Risk Register Example:
Website Redesign
A completed risk register detailing both initial analysis and response planning for a corporate website overhaul, featuring 15 identified risks and opportunities.
§1Identification & Initial Analysis
Outputs from identifying risks and performing qualitative risk analysis. Probability and Impact are each scored from 1 to 5. The total score is computed as Probability multiplied by the maximum Impact observed across the four core objectives.
| ID | Category | Risk Statement | Owner | P | Impact | Score | Level | Response Strategy | |||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Sc | Qu | Sch | Co | ||||||||
| R-01 | Technical | CRM API integration may be more complex than expected, delaying lead-form go-live. | Bob (Dev) | 3 | 2 | 2 | 4 | 3 | 12 | Med-High | Mitigate |
| R-02 | Technical | WCAG 2.1 AA audit may surface Severity-1 findings late in the project, requiring rework. | Bill (UX) | 3 | 1 | 5 | 3 | 3 | 15 | High | Mitigate |
| R-03 | External | Frontend contractor may be unavailable when needed, delaying frontend build. | Andrew (PM) | 2 | 1 | 1 | 3 | 2 | 6 | Low | Mitigate |
| R-04 | Organisational | Sponsor (Mary) may delay design approval beyond planned 5-day window, slipping the design milestone (M04). | Andrew (PM) | 4 | 1 | 1 | 4 | 2 | 16 | Critical | Mitigate |
| R-05 | Organisational | Consultants (500+) may not provide bios on time, delaying directory and content launch. | Christine | 4 | 4 | 4 | 2 | 1 | 16 | Critical | Mitigate |
| R-06 | Organisational | Bob, Bill, or Christine may take an unplanned absence (illness, family) during build phase. | Andrew (PM) | 2 | 1 | 2 | 4 | 3 | 8 | Medium | Mitigate |
| R-07 | External | Hosting/CMS vendor outage during cutover (A038) could prevent Go-Live. | Bob (Dev) | 1 | 1 | 1 | 5 | 1 | 5 | Low | Transfer/Mitigate |
| R-08 | External | Legal/Compliance review may identify GDPR or privacy issues late, blocking launch. | Andrew (PM) | 2 | 2 | 3 | 3 | 2 | 6 | Low | Mitigate |
| R-09 | Project Mgmt | Effort estimates for build activities (A024, A025) may be optimistic, exceeding the cost baseline. | Andrew (PM) | 3 | 1 | 1 | 2 | 4 | 12 | Med-High | Accept (active) |
| R-10 | Technical | Site performance may not meet LCP < 2.5s target on image-heavy pages (case studies, directory). | Bob (Dev) | 3 | 1 | 4 | 2 | 2 | 12 | Med-High | Mitigate |
| R-11 | Organisational | Marketing Lead may want to expand scope post-design approval (e.g., add a careers section). | Andrew (PM) | 4 | 4 | 1 | 3 | 3 | 16 | Critical | Mitigate |
| R-12 | Organisational | FY2026 budget pressure could reduce the project's funding mid-stream. | Mary (Sponsor) | 1 | 5 | 2 | 5 | 5 | 5 | Low | Avoid (Sponsor-managed) |
| R-13 | Project Mgmt | IT/Hosting Operations may not be ready to accept handoff at Go-Live, leaving the PM team holding production support. | Andrew (PM) | 3 | 1 | 2 | 1 | 3 | 9 | Medium | Mitigate |
| R-14 | Opportunity | Consultants featured in case studies may proactively share the new site, providing free marketing reach. | Marketing Lead | 4 | 1 | 1 | 1 | -2 | 8 | Medium | Enhance |
| R-15 | Opportunity | WCAG 2.1 AA compliance may attract clients who require accessibility-compliant vendors (gov, healthcare, education). | Sales Lead | 3 | 1 | 1 | 1 | -3 | 9 | Medium | Exploit |
§2Response Plan & Monitoring
Outputs from continuous monitoring routines. The 'Residual Score' represents the risk exposure after the response plan is implemented. Negative cost values outline calculated realisable opportunity.
