Risk Register Structure and Maintenance
5 minutes
5 Questions
In the PMI Construction Professional (PMI-CP) framework, the risk register is the central living document for identifying, analyzing, and controlling uncertainties that could affect construction scope, schedule, cost, safety, and quality. Its structure typically includes these fields: a unique Risk ID; a risk category aligned to a Risk Breakdown Structure (for example design, site conditions, procurement, regulatory, contractual, weather, labor, or stakeholder); and a clear risk statement written in cause-event-effect format, such as 'Due to unverified subsurface data, unexpected rock may be encountered, causing excavation delays and cost overruns.' The register also records the risk owner accountable for monitoring and response, along with probability and impact ratings on defined scales that produce a risk score or priority ranking. Further entries capture affected objectives and WBS elements, triggers or early warning signs, and the response strategy. For threats, responses are avoid, transfer, mitigate, accept, or escalate. For opportunities, they are exploit, share, enhance, accept, or escalate. Finally, the register lists specific action items with due dates, contingency and fallback plans, residual and secondary risks, cost and schedule contingency allocations, and current status. In construction, contractual risk allocation is critical. The register should note which party bears each risk under the contract, such as owner, general contractor, subcontractor, or designer, including provisions like differing site conditions or force majeure clauses. Maintenance is continuous throughout the project life cycle. The register is created during planning and updated at regular risk reviews, often tied to weekly site meetings or monthly progress reports. Teams add emerging risks, reassess ratings as conditions change, close risks that have passed, and record realized risks as issues in the issue log. Change orders, RFIs, schedule updates, and safety incidents should trigger reviews. Version control, transparent communication to stakeholders, and integration with earned value and schedule analysis keep the register reliable. Lessons learned from closed risks feed organizational process assets for future projects.
Risk Register Structure and Maintenance: A Complete Guide for PMI-CP Construction Risk Management
Introduction
The risk register is the central document of construction risk management. In the PMI Construction Professional (PMI-CP) certification it is the living record of every identified threat and opportunity on a project, together with its analysis, ownership, responses and current status. Many exam questions on construction risk come back to one idea: if a risk is not in the register, it is not being managed. This guide explains why the register matters, what it contains, how it is built and kept current, and how to answer exam questions about it.
1. Why the Risk Register Is Important
Construction projects carry high exposure to uncertainty. Typical sources include:
- ground conditions
- weather
- permits
- supply chains
- subcontractor performance
- design changes
- safety
- contractual disputes
The risk register matters for several reasons:
- Single source of truth: it pulls risk information from the owner, designers, the general contractor, subcontractors and suppliers into one controlled document.
- Accountability: every risk has a named risk owner who must monitor it and carry out its responses.
- Decision support: it drives contingency and management reserve calculations, schedule buffers, procurement strategy and contract clauses such as allocation, indemnities and insurance.
- Communication: it feeds status reports, progress meetings and stakeholder updates, so everyone knows the top risks.
- Contractual and claims protection: in construction the register often supports early warning notices, change orders and claims. A well-kept register shows the risk was identified, communicated and managed.
- Organizational learning: at closeout it becomes an input to lessons learned and to organizational process assets for future bids and projects.
- Safety and compliance: health, safety and environmental risks recorded and tracked in the register support regulatory duties.
2. What the Risk Register Is
The risk register is a project document, usually a spreadsheet, database or software module. It is first created as an output of the Identify Risks process. It is then progressively updated through:
- Perform Qualitative Risk Analysis
- Perform Quantitative Risk Analysis
- Plan Risk Responses
- Implement Risk Responses
- Monitor Risks
Keep three related documents distinct:
- Risk Management Plan: describes how risk will be managed. It covers methodology, roles, budget, timing, risk categories (often a Risk Breakdown Structure), probability and impact definitions, the probability-impact matrix, thresholds and tracking formats.
- Risk Register: records the individual risks themselves.
- Risk Report: summarizes overall project risk exposure and sources of overall risk, alongside summary information on individual risks.
3. Typical Structure: Fields of a Construction Risk Register
Identification fields
- Risk ID: a unique number for traceability.
