The Risk & Opportunity Register – Lean, IPD Series

Why Projects Lose Money Waiting for Bad Things to Happen

Most project teams operate on hope. They hope the stone arrives on time. They hope the design does not change. They hope the trade partner delivers. They hope the materials do not escalate. And when those hopes do not materialize, they react. They scramble. They throw money at the problem. And the project bleeds budget because the team spent months hoping instead of minutes planning. This is not risk management. This is gambling. And it costs projects millions of dollars every single year.

Here is what happens on a typical project. The team meets for preconstruction. They talk through the scope. They identify some concerns. Someone mentions that the exterior stone looks complicated and the lead time might be tight. Someone else mentions that the tile package has design gaps that could cause issues later. And the team nods. They agree those are risks. And then they do nothing. They do not write them down. They do not assign dollar values. They do not assign ownership. They do not track them. And six months later, the stone arrives late and threatens the schedule. The tile package has errors and requires rework. And the project manager stands in front of the owner trying to explain why no one saw this coming. The answer is they did see it coming. They just never did anything about it.

The real pain is not the problem itself. It is the preventability. These were not surprises. They were identified risks that no one managed. The stone lead time was knowable. The tile design gaps were visible. The material escalations were predictable. But the team never translated those concerns into action. They never created a system to track risks, assign ownership, and prevent them from materializing. And when the risks became reality, the project paid the price. Schedule delays. Budget overruns. Stress. Panic. Late nights. Blame. All of it preventable if someone had taken fifteen minutes in preconstruction to create a risk and opportunity register.

The failure pattern is predictable. Teams identify risks informally. Someone mentions a concern in a meeting. Someone else agrees it could be a problem. And then the conversation moves on. The risk never gets documented. It never gets quantified. It never gets assigned. And it never gets tracked. So it sits in the back of everyone’s mind as a vague concern until it materializes as an expensive problem. And when it does, the team reacts instead of prevents. They throw money at it. They compress the schedule. They work overtime. They stress out. And they repeat the pattern on the next project because no one ever built a system to prevent the cycle. The system failed them by never teaching them that risk management is not reacting to problems. It is preventing them from happening in the first place.

I worked on a research laboratory project where we used a risk and opportunity register from day one. We identified every major risk we could think of. Scaffolding for the complex exterior. Floor flatness tolerances. Design changes for the added fourth floor. Material escalations. We wrote them down. We assigned dollar values. We assigned likelihood percentages. We projected contingency usage. And we set to work preventing those risks from materializing. We expedited long-lead items. We locked in pricing early. We coordinated design issues before they hit the field. And the project finished fantastically. On time. Under budget. With margin to spare. Not because we got lucky. Because we managed risks instead of hoping they would not happen.

Fast forward to another project. I recommended a risk and opportunity register. I told the team the exterior stone and tile were high-risk items that needed early attention. But I did not have ultimate authority. And the team did not prioritize it. So we never formalized the register. We never assigned ownership. We never tracked it. And six months later, the stone procurement was delayed and nearly affected the end date. The exact risk I had identified became the exact problem that stressed the team. And it could have been prevented if we had created a system to manage it. That failure is on me for not being more forceful. But it is also on the system for not requiring risk management as standard practice.

This matters because every project has risks. Design gaps. Long-lead materials. Weather delays. Trade partner performance. Unforeseen conditions. Price escalations. These are not surprises. They are predictable categories of risk that show up on every project. And the teams that succeed are the ones who identify those risks early, quantify them, assign ownership, and prevent them from materializing. The teams that fail are the ones who hope for the best and react when things go wrong. Hope is not a strategy. And reaction is expensive. Prevention is cheap. It takes fifteen minutes to create a risk register. It takes weeks to fix the problem that the register would have prevented.

What a Risk and Opportunity Register Actually Is

A risk and opportunity register is a simple Excel sheet or matrix that tracks every identified risk and opportunity on the project. It has columns for description, original conditions of satisfaction, probability, dollar amount, owner, and target dates. And it gets reviewed weekly in team meetings so the team can see what risks are on the horizon and take action to prevent them. This is not complicated. This is a spreadsheet. But it changes everything because it makes risks visible, quantifiable, and actionable. And once risks are visible, teams stop hoping and start managing.

The power of the register is in the quantification. When you write down a risk, it is vague. When you assign a dollar value and a probability percentage, it becomes real. If the exterior stone delay has a 60 percent likelihood of happening and a 200,000 dollar impact, the team suddenly pays attention. They calculate that risk into their financial projections. They see that if the risk materializes, the project loses margin. And they act to prevent it. Without the register, the stone delay is just a concern. With the register, it is a 120,000 dollar exposure that needs to be managed. That difference is everything.

The register also creates accountability. Every risk has an owner. Someone is responsible for monitoring it and taking action to reduce the likelihood or the impact. The owner tracks the risk weekly. They report on it in team meetings. And they implement mitigation strategies. If the stone lead time is the risk, the owner expedites procurement, locks in pricing early, and coordinates installation sequencing. The risk does not just sit there waiting to happen. Someone is actively working to prevent it. And that ownership changes outcomes. If your project needs superintendent coaching, project support, or leadership development, Elevate Construction can help your field teams stabilize, schedule, and flow.