| ID | Action Plan | Responsible Party | Trigger / Symptom | Resid. P | Resid. Score | Status | Comments |
|---|---|---|---|---|---|---|---|
| R-01 |
|
Bob (Dev)-primary; Marketing Lead secondary | API discovery during A025 reveals missing fields or undocumented behaviour. | 2 | 4 | Mitigating | Vendor call booked Aug 18. |
| R-02 |
|
Bill (UX); Bob ensures linter in CI | Audit report identifies Sev-1 findings. | 2 | 4 | Mitigating | Internal pre-audit booked Oct 1. |
| R-03 |
|
Andrew (PM); Procurement | Contractor declines or doesn't respond to SOW by Aug 5. | 1 | 2 | Closed | SOW signed June 28. |
| R-04 |
|
Andrew (PM) | > 5 business days elapse between design submission and Mary's response. | 2 | 4 | Mitigating | Calendar booked. |
| R-05 |
|
Christine; supported by Mary's email | < 50% bio response rate by week 2 of A016. | 3 | 6 | Mitigating | Firm-wide email scheduled June 15. |
| R-06 |
|
Andrew (PM); each team member | Team member unavailable for > 5 consecutive business days. | 2 | 4 | Mitigating | Documentation in progress. |
| R-07 |
|
Bob (Dev); IT/Hosting Operations | Vendor status page shows incident on cutover day. | 1 | 2 | Mitigating | Cutover tentatively Tue Nov 24. |
| R-08 |
|
Andrew (PM); Legal | Legal flags any Sev-1 issue in the privacy review. | 1 | 1 | Mitigating | Legal joined kickoff. |
| R-09 |
|
Andrew (PM) | EAC trends > BAC at any phase gate. | 3 | 6 | Open | Watch CPI weekly. |
| R-10 |
|
Bob (Dev) | Performance test (A030) shows 75th-percentile LCP > 2.5s. | 2 | 4 | Mitigating | CDN selected. |
| R-11 |
|
Andrew (PM); Marketing Lead | Any scope-add request from Marketing Lead post-M04. | 3 | 3 | Mitigating | Phase 2 backlog established. |
| R-12 |
|
Mary (Sponsor) | CFO communicates budget reallocation. | 1 | 1 | Closed | Sponsor confirmed June 1. |
| R-13 |
|
Andrew (PM); IT/Hosting Operations | IT raises concerns about runbooks or monitoring in late October. | 2 | 2 | Mitigating | IT engaged at kickoff. |
| R-14 |
|
Marketing Lead; Christine | Launch announcement. | 4 | 12 | Open | Social-share kit drafted. |
| R-15 |
|
Sales Lead; Marketing Lead | Audit pass + sales messaging update. | 3 | 12 | Open | Sales briefed. |
Mitigation Tracking
Risk statuses naturally shift from 'Open' to 'Mitigating' to 'Closed'. Ensure ongoing oversight of mitigation actions at every stage gate review.
Residual Acceptability
Review any risk where the residual score remains elevated. It may require an executive management reserve to handle in the case of realisation.
Opportunity Enhancement
Negative impacts denote opportunities. Strategy focus shifts to 'Enhance' or 'Exploit', maximising project returns where possible.
Handbook application: from concept to controlled practice
Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Risk Register Example: Website Redesign. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.
The operating aim is to make the blank artefact usable by explaining what belongs in each field, who supplies it and how it is reviewed. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.
Use Risk Register Example: Website Redesign as a decision instrument rather than an administrative form. The subject terms—risk, register, example, website, redesign—need an explicit connection to the project objective, business value and stakeholder commitments. Before completing the artefact, write one sentence stating who will use it, what decision it supports and when that decision is required.
Apply a disciplined information model. Separate facts supported by evidence, forecasts derived from a method, assumptions awaiting validation, constraints that limit choice, risks that may occur, issues that already exist and actions assigned to people. Each material entry should have an owner, date, status and next review point. Where probability or impact scores are used, define the scale so different reviewers interpret it consistently.
