Construction project controls, consulting, and In Project AI
Construction Risk Register: How to Build One That Works (With Examples)
A practical guide to building a construction risk register: the columns to include, a 5x5 scoring matrix, 15 common construction risks with example mitigations, how to run the weekly risk review, and how to turn risk into contingency.
Article summary
A practical guide to building a construction risk register: the columns to include, a 5x5 scoring matrix, 15 common construction risks with example mitigations, how to run the weekly risk review, and how to turn risk into contingency.
What is a construction risk register?
A construction risk register is a living log of the uncertain events that could affect a project's cost, schedule, safety, or quality. Each entry records what could happen, how likely it is, how much it would hurt, who owns it, and what is being done about it. A good register turns risk from a worry voiced in a meeting into a managed list of actions with owners and dates.
Owners, general contractors, construction managers, and many public agencies require a risk register on larger projects. Even on small jobs, a one-page register reviewed weekly prevents the most common surprises: late long-lead equipment, an unresolved design conflict, a subcontractor falling behind, or an inspection nobody scheduled.
The columns every risk register needs
| Column | What to enter | Example |
|---|---|---|
| Risk ID | Unique number for reference | R-012 |
| Category | Design, procurement, site, labor, permit, safety, cost, schedule | Procurement |
| Risk description | Cause, event, and effect in one sentence | Switchgear lead time of 40 weeks may delay energization and substantial completion |
| Likelihood (1 to 5) | How probable the event is | 4 (Likely) |
| Impact (1 to 5) | Worst credible effect on cost, time, safety, or quality | 5 (Severe) |
| Score | Likelihood times impact | 20 (Critical) |
| Cost and time exposure | Estimated dollars and days if it happens | $180,000 and 30 days |
| Owner | One named person, not a company | Project manager |
| Response and mitigation | Avoid, reduce, transfer, or accept, with the specific action | Release early purchase order; confirm submittal approval by Nov 15 |
| Due date | When the mitigation must be done | Nov 15 |
| Status and trend | Open, closed, or realized; rising, stable, or falling | Open, rising |
The most important habit is writing the description as cause, event, and effect. "Weather" is not a risk. "Winter weather in January and February may stop masonry work and delay the envelope by three weeks" is a risk you can manage.
How to score construction risks
Most construction teams use a 5x5 matrix: likelihood from 1 (rare) to 5 (almost certain) and impact from 1 (negligible) to 5 (severe). Multiply them for a score from 1 to 25, then group scores into bands that trigger different levels of attention.
| Impact level | Cost | Schedule | Safety and quality |
|---|---|---|---|
| 1 Negligible | Under $10,000 | Under 3 days | No injury; minor rework |
| 2 Minor | $10,000 to $50,000 | 3 to 7 days | First aid; localized rework |
| 3 Moderate | $50,000 to $150,000 | 1 to 3 weeks | Recordable injury; failed inspection |
| 4 Major | $150,000 to $500,000 | 3 to 8 weeks | Lost-time injury; major rework |
| 5 Severe | Over $500,000 | Over 8 weeks or milestone missed | Serious injury; structural or life-safety failure |
Adjust the dollar and day thresholds to the size of your project. The point is consistency: when two people score the same risk, they should land within one point of each other.
The four risk response strategies
Every risk needs a deliberate response. Construction teams typically choose one of four strategies:
| Strategy | What it means | Construction example |
|---|---|---|
| Avoid | Change the plan so the risk cannot happen | Resequence work so steel erection does not start before the fall protection plan is approved |
| Reduce | Lower the likelihood or the impact | Release long-lead orders early and track submittal approvals weekly |
| Transfer | Move the risk to a party better able to carry it | Require performance bonds, insurance, or a design-build subcontract for a specialty system |
| Accept | Acknowledge the risk and hold contingency for it | Carry a weather allowance for winter concrete work |
Accepting a risk is a legitimate choice, but it should be an explicit decision with contingency set aside, not the default because nobody had time to plan a response.
