Problem
Most programmes have a risk register. Few use it. Risks are written down at the start and never reviewed, issues are handled in email, and dependencies on other teams or suppliers are discovered when they are already late.
Leaders learn about trouble when it is already a crisis, and the same problems return because no one owns the fix.
Outcomes
- One live log of risks, assumptions, issues and dependencies.
- A named owner and a review date for every entry.
- Problems escalated to the right level, quickly.
- Dependencies between teams and suppliers mapped and tracked.
- Early warning, so leaders decide while options are still open.
Scope
In scope
- Setting up risk, issue and dependency management: logs, roles, cadence and escalation routes.
- Agreeing risk appetite and tolerances with the accountable owners.
- Risk identification workshops and assessment.
- Dependency mapping across teams and suppliers.
- Response planning, contingency and escalation.
- Reporting risk, issues and dependencies to governance.
Not included
- Accepting risk on your behalf. We assess and advise; decisions on risk stay with your accountable owners.
- Insurance, legal or regulatory risk opinions. Your own specialists provide these.
Procurement and supplier assurance
Supplier risk is delivery risk. We help prepare procurements so requirements and evaluation criteria are clear, and we check during delivery that suppliers provide what was contracted, raising gaps early.
- Procurement preparation and evaluation criteria.
- Supplier performance reviews against the contract.
- Supplier risks and dependencies tracked in the RAID log.
Approach
Discovery
We agree the risk appetite, the logs, the roles and the cadence, and review recent risks and issues, so everyone knows how risk, issues and dependencies will be handled and who decides
Delivery Planning
We run identification workshops, assess likelihood and impact, map the dependencies between teams and suppliers, and agree responses, owners and escalation routes
Build and Test
We keep the log live as delivery runs, track responses to completion, and rehearse escalation on a real risk, so action happens before a risk becomes an issue
Operational Readiness, Hypercare and Closure
We report to governance, keep the register current through go-live and the first weeks of live use, and hand over a log your team can keep running, with your sign-off
Deliverables
Technologies
Controls
Frequently Asked Questions
We already keep a risk register. What would you add?
We make it one that is used: owners, assessments and actions kept current, dependencies mapped, and escalation that happens on agreed triggers rather than by chance.
How do you handle dependencies between suppliers?
We map each dependency with both sides named and a date, and track it, so a slip on one side is visible to the other before it causes a problem.
Do you decide which risks we accept?
No. We assess risks and recommend responses. Decisions on which risks to accept stay with your accountable owners.
Can this fit our existing governance?
Yes. We align the logs, cadence and reporting to how your boards already work, so risk reporting fits your governance rather than duplicating it.
Worried about what you cannot see?
A Technical Audit reviews your delivery and where the risks are, and gives you a prioritised plan to address them.