A baseline is useful only when changes are visible. Give the artefact an identifier, version, approval state and effective date. Define which changes require reapproval, how superseded versions are retained and where supporting evidence is stored. During reviews, focus on exceptions, decisions and trends rather than reading every field aloud. Record the decision and rationale, not merely that a meeting occurred.
Close the loop beyond delivery. Confirm acceptance criteria, unresolved items, transferred responsibilities and operational ownership. Where benefits are expected, identify the outcome measure, baseline, target, observation period and owner who remains accountable after the project team disbands. Lessons should describe the condition, consequence and reusable action; a generic statement such as “communicate better” cannot improve the next project.
Step-by-step operating method
- Name the decision. Write the decision, approval, handover or control activity the completed template must support.
- Assign ownership. Nominate one accountable owner and identify contributors, reviewers and approvers.
- Gather evidence. Use records, estimates, stakeholder input and source references rather than unsupported opinion.
- Complete with discipline. Use consistent dates, units, identifiers, status values and version controls.
- Review and maintain. Check completeness and logic, approve the baseline, then update it when trigger conditions occur.
Completion and governance protocol
Start with a short drafting workshop involving the accountable owner and the people who hold the evidence. Complete high-consequence fields first: objective, scope, owner, baseline, acceptance, dependencies and escalation. Mark unknowns as assumptions or actions rather than hiding them behind vague prose. Circulate a review draft, resolve conflicting interpretations, baseline the approved version and place the next review date in an owned schedule.
| Information type | Minimum useful content | Review test |
|---|---|---|
| Outcome | Observable change and intended recipient | Not merely a deliverable or activity |
| Measure | Definition, baseline, target, frequency and source | Two reviewers would calculate it the same way |
| Ownership | One accountable role plus contributors and approver | Authority matches responsibility |
| Uncertainty | Assumption, risk or issue with response and trigger | Status reflects current reality |
| Control | Version, approval, review date and change rule | Current baseline is identifiable |
Common failure modes and recovery actions
1. Watch for
Filling every box even when a field is not applicable instead of recording why.
Recovery: Return to the governing definition or requirement and restate the decision in one sentence.
2. Watch for
Writing vague statements without an owner, measure, date or evidence source.
Recovery: Separate evidence from assumption, assign an owner and set a date for validation.
3. Watch for
Copying a previous project without revalidating assumptions and stakeholders.
Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.
4. Watch for
Using the document as a private worksheet when it is meant to support a shared decision.
Recovery: Record the consequence, decision and rationale, then update the controlled baseline.
5. Watch for
Creating an approved baseline but failing to define who maintains it and when.
Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.
Review checklist
- Is the purpose and intended decision clear to a reader outside the team?
- Are owners, dates, measures and sources complete and internally consistent?
- Which fields are assumptions and how will they be validated?
- What event, threshold or review date causes this document to change?
- Are mandatory requirements distinguished from recommendations and illustrative values?
- Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
- Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
- Is there a named owner and a trigger for review, escalation, change or retirement?
Questions for deeper application
What is the most important distinction a practitioner must preserve when applying Risk Register Example: Website Redesign?
Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.
Which assumption about risk would change the result most if it proved false?
Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.
What evidence would allow an independent reviewer to reproduce or challenge the conclusion?
Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.
Which boundary, exception or failure case has not yet been tested?
Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.
What must be handed over, monitored or reviewed after the immediate work is complete?
Answer with a fact or cited source where available. Where evidence is incomplete, record the assumption, consequence, responsible owner and next validation action.
Authoritative references and use notes
The sources below were selected as institutional or primary guidance for the broader practice. They support the handbook method; they do not imply that every statement or clause in a source applies to every project. Confirm the current edition, jurisdiction, contract and application before treating any requirement as mandatory.
- Risk Management in Portfolios, Programs, and Projects: A Practice Guide — Project Management Institute. Used for risk practices across portfolios, programs and projects. Accessed 2026-08-13.
- ISO 31000 family — Risk management — International Organization for Standardization. Used for principles and guidance for enterprise risk management. Accessed 2026-08-13.
