Insight · Projects

The risk register is filled in. Who owns the risks?

Peter Öberg · 1 November 2026 · 3 min read

I have seen plenty of risk registers. Most are well made, with probability, impact and colour codes. The problem is that they are often filled in at the start of the project and not opened again until something has gone wrong.

Inadequate risk assessment is expensive

When the Swedish National Audit Office reviewed cost control in large road investments, it emphasised that costs tend to be underestimated because of inadequate risk assessment in the estimates. In connection with a review of large railway investments, the government agreed that there were significant risks of cost increases, partly because of uncertain planning and underestimated costs.

It is not only central government that has this problem. In almost every project I have been part of, the biggest surprises were risks someone knew about but nobody owned.

A pattern I think many will recognise: right from the start, the risk register says the business may not have time to take part in testing. Probability is rated medium, impact high, and the risk turns amber. Then nothing happens. No manager in the business has been asked to free up time. When the test period arrives it clashes with the holidays, testing is half-hearted and the defects are only discovered in production. The risk was known from day one. It just had no owner.

Why the risk list does not help

The risks have no owner. A risk that belongs to the project really belongs to nobody. It needs a person who is responsible for watching it and acting.

The list is not updated. Risks change as the project moves on. A list from the start says little about the situation six months later.

The uncomfortable risks are not written down. That the client does not know what she wants, that a key person might leave, or that the budget was set politically rather than calculated. Such things are rarely in the register, but that is often where the trouble starts.

What I usually suggest

1. Give every major risk a named owner, outside the project team if that is where the risk sits.
2. Review the five biggest risks at every steering group meeting, not the whole list.
3. Ask explicitly for the uncomfortable risks. What does nobody want to say out loud? The answer is often the most important part of the whole risk analysis.

A question for your next leadership meeting

Which of the biggest risks in our most important project has a named owner other than the project manager?

Sources: Swedish National Audit Office review of cost control in large road investments, RiR 2010:25 (Swedish) · Government communication 2010/11:139 on cost control in large railway investments (Swedish)