Your Risk Register Is Lying to You

Risk management is one of those disciplines that everyone agrees is important but few organisations practice rigorously. This week I reviewed a project that failed spectacularly, and the post-mortem revealed that every significant risk had been identified in the initial risk register — but none had been actively managed. The risk register had become a document that was updated for governance meetings and then forgotten. Risks were logged but not owned, mitigations were described but not executed, and escalation triggers were defined but not monitored. The lesson: a risk register that isn't actively used is worse than having no risk register at all, because it creates a false sense of security.

I learnt this week that the most effective way to handle pushback from a stakeholder isn't to argue your position more forcefully — it's to understand theirs more deeply. When someone pushes back, they're usually protecting something they value. Understanding what that is unlocks much more productive conversations than simply repeating your own arguments more loudly.

Spring is arriving and with it a renewed energy for getting things done. I've been using the longer evenings for walks that double as thinking time. Some of my best ideas come when I'm walking, not sitting at a desk. Movement and fresh air seem to unlock a different quality of thinking.

Tldraw — a free, minimal whiteboard tool that's perfect for quick sketches and diagrams during client calls. It runs in the browser with no signup required, which means you can share a link and start collaborating instantly. For impromptu visual explanations during video calls, it's become my go-to.

This week's challenge: review your current project's risk register (or create one if it doesn't exist). For each risk, ask: who owns it? What's the mitigation? When was it last reviewed? If you can't answer these questions, the register isn't serving its purpose.