15 common construction risks and example mitigations
| Risk | Example mitigation |
|---|---|
| Long-lead equipment (switchgear, transformers, AHUs) delivered late | Release early purchase orders; track submittal approval dates against the delivery schedule |
| Incomplete or conflicting design documents | Constructability review before bid; fast-track RFI process with a response time agreed with the design team |
| Unforeseen site or subsurface conditions | Geotechnical investigation; owner-held contingency; differing site conditions clause |
| Subcontractor understaffing or default | Prequalification; weekly manpower tracking; cure notice process; performance bonds |
| Skilled labor shortage in the local market | Early trade buyout; schedule float on labor-heavy activities |
| Material price escalation | Escalation clauses; early buyout; allowances for volatile materials |
| Permit or inspection delays | Pre-application meetings with the authority having jurisdiction; inspection look-ahead |
| Weather | Seasonal sequencing; winter protection budget; weather days in the schedule |
| Owner decision delays | Decision log with required-by dates; escalation path in the contract |
| Scope creep and unpriced changes | Change control process; no work without written direction |
| Late RFIs or submittals on the critical path | Required-by dates tied to the schedule; weekly aging review |
| Safety incidents | Site-specific safety plan; fall protection plan; daily pre-task planning |
| Quality failures and rework | Inspection and test plan; first-installation reviews; mockups |
| Commissioning and turnover delays | Engage commissioning agent early; start closeout tracking 90 days out |
| Cash flow and payment delays | Clear pay application process; lien waiver tracking; schedule of values review |
Example risk register entries
Here is what well-written entries look like on a mid-size commercial project.
| ID | Risk | L | I | Score | Owner | Mitigation |
|---|---|---|---|---|---|---|
| R-001 | Steel erection proceeding without a written fall protection plan may result in injury and an OSHA stop-work order | 4 | 5 | 20 | Safety manager | Stand down elevated work until the plan and competent person are documented |
| R-002 | RFI on a steel connection detail open 20 days may delay erection on the critical path | 4 | 4 | 16 | Project manager | Escalate to the architect with a 72-hour response deadline |
| R-003 | Drywall subcontractor staffed at 60% for three weeks may push interior finishes | 4 | 4 | 16 | Superintendent | Issue cure notice; require minimum crew size; line up a backup trade |
| R-004 | No commissioning agent retained at 58% complete may delay the certificate of occupancy | 3 | 5 | 15 | Project manager | Issue an RFP and award within 14 days |
How to run the weekly risk review
- Review new risks first. Anyone on the team can add a risk; the PM confirms the score and assigns an owner.
- Walk the top five by score. For each, confirm the mitigation is on track and the due date still holds.
- Check overdue mitigations. An overdue mitigation on a critical risk is an escalation, not a status update.
- Close or downgrade what is resolved. A register that only grows becomes noise.
- Move realized risks to the issue log. Once the event happens, it is an issue with a cost and schedule impact to manage.
Keep the review to 15 to 20 minutes inside the regular project meeting. The register is useful only if it is reviewed every week.
From risk register to contingency
The register also tells you how much contingency the project needs. A simple method is to multiply each open risk's estimated cost exposure by its probability and add them up for an expected value. Larger programs use Monte Carlo analysis to produce confidence levels, often called P50 (a 50% chance the final cost is below this number) and P80 (an 80% chance).
Compare that number with the contingency you have left. If the P80 risk exposure is $498,000 and only $276,000 of contingency remains, the owner needs to know now, while there is still time to act. That comparison is one of the most valuable sentences in any owner report.
Common risk register mistakes
- Writing vague risks such as "weather" or "budget" instead of cause, event, and effect.
- Assigning a company or "the team" as owner instead of a named person.
- Scoring once at kickoff and never updating.
- Listing mitigations like "monitor" that do not change likelihood or impact.
- Never closing risks, so the register grows to 80 lines nobody reads.
- Keeping the register separate from the schedule and cost forecast.
How In Project helps
In Project LLC helps teams build risk registers that are actually used: clear scoring, named owners, and a weekly review rhythm. In Project AI reads your schedule, logs, daily reports, and change records and drafts a scored risk register with exposure estimates and recommended mitigations for your review. See how risk fits into the wider system in What Are Project Controls in Construction?, or contact us about a project controls review.
Frequently asked questions
What should a construction risk register include?
At minimum: a risk ID, category, a cause-event-effect description, likelihood and impact scores, an overall score, estimated cost and time exposure, a named owner, the mitigation action, a due date, and current status.
How do you score risk in construction?
Most teams rate likelihood and impact from 1 to 5 and multiply them for a score from 1 to 25. Scores of 15 or more are usually treated as critical and reviewed every week with a specific mitigation and due date.
Who owns the risk register on a construction project?
The project manager usually maintains the register, but each individual risk should be owned by the person best able to act on it, such as the superintendent, safety manager, or MEP coordinator.
How often should a construction risk register be updated?
Weekly on active projects, as part of the regular project meeting, with a deeper review at major milestones and before monthly owner reporting.
What is the difference between a risk and an issue?
A risk is something that might happen. An issue is something that has already happened and now has to be managed. When a risk occurs, move it from the risk register to the issue log.