- Date identified and identified by.
- Risk category: for example technical/design, site and ground conditions, environmental, regulatory/permitting, commercial/contractual, procurement/supply chain, labor, safety, weather, stakeholder/community, or financial. Categories usually come from the Risk Breakdown Structure.
- Risk statement: written as cause, risk and effect. Example: Because the geotechnical survey covered only 40% of the site (cause), unexpected rock may be encountered during excavation (risk), resulting in a 3-week delay and $250,000 additional cost (effect).
- Threat or opportunity: registers cover both negative and positive risks.
- Affected WBS element, activity or location.
- Triggers or warning signs: for example a rainfall forecast above a threshold, or a supplier missing a shop drawing deadline.
Analysis fields
- Probability rating: for example 1 to 5, or a percentage.
- Impact ratings: on cost, schedule, quality, scope, safety and reputation.
- Risk score or priority: probability multiplied by impact, mapped on the probability-impact matrix as high, medium or low.
- Urgency, proximity, detectability, manageability where these are used.
- Quantitative data: expected monetary value (EMV = probability x impact), three-point estimates, and input to Monte Carlo simulation.
Response fields
- Risk owner: the person best placed to manage the risk. This is not necessarily the project manager.
- Response strategy for threats: escalate, avoid, transfer, mitigate or accept.
- Response strategy for opportunities: escalate, exploit, share, enhance or accept.
- Specific response actions: with action owners, due dates and cost of response.
- Contingency plan (fallback): what to do if the trigger occurs, plus a fallback plan if the primary response fails.
- Residual risk: the risk remaining after responses are applied.
- Secondary risks: new risks created by the response. For example, transferring work to a specialist subcontractor creates a subcontractor default risk.
- Contingency reserve allocated.
Monitoring fields
- Status: open, active or triggered, occurred (now an issue), closed, or escalated.
- Date of last review and next review.
- Trend: increasing, stable or decreasing.
- Comments and history log.
- Link to issue log or change request if the risk materializes.
Construction-specific additions
- Contractual risk allocation: owner, contractor, shared or insured.
- Contract clause reference.
- Early warning notice reference.
- Insurance or bond coverage.
- Permit or authority reference.
4. How the Register Works: Lifecycle and Maintenance
Step 1: Create. Build the register during planning, or even at bid stage, using:
- brainstorming and expert judgment
- checklists and lessons learned
- SWOT and assumption analysis
- site visits and document reviews (drawings, specifications, geotechnical reports, contracts)
- constructability reviews
- interviews with subcontractors
Step 2: Analyze and prioritize. Apply the probability and impact definitions from the risk management plan. High-priority risks may go to quantitative analysis, such as schedule risk analysis or cost Monte Carlo simulation.
Step 3: Plan responses. Assign owners, select strategies, cost the responses and update the budget, schedule and contracts through change control where needed.
Step 4: Implement responses. Risk owners carry out the agreed actions. Results are recorded in the register.
Step 5: Monitor and maintain. This is the heart of maintenance:
- Review the register at a regular cadence: weekly site meetings, monthly risk reviews, and stage gates or milestones.
- Re-assess probability and impact as conditions change. Once excavation is finished, for example, ground condition risks should be closed.
- Add newly identified and emergent risks.
- Record triggered risks, then execute contingency plans and log the event as an issue.
- Close risks that have expired, and record why.
- Track residual and secondary risks.
- Hold risk audits to check that the process is effective.
- Run reserve analysis to compare remaining contingency against remaining risk.
- Use workaround documentation for unplanned responses to risks that were not identified.
- Feed updates into change requests, the issue log, the lessons learned register, the risk report and the assumption log.
Step 6: Close. At project closeout:
- close all remaining risks
- archive the register
- capture lessons learned, such as which risks occurred, which responses worked and how accurate the estimates were
- update organizational process assets
5. Key Distinctions the Exam Tests
- Risk vs. issue: a risk is uncertain and in the future. An issue has already happened. When a risk occurs, it moves to the issue log and the register status is updated.
- Contingency plan vs. workaround: a contingency plan is planned in advance for an identified risk. A workaround is an unplanned response to an unidentified risk or a failed response.
