilitates same-day decisions.
Andrew (PM) > 5 business days elapse between design submission and Mary's response. 2 4 Mitigating Calendar booked.
R-05
  • Mary sends a firm-wide kickoff email setting the expectation.
  • Provide a 10-minute self-service form (instead of an interview).
  • Tier the rollout: top 50 consultants at launch, remainder added in batches post-launch.
  • Recognition in case studies for early submitters.
Christine; supported by Mary's email < 50% bio response rate by week 2 of A016. 3 6 Mitigating Firm-wide email scheduled June 15.
R-06
  • Document architecture, design system, and content pipeline so anyone can pick up.
  • Cross-train: Bob shadows Bill on accessibility; Christine shadows Bill on content design.
  • Identify backup contractors who can be onboarded in ≤ 1 week.
Andrew (PM); each team member Team member unavailable for > 5 consecutive business days. 2 4 Mitigating Documentation in progress.
R-07
  • Contractually require 99.5% SLA from vendor.
  • Schedule cutover Tue-Thu (not Mon/Fri) to allow vendor support.
  • Document rollback to legacy site (DNS revert) tested in advance.
Bob (Dev); IT/Hosting Operations Vendor status page shows incident on cutover day. 1 2 Mitigating Cutover tentatively Tue Nov 24.
R-08
  • Engage Legal at requirements (A006) and design (A011) before build.
  • Use the firm's standard cookie-consent/privacy-policy template.
  • Schedule a Legal sign-off 4 weeks before launch.
Andrew (PM); Legal Legal flags any Sev-1 issue in the privacy review. 1 1 Mitigating Legal joined kickoff.
R-09
  • Hold $15,000 contingency reserve specifically for this risk pool.
  • Track CPI weekly during build phase.
  • Trigger management reserve request if CPI < 0.9 for 2 consecutive weeks.
Andrew (PM) EAC trends > BAC at any phase gate. 3 6 Open Watch CPI weekly.
R-10
  • Implement image-CDN with auto-resize from build start.
  • Lazy-load all below-fold imagery.
  • Performance budget enforced in CI (fail build if LCP > 2.5s).
Bob (Dev) Performance test (A030) shows 75th-percentile LCP > 2.5s. 2 4 Mitigating CDN selected.
R-11
  • Documented scope-statement exclusions reviewed at Marketing kickoff.
  • Any scope-add goes through formal change-control (no exceptions).
  • Maintain a 'Phase 2 backlog' so good ideas have a home without disrupting Phase 1.
Andrew (PM); Marketing Lead Any scope-add request from Marketing Lead post-M04. 3 3 Mitigating Phase 2 backlog established.
R-12
  • Sponsor secured first-call on FY2026 funding.
  • Quarterly tranche release confirmed.
  • PM reports on benefits early to maintain executive support.
Mary (Sponsor) CFO communicates budget reallocation. 1 1 Closed Sponsor confirmed June 1.
R-13
  • Engage IT/Hosting Ops at architecture review (Aug 5).
  • Draft runbooks during build, not at end.
  • Joint cutover rehearsal Nov 17 (1 week before Go-Live).
Andrew (PM); IT/Hosting Operations IT raises concerns about runbooks or monitoring in late October. 2 2 Mitigating IT engaged at kickoff.
R-14
  • Provide pre-written social-share copy to featured consultants.
  • Recognise sharing leaders in the firm's all-hands meeting.
  • Track referral traffic in analytics.
Marketing Lead; Christine Launch announcement. 4 12 Open Social-share kit drafted.
R-15
  • Sales Lead develops WCAG-compliance messaging post-audit.
  • Landing page on the new site for accessibility-first prospects.
  • Add accessibility credentials to RFP responses.
Sales Lead; Marketing Lead Audit pass + sales messaging update. 3 12 Open Sales briefed.

Mitigation Tracking

Risk statuses naturally shift from 'Open' to 'Mitigating' to 'Closed'. Ensure ongoing oversight of mitigation actions at every stage gate review.

Residual Acceptability

Review any risk where the residual score remains elevated. It may require an executive management reserve to handle in the case of realisation.

Opportunity Enhancement

Negative impacts denote opportunities. Strategy focus shifts to 'Enhance' or 'Exploit', maximising project returns where possible.

