A PMO Risk Register That Never Changes Is Not Managing Risk

If the same risks appear in every monthly pack with the same wording and no decision, the register is not controlling uncertainty. It is preserving paperwork.

The UK Government’s Teal Book describes risk management as an ongoing process of identifying, assessing, responding to, monitoring and reporting risk across portfolio, programme and project work. It also emphasises documented arrangements and alignment with wider organisational risk management. Use that as a management discipline, not a reason to create another spreadsheet. Teal Book: Risk Management

Make each entry operational

For every material risk, state:

• The uncertainty and objective affected: what might happen, and what outcome is exposed?
• The evidence and trigger: what would indicate the situation is changing?
• The accountable owner: who has authority to act, not just update the text?
• The response: what action reduces the exposure, and what contingency applies if it occurs?
• The decision threshold: what needs escalation, by whom and by when?
• The residual position: after action, what remains and who accepts it?

Avoid writing risks as vague events such as “supplier issue” or “resources”. Separate cause, uncertain event and consequence. A clear chain makes it easier to identify a response that can actually be delivered.

Use the register to reallocate effort

At each review, ask what has changed in the evidence, likelihood, impact, dependencies or response. Close items only when the exposure is resolved or consciously transferred, not because the date passed. Look across the portfolio for common dependencies and correlated risks: several projects may depend on the same scarce team, supplier or decision-maker.

When exposure exceeds authority or tolerance, put options in front of the right decision-maker. Show the impact of acting now, accepting the exposure, changing scope or stopping work. Record the choice and owner. Do not bury a decision request under a page of status colour.

Measure the PMO by decisions enabled

The PMO should provide a current view of the risks that can change delivery choices. That means less duplication, explicit escalation and evidence that responses were completed. It does not mean pretending uncertainty can be eliminated.

A live risk process gives leaders time to protect outcomes, redirect capacity and challenge an assumption before it becomes a missed commitment. A static register gives them a history of what the team already knew.

Source: UK Government Teal Book, Risk Management.