Risk is not a register

Ask most organizations to show you their risk management and you will be handed a register. Rows of things that might go wrong, each scored for likelihood and impact, each with an owner, each reviewed quarterly.

It is a useful artefact. It is not risk management.

The register answers the wrong question

A risk register asks: what could go wrong? It is a catalogue of downside events, maintained because someone must maintain it, reviewed because the calendar says so.

But risk is not a list of bad things. Risk is uncertainty — the possibility that reality may differ from our expectations, for better or for worse. The register captures one tail of that distribution and ignores everything else: the assumptions the strategy rests on, the upside you are not positioned to capture, the second-order effects of the mitigations themselves.

If your risk process only ever produces reasons to be careful, it is not measuring uncertainty. It is measuring anxiety.

Three symptoms of a register that has replaced thinking

You can usually tell when the artefact has become the activity.

• The register is complete and the surprises still happen. Nothing on the list caused the crisis. The crisis came from an assumption nobody wrote down, because assumptions are not “risks” and so had no row to live in.
• Scores move but decisions don’t. A risk moves from amber to red and the only consequence is a different colour in the pack. If a score change never changes a decision, the score is decoration.
• Ownership is nominal. Every risk has an owner, and no owner has the authority to act on it alone. Accountability was assigned; the decision rights were not.

What to ask instead

The question that produces better risk management is not what could go wrong? It is:

What are we assuming, and what would have to be true for this to work?

That reframing does three things a register cannot. It surfaces the assumptions the plan actually depends on, rather than the hazards that are easy to name. It makes the uncertainty two-sided, so the conversation includes what you would do if things went better than planned. And it attaches the uncertainty to a decision, which is the only place risk information has any value.

Risk work should end in a decision

Here is a practical test. Take any item in your register and ask: which decision does this change, and who makes it?

If there is no decision, the item is trivia — accurate, perhaps, but inert. If there is a decision but no decision-maker in the room, you have a reporting problem, not a risk problem. If there is a decision and a decision-maker and the information arrives after the decision is made, you have a timing problem, and the register is actively wasting people’s attention.

Good risk management is not a better list. It is a shorter distance between an uncertainty and the person who has to act on it.

The register can stay. It just should not be the point.