- Contingency reserve vs. management reserve: contingency reserve covers identified risks (known-unknowns) and is managed by the PM. Management reserve covers unidentified risks (unknown-unknowns) and needs management or sponsor approval.
- Residual vs. secondary risk: residual risk is what remains after a response. Secondary risk is a new risk caused by a response.
- Risk owner vs. action owner: the risk owner is accountable for the risk. Action owners carry out specific tasks.
- Watch list: low-priority risks stay in the register on a watch list and are reviewed periodically, not deleted.
6. Common Pitfalls in Practice
- Creating the register at kickoff and never updating it (the 'shelf document' problem).
- Vague risk statements such as 'weather' with no cause or effect.
- No named owner, or the PM listed as owner for everything.
- Ignoring opportunities.
- Not linking risks to schedule activities and cost estimates.
- Deleting closed risks instead of keeping their history.
- Not sharing the register with subcontractors who own or influence risks.
- Mixing issues and risks in one list without status control.
7. Worked Example
Risk R-017:
- Category: Supply chain.
- Statement: Due to a single-source supplier for curtain wall panels, fabrication delays may occur, causing up to 6 weeks of facade delay and liquidated damages exposure.
- Analysis: probability 40%, impact $300,000, giving EMV = $120,000. Rated high.
- Owner: Procurement Manager.
- Strategy: Mitigate. Pre-qualify a second supplier, place an early order, and add factory inspections.
- Trigger: supplier misses the shop drawing submission by more than 5 days.
- Contingency plan: release a partial order to the alternate supplier.
- Residual risk: 15%.
- Secondary risk: interface mismatch between two panel suppliers.
- Status: Open, reviewed monthly.
Exam Tips: Answering Questions on Risk Register Structure and Maintenance
1. Check the register first. If a scenario describes a risk event or a new concern, the best first step is usually to consult or update the risk register. Do not jump to escalation or a change request without assessment.
2. A newly identified risk is added and analyzed. It is not immediately escalated or ignored. Record it, assess it, assign an owner and plan a response.
3. An identified risk has occurred. Implement the contingency plan in the register, update the register, and log the issue. If the risk was not identified, apply a workaround, then add it to the register and the lessons learned.
4. Know where the register is created. It is first an output of Identify Risks and is updated by every later risk process. Do not confuse it with the risk management plan.
5. Owners are named individuals best positioned to manage the risk. An answer assigning ownership to the person closest to the risk, such as a subcontractor foreman or the procurement lead, is often correct.
6. Low-priority risks go on the watch list. They are not deleted.
7. Closing risks: close a risk only when it can no longer occur, such as after the activity is complete. Record the rationale and keep the history.
8. Look for words that signal maintenance: 'periodic review', 'reassess', 'risk audit', 'reserve analysis', 'trend'. These point to Monitor Risks.
9. Responses create secondary risks. These must also be entered in the register.
10. Construction context: expect links to contract risk allocation, early warning notices, insurance, safety and claims. The register supports documented, proactive communication with the owner.
11. Calculate EMV carefully. Threats are negative and opportunities positive. Contingency reserve is usually the sum of EMVs of identified risks, not management reserve.
12. Prefer proactive, collaborative answers. Good options review the register with the team and stakeholders, engage subcontractors and update it regularly. Weak options leave risk management to the PM alone or treat it as a one-time task.
13. Eliminate weak options. Rule out answers that skip analysis, ignore the documented contingency plan, delete risks, or blame others.
14. Remember both threats and opportunities. An option that exploits or enhances a positive risk recorded in the register is valid.
Summary
The risk register is the structured, living record of individual project risks. It runs from identification through analysis, response, monitoring and closure. Its value in construction comes from:
- clear cause-risk-effect statements
- named owners
- defined triggers and contingency plans
- links to cost, schedule and contracts
- disciplined, regular maintenance
In the exam, choose answers that keep the register current, assess before acting, follow documented plans, and turn experience into lessons learned.
