Risk Management in Construction - How to Keep a Risk Register
Anyone who has run a site knows this conversation. Something has gone wrong - the rebar delivery is late, the excavation hit groundwater, the subcontractor has not shown up for two weeks - and someone says: "We knew this could happen." Often they really did. It is just that nobody wrote it down, nobody decided what to do about it, and nobody looked at it again until it was too late.
Risk management is an attempt to have that conversation before the problem, not after it.
What is a risk in construction
A risk is something that has not happened yet but could, and if it does, it will cost you something. Most often that is money or time, sometimes quality, and in the worst case the health of the people on site.
It helps to separate two things that tend to get mixed up in conversation: where the risk comes from and what it affects. A rainy season during the roofing works comes from the weather, but it affects the schedule. An unclear clause in the contract comes from the contract, but it affects the money. If you sort risks by source, you see where your weak spots are as a company. If you look at them by consequence, you see exactly what threatens the site.
The typical sources of risk on a construction site are fairly constant:
- the design - errors, omissions, changes during construction;
- the ground - unexpected geological conditions, groundwater, existing underground utilities;
- safety - working at height, excavations, heavy machinery;
- workmanship - method errors, substandard materials;
- people and machines - shortage of workers, equipment breakdowns;
- procurement - late or more expensive materials;
- subcontractors - delays, lack of capacity, insolvency;
- money - late payments from the client, price spikes;
- the contract - disputes, penalties, changes in scope;
- the weather - rain, frost, wind, heat;
- permits - approvals and connection to the utility networks;
- third parties - neighbours, complaints, traffic, noise and dust.
Why bother at all
Construction companies rarely go under because of one big problem. More often it is an accumulation of small, foreseeable things, each of which ate a little of the profit. Most of them someone on site sensed early on.
A risk register does not predict the future. It does three more modest and more useful things. First, it turns a vague worry into a concrete entry with a name and an owner. Second, it makes you come back to the risk regularly, instead of remembering it only once it has happened. And third, it leaves a trail - when the same situation comes up on the next site, there is somewhere to look for what worked.
There is also a more mundane reason. More and more clients, especially in public procurement and under FIDIC contracts, expect the contractor to show that it manages its risks. The register is the simplest proof.
How to assess a risk
The most widespread method, and one that is entirely sufficient in practice, uses two scales from 1 to 5.
Probability - how likely it is to happen:
| Rating | Description |
|---|---|
| 1 | Rare - below 10% |
| 2 | Unlikely - 10% to 30% |
| 3 | Possible - 30% to 50% |
| 4 | Likely - 50% to 80% |
| 5 | Almost certain - 80% or more |
Impact - how bad it would be if it happened. Here it matters that the scale is described with concrete thresholds, otherwise everyone rates "by feel" and two people's assessments cannot be compared. For money, for example, the thresholds can be relative to the contract value of the site: below 1% is insignificant, 5% to 10% is major, over 10% is severe. For safety, the scale runs from "first aid only" to "fatal accident".
When a risk affects several things at once, the impact is rated by the most severe of them. If a late crane means both a week's delay and a hazard from moving loads by hand, safety is what counts.
Multiplying the two ratings gives a risk score from 1 to 25:
- 1-4 - low. Keep an eye on it, but no special action is needed.
- 5-12 - medium. Needs measures and an owner.
- 15-25 - high. Needs attention now and regular review.
Laid out in a five-by-five grid, with probability on one axis and impact on the other, the risks form a risk matrix. It is the quickest way to see the state of the site at a glance: how many things sit in the red corner, and whether it is filling up or emptying.
What you do with a risk
The assessment on its own changes nothing. What reduces a risk are measures: concrete actions with an owner and a deadline. "Be careful with the excavation" is not a measure. "Surveyor to map the existing utilities by Friday" is a measure.
A risk goes through several states. It is logged, then assessed, then measures are carried out. In the end there are two outcomes. Either the danger passes and the risk is closed, or it happens and the risk has occurred. The second case is not a failure of the register. That is exactly when what you wrote down is worth the most, because the measures are already agreed and people know what to do.
The most important part of the whole process is regular review. A risk assessed once at the start of the job and then forgotten is almost as useless as a risk that was never written down. Circumstances change: the excavation finishes, the supplier is replaced, winter arrives. The higher the risk, the more often it is worth a look.
How the risk register works in Construction Team
In Construction Team the risk register lives in the "Field" section and in the "Risks" tab of each object. Here is what the approach described above looks like in practice.
ConstructionTeamSearch documents, counterparties, contracts...⌘KNew from file18DADemo Administrator
Risk register
Field / Risks
Summary by object
All risks across your sites in one place. The summary at the top tells you where to look first: active high risks, overdue reviews and risks not yet assessed.
Logging
With the "New risk" button you fill in a title ("What might happen?"), the object and the category. The categories are the twelve sources from the list above plus "Other", each with a short note on what it covers. Optionally you add a description, a location on site (for example "Section B, floor 3") and tick what the risk affects: cost, schedule, quality or safety. Every risk gets an RSK number with the object code, so in a site meeting you can talk about a specific entry.
