The risk register that actually gets used (instead of filed and forgotten)

I've audited a lot of risk registers. Most of them have a last-modified date of 'kickoff week.' They got built because somebody on the methodology checklist said to build one, and then they sat in SharePoint while the actual risks materialised in real time, unmanaged, in a Slack channel.

That's not a discipline problem. It's a design problem. The register doesn't get used because it isn't built to be used.

Three columns most registers are missing

Probability and impact aren't enough. Add these three or your register is decoration:

• Owner. One name. Not a team, not 'the PMO,' not 'TBD.' If two people own a risk, nobody does.
• Trigger. The observable event that means the risk is materialising. 'Vendor delays' is not a trigger. 'Vendor misses the staging-env deadline of Mar 14' is a trigger.
• Pre-agreed response. What we do the moment the trigger fires. Decided now, when heads are cool and stakeholders are reasonable.

These three columns are the entire reason a register has any operational value. Everything else is paperwork.

Score on 1–3, not 1–5

A 1–5 scale gives people a comfortable middle. Everything becomes a 3. You end up with a 40-row register where every row is medium-medium and nobody can tell what to worry about.

A 1–3 scale forces a decision: low, medium, or top-of-mind. The conversations are sharper. The register is shorter. The top of the list is actually the top.

Review weekly, in 5 minutes

Put the register on your weekly status meeting as a fixed 5-minute agenda item. Only review the top five. Anything below the top five doesn't get screen time.

If you don't have time for the top five, you don't have a risk register. You have a document.

PenSow's risk register template ships with these columns by default. The first draft is usually 80% right. You spend your time on the trigger and response columns, which is where the actual thinking lives anyway.