The risk register is the central document of construction risk management. In the PMI Construction Professional (PMI-CP) certification it is the living record of every identified threat and opportunity on a project, together with its analysis, ownership, responses and current status. Many exam questions on construction risk come back to one idea: if a risk is not in the register, it is not being managed. This guide explains why the register matters, what it contains, how it is built and kept current, and how to answer exam questions about it.
1. Why the Risk Register Is Important
Construction projects carry high exposure to uncertainty. Typical sources include:
- ground conditions
- weather
- permits
- supply chains
- subcontractor performance
- design changes
- safety
- contractual disputes
The risk register matters for several reasons:
- Single source of truth: it pulls risk information from the owner, designers, the general contractor, subcontractors and suppliers into one controlled document.
- Accountability: every risk has a named risk owner who must monitor it and carry out its responses.
- Decision support: it drives contingency and management reserve calculations, schedule buffers, procurement strategy and contract clauses such as allocation, indemnities and insurance.
- Communication: it feeds status reports, progress meetings and stakeholder updates, so everyone knows the top risks.
- Contractual and claims protection: in construction the register often supports early warning notices, change orders and claims. A well-kept register shows the risk was identified, communicated and managed.
- Organizational learning: at closeout it becomes an input to lessons learned and to organizational process assets for future bids and projects.
- Safety and compliance: health, safety and environmental risks recorded and tracked in the register support regulatory duties.
2. What the Risk Register Is
The risk register is a project document, usually a spreadsheet, database or software module. It is first created as an output of the Identify Risks process. It is then progressively updated through:
- Perform Qualitative Risk Analysis
- Perform Quantitative Risk Analysis
- Plan Risk Responses
- Implement Risk Responses
- Monitor Risks
Keep three related documents distinct:
- Risk Management Plan: describes how risk will be managed. It covers methodology, roles, budget, timing, risk categories (often a Risk Breakdown Structure), probability and impact definitions, the probability-impact matrix, thresholds and tracking formats.
- Risk Register: records the individual risks themselves.
- Risk Report: summarizes overall project risk exposure and sources of overall risk, alongside summary information on individual risks.
3. Typical Structure: Fields of a Construction Risk Register
Identification fields
- Risk ID: a unique number for traceability.
- Date identified and identified by.
- Risk category: for example technical/design, site and ground conditions, environmental, regulatory/permitting, commercial/contractual, procurement/supply chain, labor, safety, weather, stakeholder/community, or financial. Categories usually come from the Risk Breakdown Structure.
- Risk statement: written as cause, risk and effect. Example: Because the geotechnical survey covered only 40% of the site (cause), unexpected rock may be encountered during excavation (risk), resulting in a 3-week delay and $250,000 additional cost (effect).
- Threat or opportunity: registers cover both negative and positive risks.
- Affected WBS element, activity or location.
- Triggers or warning signs: for example a rainfall forecast above a threshold, or a supplier missing a shop drawing deadline.
Analysis fields
- Probability rating: for example 1 to 5, or a percentage.
- Impact ratings: on cost, schedule, quality, scope, safety and reputation.
- Risk score or priority: probability multiplied by impact, mapped on the probability-impact matrix as high, medium or low.
- Urgency, proximity, detectability, manageability where these are used.
- Quantitative data: expected monetary value (EMV = probability x impact), three-point estimates, and input to Monte Carlo simulation.
Response fields
- Risk owner: the person best placed to manage the risk. This is not necessarily the project manager.
- Response strategy for threats: escalate, avoid, transfer, mitigate or accept.
- Response strategy for opportunities: escalate, exploit, share, enhance or accept.
- Specific response actions: with action owners, due dates and cost of response.
- Contingency plan (fallback): what to do if the trigger occurs, plus a fallback plan if the primary response fails.
- Residual risk: the risk remaining after responses are applied.
- Secondary risks: new risks created by the response. For example, transferring work to a specialist subcontractor creates a subcontractor default risk.
- Contingency reserve allocated.
Monitoring fields
- Status: open, active or triggered, occurred (now an issue), closed, or escalated.
- Date of last review and next review.
- Trend: increasing, stable or decreasing.
- Comments and history log.
- Link to issue log or change request if the risk materializes.