The register should also be integrated into monthly status reports. Most projects report on financials, schedule, quality, and safety. But they do not report on risk exposure. They say we are projecting 96 percent margin. But they do not say if all identified risks materialize, we are projecting 81 percent margin. That second number is the truth. And the team needs to see it. Because if the gap between the projected margin and the risk-adjusted margin is too large, the team needs to act. They need to reduce risks. They need to increase contingency. They need to change the plan. But without visibility into risk exposure, the team operates on false confidence. They think they are fine when they are actually vulnerable. And when risks materialize, they are blindsided.

How to Build and Use a Risk and Opportunity Register

Start by creating the register in your fresh eyes meeting or preconstruction kickoff. Gather the team. Brainstorm every risk you can think of. Design gaps. Long-lead materials. Weather exposure. Trade partner performance. Unforeseen site conditions. Regulatory approvals. Material escalations. Coordination challenges. Write them all down. Do not filter. Do not dismiss. Get everything on the table. Then prioritize. Assign dollar values to each risk. Estimate the likelihood. Calculate the total exposure. And decide which risks need immediate action.

Next, assign ownership. Every risk needs a name next to it. Someone owns monitoring the stone procurement. Someone owns tracking the design coordination. Someone owns managing weather exposure. And that person reports on the risk weekly in team meetings. They update the likelihood. They update the dollar amount. They report on mitigation actions. And if the risk is no longer a concern, they remove it from the register. Ownership creates accountability. And accountability drives action.

Review the register weekly in your team meeting. Do not let it sit on a shelf gathering dust. Make it a standing agenda item. Start every meeting by reviewing risks. What changed this week? What new risks emerged? What risks were mitigated? What actions are needed? This keeps the team focused on prevention instead of reaction. And it creates a rhythm where risk management becomes habit instead of afterthought. The teams that succeed are the ones who talk about risks every single week. The teams that fail are the ones who create the register once and forget about it.

Signs You Need a Risk and Opportunity Register

Watch for these patterns that signal you are operating without proper risk management:

• Risks are discussed informally but never documented or tracked
• Problems surface late when they are expensive to fix instead of early when they are cheap to prevent
• The team reacts to issues instead of preventing them from happening
• Financial projections do not account for identified risks or contingency exposure
• No one owns monitoring specific risks or taking action to mitigate them
• Team meetings focus on current problems instead of future risks
• The project gets blindsided by issues that were foreseeable and preventable

These are not bad luck. These are system failures. And the fix is simple. Create a register. Track risks. Assign ownership. Review weekly. And prevent problems before they cost money.

Integrate Risk into Financial Reporting

One of the most powerful uses of the risk register is integrating it into financial projections. Most projects report a single margin number. We are projecting 96 percent. But that number assumes nothing goes wrong. It assumes all risks stay theoretical. And that is unrealistic. A better approach is to report two numbers. Projected margin if nothing goes wrong. And risk-adjusted margin if identified risks materialize. The gap between those two numbers is the truth. And the team needs to see it.

If your projected margin is 96 percent and your risk-adjusted margin is 81 percent, you have a problem. You have 15 percent of margin at risk. And unless you reduce those risks or increase contingency, you are vulnerable. That visibility creates urgency. The team stops operating on false confidence and starts acting to protect the project. They expedite procurement. They lock in pricing. They coordinate design. They reduce exposure. And the project finishes with margin intact because the team managed risk instead of ignoring it.

The Challenge

Walk into your next preconstruction meeting with a blank risk register template. Gather the team. Brainstorm every risk you can identify. Assign dollar values. Assign ownership. Calculate total exposure. And integrate it into your financial projections. Then review it weekly in team meetings. Track progress. Update probabilities. Remove mitigated risks. Add new ones. And watch what happens when the team shifts from reacting to problems to preventing them. As Dr. Eli Goldratt said, “Every situation can be substantially improved. Even the sky is not the limit.” Risk management is not about accepting bad outcomes. It is about preventing them. Build the register. Track the risks. Act early. And turn risks into opportunities before they turn into disasters. On we go.

Frequently Asked Questions

What is a risk and opportunity register?

A simple Excel matrix that tracks every identified risk with columns for description, probability, dollar amount, owner, and target dates, reviewed weekly to prevent risks from materializing.

How do you quantify risks on the register?

Assign a dollar value for the potential impact and a percentage for likelihood, then multiply them to calculate total exposure and integrate into financial projections.

How often should the risk register be reviewed?

Weekly in team meetings as a standing agenda item, with owners reporting on changes, mitigation actions, and updated probabilities for each risk.

What should be included in the risk register?

Design gaps, long-lead materials, weather exposure, trade performance, unforeseen conditions, regulatory approvals, material escalations, and coordination challenges.

How does the risk register integrate with financial reporting?

Report both projected margin assuming no issues and risk-adjusted margin if identified risks materialize, showing the gap and creating urgency to mitigate exposure.