Definition
Risks are external events or conditions that could prevent a program from achieving its intended results. A risk differs from an assumption: assumptions are conditions that must hold true for the theory of change to work, while risks are events that might occur outside the program's direct control. A risk register is the structured document that catalogs all identified risks, assesses their likelihood and severity, and documents mitigation strategies.
Why It Matters
Risk management is fundamental to responsible program design and delivery. Programs operate in complex environments where external shocks - economic downturns, policy changes, conflict, natural disasters, staff turnover - can derail planned activities and outcomes. Documenting risks at the outset allows program teams to prepare contingency plans, allocate resources strategically, and respond faster when risks materialize. A well-maintained risk register also demonstrates due diligence to donors and partners, building confidence in program governance.
In Practice
A typical risk management workflow includes these steps: (1) Identify potential risks through brainstorming with the program team and key stakeholders; (2) For each risk, document the threat (what could happen), vulnerability (why it's possible), likelihood (how probable), and impact (how severe if it occurs); (3) Calculate a risk score (often likelihood x severity); (4) For high-scoring risks, agree on mitigation strategies (actions to reduce likelihood or soften impact); (5) Assign ownership and track mitigation progress; (6) Review the register quarterly or when conditions change.
Example: A health program identifies the risk that district health officials could reassign key clinic staff. The team mitigates this by building relationships with district health supervisors, offering refresher training accessible to new staff, and documenting all protocols in accessible manuals.
Related Topics
- Assumptions: Conditions that must hold for your theory of change to work
- Theory of Change: The causal logic linking activities to outcomes
- MEL Plans: The comprehensive framework for monitoring, evaluation, and learning
- Adaptive Management: How to adjust strategy based on changing conditions