↑ Contents

Original KEVOS® synthesis. Built July 2026.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Risk Register Example: Website Redesign. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to make the blank artefact usable by explaining what belongs in each field, who supplies it and how it is reviewed. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Use Risk Register Example: Website Redesign as a decision instrument rather than an administrative form. The subject terms—risk, register, example, website, redesign—need an explicit connection to the project objective, business value and stakeholder commitments. Before completing the artefact, write one sentence stating who will use it, what decision it supports and when that decision is required.

Apply a disciplined information model. Separate facts supported by evidence, forecasts derived from a method, assumptions awaiting validation, constraints that limit choice, risks that may occur, issues that already exist and actions assigned to people. Each material entry should have an owner, date, status and next review point. Where probability or impact scores are used, define the scale so different reviewers interpret it consistently.

A baseline is useful only when changes are visible. Give the artefact an identifier, version, approval state and effective date. Define which changes require reapproval, how superseded versions are retained and where supporting evidence is stored. During reviews, focus on exceptions, decisions and trends rather than reading every field aloud. Record the decision and rationale, not merely that a meeting occurred.

Close the loop beyond delivery. Confirm acceptance criteria, unresolved items, transferred responsibilities and operational ownership. Where benefits are expected, identify the outcome measure, baseline, target, observation period and owner who remains accountable after the project team disbands. Lessons should describe the condition, consequence and reusable action; a generic statement such as “communicate better” cannot improve the next project.

Step-by-step operating method

  1. Name the decision. Write the decision, approval, handover or control activity the completed template must support.
  2. Assign ownership. Nominate one accountable owner and identify contributors, reviewers and approvers.
  3. Gather evidence. Use records, estimates, stakeholder input and source references rather than unsupported opinion.
  4. Complete with discipline. Use consistent dates, units, identifiers, status values and version controls.
  5. Review and maintain. Check completeness and logic, approve the baseline, then update it when trigger conditions occur.

Completion and governance protocol

Start with a short drafting workshop involving the accountable owner and the people who hold the evidence. Complete high-consequence fields first: objective, scope, owner, baseline, acceptance, dependencies and escalation. Mark unknowns as assumptions or actions rather than hiding them behind vague prose. Circulate a review draft, resolve conflicting interpretations, baseline the approved version and place the next review date in an owned schedule.

Information typeMinimum useful contentReview test
OutcomeObservable change and intended recipientNot merely a deliverable or activity
MeasureDefinition, baseline, target, frequency and sourceTwo reviewers would calculate it the same way
OwnershipOne accountable role plus contributors and approverAuthority matches responsibility
UncertaintyAssumption, risk or issue with response and triggerStatus reflects current reality
ControlVersion, approval, review date and change ruleCurrent baseline is identifiable

Common failure modes and recovery actions

1. Watch for

Filling every box even when a field is not applicable instead of recording why.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Writing vague statements without an owner, measure, date or evidence source.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Copying a previous project without revalidating assumptions and stakeholders.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Using the document as a private worksheet when it is meant to support a shared decision.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Creating an approved baseline but failing to define who maintains it and when.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

  • Is the purpose and intended decision clear to a reader outside the team?
  • Are owners, dates, measures and sources complete and internally consistent?
  • Which fields are assumptions and how will they be validated?
  • What event, threshold or review date causes this document to change?
  • Are mandatory requirements distinguished from recommendations and illustrative values?
  • Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
  • Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
  • Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Risk Register Example: Website Redesign?

Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.

Which assumption about risk would change the result most if it proved false?

Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.

What evidence would allow an independent reviewer to reproduce or challenge the conclusion?

Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.

Which boundary, exception or failure case has not yet been tested?

Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.

What must be handed over, monitored or reviewed after the immediate work is complete?

Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.

Authoritative references and use notes

The sources below were selected as institutional or primary guidance for the broader practice. They support the handbook method; they do not imply that every statement or clause in a source applies to every project. Confirm the current edition, jurisdiction, contract and application before treating any requirement as mandatory.

  • Risk Management in Portfolios, Programs, and Projects: A Practice Guide — Project Management Institute. Used for risk practices across portfolios, programs and projects. Accessed 2026-08-13.
  • ISO 31000 family — Risk management — International Organization for Standardization. Used for principles and guidance for enterprise risk management. Accessed 2026-08-13.

Continue learning

NEXT LESSON →Stakeholder Register ExampleTemplate · ExamplesCommunications Management Plan ExampleTemplate · ExamplesIndividual Performance Assessment ExampleTemplate · ExamplesIndividual Performance Assessment: UX Designer ExampleTemplate · Examples
KEVOS · Engineering, manufacturing and project improvement
ArticlesServicesCase studiesAboutContact
© 2026 KEVOS®