Every major project has a risk register. It’s required, audited, ticked.
And yet in most projects I encounter, that register is dead. It only looks alive because someone still projects it in meetings.
A dead register is worse than none: it provides false assurance. Leadership believes risks are managed because a file exists.
Seven signs give it away:
1. Review dates are overdue. Risks “to review in March”… of last year.
2. Ghost owners. Risks assigned to people who have left — or who don’t know they own anything.
3. No closures in months. A healthy register breathes. One that only grows isn’t being managed, it’s being accumulated.
4. One-line statements. “Schedule risk.” If a newcomer can’t understand it cold, the risk isn’t written.
5. No new risks since kickoff. The project evolves; the register doesn’t.
6. Actions with no date or status. A mitigation without a deadline is a wish.
7. Nobody cites it between meetings. The real test: did one decision, just one, change this month because of the register?
The good news: each sign is measurable. Field completeness, share of reviews current, average age of open risks, ratio of dated actions — and above all the gaps per owner, because register health is always uneven.
Measuring changes the conversation. Instead of “we need to update the register”, you get: “your eight risks are 40% empty with three overdue reviews — which do we close?”
That’s specific, actionable, and surprisingly well received.
This week, count just two things: how many review dates are overdue, and how many actions have no deadline.
Those two numbers tell you whether you have a tool or a graveyard.