Risk Register

Risk registers fail in one of two ways: they don't exist, or they exist as a stale spreadsheet that nobody updates, full of generic worries with no owners. The first failure is obvious. The second is worse — a stale register creates false confidence, because the team thinks "we have a risk log" without anyone checking whether the risks are still real or the mitigations are still happening. This skill builds a register that's small enough to maintain and structured enough to use.

The SPECTRUM scan forces you to look in every category — Scope, People, External, Communication, Technical, Resources, Unknown unknowns, Money — instead of just listing the risks you're already worried about. The risks you haven't named are the ones that bite. Scoring is mechanical: likelihood (1-5) times impact (1-5) gives a 1-25 score with explicit thresholds. Below 5: monitor only. 5-9: mitigate. 10-15: active management. 16+: critical, escalate. The thresholds are calibrated by risk appetite, declared at the top of the register — risk-averse projects (regulated, client-facing) treat anything 5+ as active; risk-tolerant projects (internal experiments, startups) raise the bar to 10+. This stops you from over-engineering risk management on a two-week internal project, and from under-investing on a regulated rollout.

Every risk that crosses the threshold gets the same fields: a 4T response strategy (Terminate, Transfer, Treat, Tolerate), a specific mitigation, a contingency for if it materialises anyway, an early warning trigger so you act before it fully lands, and a single owner. "The team" can't watch for a risk. One person, named. The trigger is the part most registers skip and it's the most useful — by the time the risk has fully materialised you're already in damage control; by the time the trigger fires you still have options.

The skill also looks for cascade risks (if A materialises, does it make B more likely?), correlated risks (several risks sharing one root cause that single mitigation would address), and concentration risks (one person owning five risks is itself a single point of failure). And the standing rule: don't conflate risks with issues. A risk might happen. An issue has happened. When a risk materialises, mark it CLOSED — MATERIALISED and move it to an issue tracker. Mixing the two is how registers quietly become fiction.