A Risk Register Should Tell You What to Do Before Trouble Arrives

Turn one project uncertainty into a clear warning sign, a named owner, and a response while there is still time to choose.

By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.

AI-generated illustration of community organizers checking preparations for an exhibition.

A project spreadsheet can contain a reassuring row: “Supplier delay. Medium risk. Monitor.” Yet on the morning materials are needed, nobody knows who last spoke to the supplier, what would have counted as a warning, or when a different plan should have been chosen. The concern was recorded. The decision was left unwritten.

For a small nonprofit or community team, a useful risk register should help answer a practical question: what would make us act before an uncertainty harms the work? Begin with one important commitment and one plausible way it could go wrong. Build a record that connects the concern to evidence, responsibility, and a response. The exercise below is an original planning aid for ordinary project delivery, not a substitute for specialist safety, safeguarding, legal, or financial procedures.

Write a situation someone can recognize

“The exhibition might fail” is too broad to guide a colleague. “Because the prints depend on one supplier with an unconfirmed production slot, delivery may arrive after setup, leaving some contributors without work on display” gives the team something to investigate. It names a cause, a possible event, and a consequence for people. The UK government's Orange Book, Annex 5, uses this cause, event, and consequence distinction in describing risk. Its formal context is government risk management; the exhibition example is a small-team adaptation.

Separate an uncertain future event from a problem already present. An unconfirmed production slot is something to check now. A missed delivery deadline is an issue requiring action now. Leaving both under “monitor” can conceal the moment the team's responsibility changes. Put a date beside the latest observation so that an old assurance does not silently become today's evidence.

Ask whose experience the consequence describes. A delay may mean extra work for an organizer, but it may also mean a contributor travels to an exhibition where their work is absent. Avoid describing residents, volunteers, or participants as risks. Describe the arrangement that may fail them: unavailable transport information, materials supplied in an unusable format, or a commitment made without a confirmed resource.

Keep existing protection separate from unfinished work

A control is an arrangement already operating to reduce a risk. An action is work still needed. “A second printer is available” and “ask whether another printer could help” are different statements. If the team has only sent an inquiry, record the inquiry. Do not lower the risk because a possible solution sounds convincing.

The Charity Commission's risk-management guidance, including its register examples, distinguishes the risk before controls from the risk remaining afterward. It also brings together responsibilities, monitoring, and further actions. That guidance applies to charities in England and Wales; here those distinctions are used as planning concepts, not as a statement of obligations elsewhere.

For your own record, ask what evidence would show that each protection works. A supplier's written acceptance of a specification is different from a friendly conversation. A tested alternative production method is different from a colleague saying they own a printer. Include the limit too: an alternative may handle a few small prints but not the complete exhibition. A partial fallback should not be described as complete protection.

A fictional exhibition with a decision still available

Consider this fictional teaching example. A neighborhood group is preparing a small exhibition of reproductions supplied with contributors' permission. The display is planned for Saturday, with setup on Friday. Rosa coordinates production; Ben approves changes to the event plan. Their main printer has accepted the files but has not confirmed when the order will enter production. No delay has happened yet.

The team initially writes “printing delay, medium, Rosa.” They revise the entry after asking when they would still have a workable choice. Waiting until Friday would leave no time to check a smaller local order or tell contributors about a change. They choose Wednesday noon as their decision point, based on the actual lead time quoted for their proposed alternative. This timing is an illustrative assumption, not a standard deadline for other projects.

The revised record fits on one page:

• Commitment and risk: Have the agreed prints ready for Friday setup. An unconfirmed production slot could cause late delivery and an incomplete display.

• Evidence and present protection: Files were accepted Monday. Production timing is still unconfirmed. Rosa holds the accepted specification and current order correspondence.

• Early warning and owner: Rosa checks for written production confirmation by Wednesday noon and tells Ben immediately if it is missing.

• Response and authority: Ben decides Wednesday afternoon whether to approve a smaller alternative order within the previously agreed spending limit, revise the display, or postpone. Rosa gathers options but cannot authorize extra spending.

• Remaining uncertainty and review: An alternative order is not secured until its scope, price, timing, and acceptance are confirmed. Review the decision and contributor communications that afternoon.

They also check their original order's terms before assuming it can be changed or cancelled. An alternative order could create a second bill without removing the first commitment. If no workable option is confirmed, Ben must choose an honest change to the exhibition and arrange timely communication. The register does not manufacture an available supplier. It makes the limit visible while a responsible decision is still possible.

On Wednesday, suppose production confirmation arrives, but the team learns that two files need correction. Rosa updates the entry and records who will supply corrected files and when. She does not mark the entire risk “closed” merely because one warning has passed. The question is whether the remaining uncertainty still threatens Friday setup.

Give “monitor” a meaning

Monitoring needs an observable signal, someone who will check it, and an action if the signal changes. “Stay in touch” leaves all three open. “Rosa checks written confirmation by Wednesday noon; missing confirmation goes to Ben that day” makes the check usable. The Orange Book's risk-treatment guidance explicitly includes responsible people, resources, early-warning indicators, and completion timing. A small team can express those elements in plain language.

Choose signals that arrive early enough to matter. The final failure is rarely a useful early warning. In the exhibition example, “prints absent on opening morning” offers almost no room to respond. A missed confirmation provides time to investigate. Equally, avoid a trigger so sensitive that every ordinary pause creates an emergency. Ask the person doing the work what can realistically be observed and how much response time is needed.

Some events provide little warning. For those, prepare a proportionate response rather than pretending a signal will always arrive. Identify who can stop an activity, communicate a change, or obtain appropriate help. A register should record uncertainty honestly, including uncertainty about the warning itself.

Use ratings to support judgment

A color or number can help a team compare concerns, but its meaning should be written down. What period is being assessed? What would “serious” mean for this commitment? What evidence supports the likelihood judgment? The Charity Commission's discussion of risk assessment notes the judgment involved in scoring and the importance of considering very high-impact events even when their likelihood appears remote.

For this first-row exercise, a short explanation can be more useful than an unexplained score: “Delivery remains uncertain; missing setup would exclude contributors; confirmation is due Wednesday.” Follow any assessment method your organization already requires. Never let a low numerical result become permission to ignore a serious safety or safeguarding concern. Those matters belong with the responsible qualified people and applicable procedures.

Bring the record into the next real decision

At the next project check-in, read the warning and response aloud. Can the owner obtain the evidence? Can the decision-maker be reached in time? Is the proposed fallback affordable and usable for the people affected? If a volunteer cannot check messages during working hours, change the monitoring arrangement instead of assigning an impossible responsibility. Keep sensitive details in appropriately controlled records; the planning page needs enough information to act, not everyone's personal story.

This focus on dependable implementation connects with Feel Worldwide Foundation Inc.'s Leadership, Institutions & Implementation Capacity pathway. Organizations exploring a relevant collaboration can connect with the foundation. For your own team, take one existing “monitor” entry today and add the missing observation, owner, decision time, and response. At the next review, ask whether that entry helped someone make a better-informed choice while the choice was still available.