What Is a Risk Register? A Construction QS Guide

A risk register construction teams actually use is not a document you fill in once at tender stage and file away. It is a live, owned, regularly updated record of every significant risk on a project - what it is, how likely it is to happen, how bad it would be if it did, who is responsible for dealing with it, and what is being done to reduce it.

For quantity surveyors and commercial managers, the risk register sits close to the centre of the job. It feeds the cost plan and contingency figure, it shapes procurement decisions, it gives the commercial team an evidence trail when a claim lands, and it is one of the first documents a client or funder will ask to see when they want reassurance that a project is under control.

This guide explains what a construction risk register is, the fields every entry needs, how the register is used from feasibility through to handover, and how risks are scored using a probability and impact matrix. It includes a worked example of real register entries and a summary of RICS and APM best practice, so you can build or tighten up your own version.

If you want a ready-made version to start from rather than building one line by line, there is a free downloadable risk register template linked further down this guide.

What Is a Risk Register in Construction?

A construction risk register is a structured record - usually a spreadsheet or a dedicated register in project management software - that captures every risk identified on a project and tracks it through to resolution. Unlike a risk assessment, which is often a point-in-time exercise focused on health and safety hazards, a risk register is broader and ongoing. It covers commercial, design, programme, technical and reputational risk as well as safety risk, and it stays open and live for the life of the project.

The register starts life during feasibility or tender, when the project team runs an initial risk identification exercise across the drawings, ground reports, programme and procurement strategy. From there it becomes a working document: new risks are added as they emerge, existing risks are re-scored as circumstances change, and closed risks are marked off with a note on how they were resolved.

Risk register vs. risk assessment: what's the difference

The two terms get used interchangeably on site, but they are not the same thing. A risk assessment is typically a task- or activity-specific exercise, often tied to CDM 2015 duties, that identifies hazards for a particular piece of work and how to control them. A risk register is the project-wide commercial and technical record that sits above this - it aggregates safety risk alongside cost, programme, design and supply chain risk, and it is the document a commercial manager or QS is more directly responsible for maintaining.

• Risk assessment: task-specific, safety-focused, often a one-off document per activity
• Risk register: project-wide, covers all risk categories, live for the whole project duration
• Risk assessment feeds into method statements and RAMS
• Risk register feeds into the cost plan, contingency, procurement strategy and client reporting

The Key Fields Every Construction Risk Register Needs

A risk register only works if every entry captures the same core information, consistently, so risks can be compared, sorted and reported on. At minimum, each row needs a unique reference, a clear description of the risk, its category, a probability score, an impact score, a calculated risk rating, a named owner, the planned mitigation, a target date, and a status. Most registers add a trigger (the event or condition that would cause the risk to materialise) and a cost or time allowance held against it.

Probability and impact are usually scored on a simple 1-5 scale, with the two multiplied together to give an overall risk rating between 1 and 25. This rating is what allows a long list of risks to be sorted by priority, so the team's time and the project's contingency get spent on the risks that matter most rather than spread evenly across everything on the list.

• Probability: how likely the risk is to occur, scored 1 (rare) to 5 (almost certain)
• Impact: how severe the consequence would be, scored 1 (negligible) to 5 (severe)
• Owner: a named person, not a team or department, who is accountable for the risk
• Mitigation: the specific action being taken, not a vague intention
• Trigger: the early warning sign that the risk is becoming live
• Status and review date: keeps the register honest and prevents stale entries

How a Risk Register Is Used Through the Project Lifecycle

A risk register is not static - the risks that matter most, and the level of detail needed, change significantly as a project moves from feasibility through to handover. Treating it as a living document rather than a one-off deliverable is what separates a register that genuinely reduces risk from one that exists purely to satisfy a client requirement.

Feasibility and tender stage

The register is opened early, often before a contractor is even appointed. At this stage risks tend to be broad - ground conditions, planning risk, market conditions, procurement route risk - and scoring is based on assumptions rather than firm information. The initial register informs the contingency built into the cost plan and the choice of procurement route.

Design development

As the design firms up, risks become more specific: buildability issues, coordination clashes, specification gaps, and long-lead items. Designers and the principal designer add and close risks as drawings are issued, and the QS tracks how design decisions are affecting cost risk and provisional sums.

Construction phase

This is when the register is busiest. Site-specific risks - subcontractor performance, weather, utility diversions, unforeseen ground conditions, supply chain and price risk - are added and reviewed at every commercial and programme meeting, typically weekly or monthly depending on project scale. Realised risks are logged against the cost value reconciliation so their actual impact on margin is visible.

Handover and close-out

Remaining open risks are either closed out, transferred into the defects liability period, or handed to the client's facilities team if they relate to ongoing operation of the building. A good practice at this stage is a lessons-learned review of which risks materialised, which didn't, and how accurate the original scoring was - this feeds into better estimating on the next project.

Scoring Risk: The Probability and Impact Matrix

The probability and impact matrix is the standard tool for turning a long, unsorted list of risks into a prioritised one. Each risk is plotted on a grid according to its probability score on one axis and its impact score on the other. The cell it lands in - and the colour band that cell sits in - tells the team at a glance whether the risk needs immediate senior attention, ongoing monitoring, or can be accepted with minimal action.

Colour bands are typically split into three tiers: low risk (scores of roughly 1-4), medium risk (5-12), and high risk (15-25). Where a risk sits determines the response - low-scoring risks might just be monitored, medium risks need an active mitigation plan and regular review, and high-scoring risks usually need escalation to senior management and a dedicated contingency allowance. The exact scale and colour bands should be agreed and stated on the register itself, since different clients and frameworks use slightly different thresholds.