Construction-specific additions
- Contractual risk allocation: owner, contractor, shared or insured.
- Contract clause reference.
- Early warning notice reference.
- Insurance or bond coverage.
- Permit or authority reference.
4. How the Register Works: Lifecycle and Maintenance
Step 1: Create. Build the register during planning, or even at bid stage, using:
- brainstorming and expert judgment
- checklists and lessons learned
- SWOT and assumption analysis
- site visits and document reviews (drawings, specifications, geotechnical reports, contracts)
- constructability reviews
- interviews with subcontractors
Step 2: Analyze and prioritize. Apply the probability and impact definitions from the risk management plan. High-priority risks may go to quantitative analysis, such as schedule risk analysis or cost Monte Carlo simulation.
Step 3: Plan responses. Assign owners, select strategies, cost the responses and update the budget, schedule and contracts through change control where needed.
Step 4: Implement responses. Risk owners carry out the agreed actions. Results are recorded in the register.
Step 5: Monitor and maintain. This is the heart of maintenance:
- Review the register at a regular cadence: weekly site meetings, monthly risk reviews, and stage gates or milestones.
- Re-assess probability and impact as conditions change. Once excavation is finished, for example, ground condition risks should be closed.
- Add newly identified and emergent risks.
- Record triggered risks, then execute contingency plans and log the event as an issue.
- Close risks that have expired, and record why.
- Track residual and secondary risks.
- Hold risk audits to check that the process is effective.
- Run reserve analysis to compare remaining contingency against remaining risk.
- Use workaround documentation for unplanned responses to risks that were not identified.
- Feed updates into change requests, the issue log, the lessons learned register, the risk report and the assumption log.
Step 6: Close. At project closeout:
- close all remaining risks
- archive the register
- capture lessons learned, such as which risks occurred, which responses worked and how accurate the estimates were
- update organizational process assets
5. Key Distinctions the Exam Tests
- Risk vs. issue: a risk is uncertain and in the future. An issue has already happened. When a risk occurs, it moves to the issue log and the register status is updated.
- Contingency plan vs. workaround: a contingency plan is planned in advance for an identified risk. A workaround is an unplanned response to an unidentified risk or a failed response.
- Contingency reserve vs. management reserve: contingency reserve covers identified risks (known-unknowns) and is managed by the PM. Management reserve covers unidentified risks (unknown-unknowns) and needs management or sponsor approval.
- Residual vs. secondary risk: residual risk is what remains after a response. Secondary risk is a new risk caused by a response.
- Risk owner vs. action owner: the risk owner is accountable for the risk. Action owners carry out specific tasks.
- Watch list: low-priority risks stay in the register on a watch list and are reviewed periodically, not deleted.
6. Common Pitfalls in Practice
- Creating the register at kickoff and never updating it (the 'shelf document' problem).
- Vague risk statements such as 'weather' with no cause or effect.
- No named owner, or the PM listed as owner for everything.
- Ignoring opportunities.
- Not linking risks to schedule activities and cost estimates.
- Deleting closed risks instead of keeping their history.
- Not sharing the register with subcontractors who own or influence risks.
- Mixing issues and risks in one list without status control.
7. Worked Example
Risk R-017:
- Category: Supply chain.
- Statement: Due to a single-source supplier for curtain wall panels, fabrication delays may occur, causing up to 6 weeks of facade delay and liquidated damages exposure.
- Analysis: probability 40%, impact $300,000, giving EMV = $120,000. Rated high.
- Owner: Procurement Manager.
- Strategy: Mitigate. Pre-qualify a second supplier, place an early order, and add factory inspections.
- Trigger: supplier misses the shop drawing submission by more than 5 days.
- Contingency plan: release a partial order to the alternate supplier.
- Residual risk: 15%.
- Secondary risk: interface mismatch between two panel suppliers.
- Status: Open, reviewed monthly.
Exam Tips: Answering Questions on Risk Register Structure and Maintenance
1. Check the register first. If a scenario describes a risk event or a new concern, the best first step is usually to consult or update the risk register. Do not jump to escalation or a change request without assessment.
