If your project has a risk register that was produced once at kickoff and hasn't been opened since, it's worth being honest that this is functionally the same as not having one at all - because the cost variance benefit of a risk register comes specifically from active, ongoing management, not from the document's mere existence in a project file.
| Practice | Typical final cost variance from original budget |
|---|---|
| No formal risk register | 12% to 25% |
| Risk register maintained but rarely updated ("filed and forgotten") | 10% to 20% |
| Actively managed risk register (regular review, owned mitigation actions) | 5% to 12% |
Why the Gap Between "Filed" and "Active" Is So Large
A risk register produced once and never revisited provides almost none of the practical benefit the practice is meant to deliver - the actual value comes from ongoing identification of new risks as the project evolves and continuous tracking of mitigation actions against risks already identified, not from the initial document itself, however thoroughly it was drafted at the start. This is exactly why the middle category in the table above - a register that exists but isn't actively managed - shows only a modest improvement over having no register at all, while an actively managed register shows a considerably larger effect.
A Scenario Showing Active Management in Practice
Picture a project where, at kickoff, the risk register correctly identifies a specific long-lead equipment item as a schedule risk given known supply chain constraints in that particular category. On a project where the register is filed and forgotten, this risk sits unaddressed until the equipment's delivery date arrives late, at which point the schedule impact is already locked in and the response becomes purely reactive. On a project with an actively managed register, that same risk is reviewed monthly, with an assigned owner tracking the supplier's actual production and shipping timeline against the project schedule - and when an early warning sign emerges that the delivery might slip, the project team has weeks of lead time to explore alternative suppliers, adjust the construction sequence to reduce dependency on that specific item's original delivery date, or otherwise mitigate the impact before it becomes an unavoidable delay. The register's value in this scenario comes entirely from the ongoing monthly review and the assigned ownership - the original risk identification at kickoff, while necessary, wasn't sufficient on its own to produce the better outcome.
Why Named Ownership Matters as Much as the Review Cadence
A risk with no individual owner responsible for tracking and acting on its mitigation tends to sit unaddressed regardless of how well it's documented in the register, since a general awareness that "this is a risk" doesn't translate into action without someone specifically accountable for monitoring it and triggering the mitigation plan when needed. This is a common gap even in projects that do maintain an actively reviewed register - the review happens, the risks are discussed, but without clear individual ownership of each specific risk, the discussion doesn't reliably convert into the kind of proactive action that actually changes the outcome.