Worked Example: Sample Risk Register Rows

The table below shows what a small set of live register entries actually looks like in practice, combining commercial, design and programme risk in the same format so they can be compared and prioritised together.

Notice how the ground contamination risk scores highest despite a moderate probability, because its impact is severe - this is exactly why multiplying probability by impact matters more than ranking by probability alone. A frequent, low-impact risk like minor weather delay can sit well below a rare but severe risk like contaminated ground, even though the weather risk might feel more immediate day to day.

Each of these rows would also carry a target closure date, a review frequency and a status field in a real register - they are omitted here for readability, but every field from Table 01 above should be populated in practice, not just the ones that feel most relevant at the time.

RICS and APM Best Practice for Risk Registers

RICS sets out formal guidance on risk management for construction professionals in its Black Book practice information, Management of Risk, which was reissued in March 2025 having originally been published in 2015. The guidance is explicit that a risk register should be prepared at the initial project stage, capturing all risks associated with the project, and that risk exposure changes as the project progresses - meaning the register has to be actively managed rather than treated as a one-off exercise.

RICS guidance also stresses the link between procurement route and risk: each procurement route carries a different weight and allocation of risk between employer and contractor, and understanding this is described as essential for anyone advising on or running a project. This is one of the reasons the risk register is opened so early - the choice of procurement route itself is a major entry on it.

The Association for Project Management (APM) treats risk management as a core competence within its Body of Knowledge and project management qualifications, several of which - including the Project Fundamentals Qualification - are delivered through RICS. APM guidance frames the risk register as the record that sits alongside the probability and impact matrix: risks are identified, assessed for likelihood and consequence, and then displayed on the matrix so they can be divided into priority groups for action.

• Open the register at the earliest project stage, not once construction starts
• Assign a named owner to every risk, not a department or team
• Review and re-score risk at every commercial or programme meeting, not just at fixed milestones
• Link the register explicitly to procurement route decisions and contingency allowances
• Treat closed risks as a record, not a deletion - the history is useful for future estimating
• Run a lessons-learned review at project close-out to check scoring accuracy against outcomes

Common Mistakes That Make a Risk Register Useless

The single biggest failure mode is a register that gets built once, presented at a kick-off meeting, and never opened again. If entries aren't reviewed and re-scored, the register stops reflecting reality within weeks, and it becomes a compliance document rather than a working tool. The fixes below are simple but consistently separate registers that actually reduce risk from ones that just look tidy.

• No named owner: risks assigned to 'the team' or 'the contractor' rarely get actioned - assign a real person
• Vague descriptions: 'ground risk' tells nobody anything - describe the specific event and its cause
• No review cadence: set a fixed frequency (weekly on live projects, monthly minimum) and stick to it
• Disconnected from the cost plan: contingency should trace back to specific, scored risks, not a flat percentage
• Treating it as a compliance checkbox: a register built purely to satisfy a client requirement gets ignored operationally
• Never closing anything: a register that only grows becomes unusable - close out resolved risks with a note on the outcome

A risk register that is kept short, current and genuinely owned by the commercial and project team will do more to protect margin and programme than an exhaustive one that nobody looks at after week one. Consistency and ownership matter more than length.

Frequently Asked Questions

What is a risk register in construction?

A construction risk register is a live document that logs every significant risk on a project, along with its likelihood, potential impact, a named owner, planned mitigation and current status. It is used throughout the project lifecycle to prioritise attention, set contingency and provide an audit trail for claims and client reporting.

What is the difference between a risk register and a risk assessment?

A risk assessment is usually a task-specific, safety-focused exercise tied to a particular activity, often required under CDM 2015. A risk register is broader and ongoing - it covers commercial, design, programme and technical risk across the whole project and stays live from feasibility to handover, not just for a single task.

Who is responsible for maintaining the risk register on a construction project?

Responsibility is usually shared. The project or commercial manager typically owns the overall register, but individual risk entries are assigned to whoever is best placed to manage them - a principal designer for design risk, a quantity surveyor for commercial risk, or a site manager for site-specific risk.

How often should a construction risk register be reviewed?

On a live construction project, the register should be reviewed at every commercial or programme meeting, which is typically weekly, with a formal minimum review of at least once a month. New risks should be added as soon as they are identified rather than waiting for the next scheduled review.

What is a probability and impact matrix?

A probability and impact matrix is a grid, commonly 5x5, used to score each risk by how likely it is to occur and how severe its consequences would be. Multiplying the two scores gives a risk rating that determines whether a risk needs urgent senior attention, active monitoring, or can simply be accepted.

Is a risk register a legal requirement in construction?

There is no single law that names a 'risk register' directly, but CDM 2015 places legal duties on clients, designers and contractors to manage health and safety risk, and RICS professional guidance treats a risk register as standard good practice for managing commercial and technical risk. In practice, most UK contracts and funders expect to see one.

What software is used for a construction risk register?

Many teams start with a shared Excel or Google Sheets template, which is often sufficient for smaller projects. Larger schemes or contractors frequently move to dedicated risk and project management platforms that automate scoring, reminders and reporting, but the underlying fields - probability, impact, owner, mitigation - stay the same.

Final Thoughts

A risk register is only as useful as the discipline behind it. The template and the scoring method matter less than whether every entry has a real owner, a clear description, and a review date that actually gets kept. Get those three things right, and the register becomes one of the most useful commercial tools on the project - not just a document you produce for the client.

If you're setting one up from scratch, start with the fields in Table 01, score your first pass of risks using the probability and impact matrix above, and put a recurring slot in the commercial meeting agenda to keep it current. Download the free template below to save yourself building the structure from zero.

Want the full picture? Download the Free Risk Register Template

Pair it with our guides on Construction Risk Assessment and Cost Value Reconciliation for a full commercial risk toolkit.