2. A newly identified risk is added and analyzed. It is not immediately escalated or ignored. Record it, assess it, assign an owner and plan a response.
3. An identified risk has occurred. Implement the contingency plan in the register, update the register, and log the issue. If the risk was not identified, apply a workaround, then add it to the register and the lessons learned.
4. Know where the register is created. It is first an output of Identify Risks and is updated by every later risk process. Do not confuse it with the risk management plan.
5. Owners are named individuals best positioned to manage the risk. An answer assigning ownership to the person closest to the risk, such as a subcontractor foreman or the procurement lead, is often correct.
6. Low-priority risks go on the watch list. They are not deleted.
7. Closing risks: close a risk only when it can no longer occur, such as after the activity is complete. Record the rationale and keep the history.
8. Look for words that signal maintenance: 'periodic review', 'reassess', 'risk audit', 'reserve analysis', 'trend'. These point to Monitor Risks.
9. Responses create secondary risks. These must also be entered in the register.
10. Construction context: expect links to contract risk allocation, early warning notices, insurance, safety and claims. The register supports documented, proactive communication with the owner.
11. Calculate EMV carefully. Threats are negative and opportunities positive. Contingency reserve is usually the sum of EMVs of identified risks, not management reserve.
12. Prefer proactive, collaborative answers. Good options review the register with the team and stakeholders, engage subcontractors and update it regularly. Weak options leave risk management to the PM alone or treat it as a one-time task.
13. Eliminate weak options. Rule out answers that skip analysis, ignore the documented contingency plan, delete risks, or blame others.
14. Remember both threats and opportunities. An option that exploits or enhances a positive risk recorded in the register is valid.
Summary
The risk register is the structured, living record of individual project risks. It runs from identification through analysis, response, monitoring and closure. Its value in construction comes from:
- clear cause-risk-effect statements
- named owners
- defined triggers and contingency plans
- links to cost, schedule and contracts
- disciplined, regular maintenance
In the exam, choose answers that keep the register current, assess before acting, follow documented plans, and turn experience into lessons learned.
Test mode:
PMI-CP - Risk Register Structure and Maintenance Example Questions
Test your knowledge of Risk Register Structure and Maintenance
Question 1
On a construction project, what distinguishes an entry in the risk register from an entry in the issue log?
Question 2
On a commercial building project, the governance plan lets the project manager accept risks with an expected monetary value (EMV) of up to 150,000. Larger exposures must go to the project board for a response decision. A new risk register entry for steel price escalation shows a 40% probability and a 500,000 cost impact. The team proposes logging it as accepted and covering it from the project manager's contingency. What should the project manager do with this register entry?
Question 3
On a highway interchange project, the risk register holds one current probability-impact score per risk. The risk coordinator overwrites that score after each monthly review. The sponsor now asks whether the response actions on the ten highest risks are reducing exposure over time, and the team cannot answer. Which register change BEST closes this gap?
Unlock Premium Access
PMI Construction Professional (PMI-CP)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2667 Superior-grade PMI Construction Professional (PMI-CP) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- PMI-CP: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Risk Register Structure and Maintenance questions
15 questions (total)
Other Construction Risk Management concepts
Contingency and Reserves for Construction RiskFront End Planning and Project DefinitionIPRA Elements and Assessment SessionsMobilizing a Risk Management Framework at the OutsetMonte Carlo Simulation for Cost and Schedule RiskPositive Risk and Opportunity in ConstructionProbabilistic Risk Analysis TechniquesQualitative Probability and Impact AssessmentQuantitative Risk Analysis and Cost RangesRisk Breakdown Structure for ConstructionRisk Classifications in Built Environment ProjectsRisk Evaluation and AllocationRisk Identification Techniques for ConstructionRisk Lessons Learned and Historical DataRisk Monitoring and ReassessmentRisk Ownership and AccountabilityRisk Prioritization During Front End PlanningRisk Response Strategies in ConstructionRisk Workshops and Expert ElicitationSelecting Risk Tools by Project ComplexityStakeholder Input to the Risk ProcessThe Integrated Project Risk Assessment (IPRA) ToolThe Risk Process Across the Project Life Cycle