Risks are rarely born at a desk. They usually come out of something else: an RFI to the designer, a defect, a meeting or a daily log entry. That is why these four records have a "Record as risk" button. It opens the form with fields filled in from the source, and the risk then stays linked to the record it came from. When you open the defect, you also see the risks logged from it.
Assessment
The "Assess" button opens probability and impact. If you have not ticked what the risk affects, the system will not let you assess it, because without that it is not clear which scale the impact is measured on. Next to the fields there are "Scale definitions" with the thresholds for each area, so everyone rates the same way.
The risk score is calculated automatically and the risk gets a colour: green, yellow or red, with unassessed risks shown in grey. With each assessment you can leave a note on what was discussed.
Owner and measures
Each risk can have a risk owner - the person who keeps track of it. They are notified when they are assigned.
Measures are added one at a time. Each has a description, a deadline and an assignee. The assignee can be a colleague or simply a name, for example a subcontractor who has no account in the system. When the measures actually get under way, the risk is marked as "Mitigation in progress". Overdue measures are visible straight away.
Reviews and reminders
Each risk has a next review date that the system suggests on its own based on the level: high after 7 days, medium after 14, low after 30. Unassessed risks are reviewed within a week, so they do not sit without an assessment forever. You can change the date by hand if you know better.
When a review is coming up, the owner gets a reminder. If there is no owner, or they have left the company, the reminder does not disappear but goes to another person with access to risks. The same applies to measure deadlines.
If you have looked at a risk and nothing has changed, the "Reviewed, no change" button records the review and moves the next date on. In the list you can select several risks at once and confirm them together, which saves time in the weekly site meeting.
Closing and occurrence
A risk is closed with a short note on why, for example "Excavation works finished without a collapse". Its open measures are cancelled and the reminders stop.
If the risk happens, you mark it as occurred, with a date and a description of the consequences. Reviews stop, but the measures stay on as response actions and keep sending reminders. The consequences can be filled in later, once the real costs and delay are known. If you closed a risk too early, it can be reopened.
Every assessment, every review and every status change stays in the risk's history. So months later you can see not only where the risk stands now, but how it got there.
The big picture
The risk list can be filtered by object, category, status, risk level, owner and overdue review. On the object there is a five-by-five risk matrix: click a cell and you see exactly which risks sit in it. Next to it is a summary with the three numbers that deserve attention - active high risks, overdue reviews and unassessed risks.
The register can be downloaded as PDF or Excel with the filters and sorting you chose in the list. In the PDF each risk shows its initial and current assessment, so you can see whether the measures worked. It is handy for a report or for a conversation with the client.
What is left to you
The system does not know which risks exist on your site. It cannot judge whether the subcontractor will cope, or how likely it is that the municipality will hold up an approval. It keeps what you record, reminds you and shows the picture, but the thinking stays with the people who know the site.
Do not expect the register to be complete from day one either. A good start is five or six risks the team already discusses at every site meeting. Once reviewing becomes a habit, the list grows on its own.
Where to start
- Get the site manager, the technical manager and the person handling procurement around one table.
- Each of them names the three things that worry them most on this site.
- Log them as risks, assess them and give each one an owner.
- For every high risk, record at least one measure with a deadline.
- Make the risk review a standing item in the weekly site meeting.
That is enough. Sophisticated methods have their place on large projects, but on most sites the difference is not made by the method, it is made by whether anyone actually goes back to the list.
Related articles
Frequently asked questions
What is a risk register in construction?
A risk register is a list of the things that could happen on site and cost you money, time, quality or safety. For each risk you record where it comes from, how likely it is, how hard it would hit, who is responsible for it and what measures are being taken. The point is that the risk is visible and reviewed regularly, not kept in one person's head.
How do you assess a risk?
The most common approach uses two scales from 1 to 5: probability and impact. Multiplying them gives a risk score from 1 to 25. Typically 1-4 is a low risk, 5-12 medium and 15-25 high. Impact is rated by the most severe consequence - if the risk hits both the schedule and safety, the more severe of the two is what counts.
How often should risks be reviewed?
The more serious the risk, the more often. A sensible practice is to review high risks every week, medium ones every two weeks and low ones once a month. Newly logged risks that have not been assessed yet should also be looked at within a week.
What is the difference between a closed and an occurred risk?
A closed risk can no longer happen - for example, the excavation work finished without a collapse. An occurred risk has happened and is now a problem: you record the date and the consequences, and the measures carry on as response actions. Both stay in the history, because that is what the next site learns from.
Do you need dedicated software for risk management?
Not necessarily. A small site can be run from a spreadsheet. The trouble with a spreadsheet is that nobody reminds you when a review is due, measures have no deadlines or owners, and the history of assessments is lost with every edit. Software helps most where there are many risks and different people are responsible for them.