200 rows, three months stale, and not one of them will sink the program
Show me the risk register for any flagship transformation in your portfolio and I can describe it before I open the file. Fourteen columns. Two hundred rows. The "Last Updated" field reads sometime last quarter. Two of the named mitigation owners have left the company. And the status column is a wall of amber, because amber is the only color that lets a project manager survive a steering committee without committing to anything.
That register is not governance. It is an artifact maintained to satisfy a PMO checklist, and on a $50M program it is actively dangerous, because it gives the board the feeling of oversight without any of the substance. KPMG's 2023 survey of major capital and technology programs found that 37% missed budget or schedule by more than 20% specifically because of weak risk management (KPMG, 2023). On a nine-figure transformation, that miss is not a line item. It is the difference between a CIO who keeps their mandate and one who is explaining a write-down to the audit committee.
The register tracks the wrong category of bad news
Here is the failure underneath the failure. Your register is probably full of tactical issues and nearly empty of strategic threats, and only one of those two categories will actually kill the program.
- Tactical issues — "server delivery slipped two days," "QA lead is out sick," "API docs incomplete." Real, annoying, and entirely survivable. These belong in the daily standup, not on the board's risk log.
- Strategic threats — "the VP of Sales hasn't shown up to a steering committee in six weeks," "the data-migration vendor gets paid by the month and has no incentive to finish," "business requirements are still moving despite a signed sign-off." These are the ones that end careers.
Strategic threats almost never make the register, because they are political. Nobody wants to be the PM who wrote down that the executive sponsor has quietly checked out. So the log fills with the safe stuff while the dangerous stuff lives only in hallway conversations. Bent Flyvbjerg's work on optimism bias at Oxford explains why this is structural, not personal: planners systematically overweight the upside and underweight the cost, and without a mechanism that forces the uncomfortable truth onto paper, the bias wins every time (Oxford, 2021).
Three rules that turn the register into something people fear in a good way
When we step into a stalled enterprise initiative, the first thing we retire is the standard PMI-style risk log. In its place goes an Active Threat Matrix — the same tool we leaned on to unblock a $3M project in 30 days. It runs on three rules, and each one exists to defeat a specific way humans hide bad news.
Rule 1: Kill amber
On a traffic light, amber means caution. On a corporate risk register, amber means "I know this is in trouble but I'd rather not say so on the record." So we ban it. A risk is either:
- Green — managed, under control, the owner is accountable for keeping it there.
- Red — unmitigated and threatening the critical path. The owner is asking for help, in writing.
Removing the middle color removes the place people hide. A PM can no longer split the difference. Green is a commitment; red is a flare. Either way, leadership finally knows where the program actually stands this week instead of next quarter.
Rule 2: A 30-day shelf life, after which a risk becomes a fact
Risks expire. If an item has sat on the matrix for 30 days with no status change and no mitigation action, it is no longer a risk — it is a fact you are choosing to ignore. "Adoption may fail due to no training budget" is a genuine risk in week one. Ninety days later, it means you have a program with no training budget. At that point you accept the fact, adjust scope, or stop the program. What you do not do is let it sit there as a "possibility," because a register full of stale possibilities is indistinguishable from one full of facts, and that is how the signal dies.
Rule 3: Inject a pre-mortem to manufacture the crisis
Gartner predicts 80% of governance initiatives will fail by 2027, largely because they have no real crisis to create urgency (Gartner, 2024). You can manufacture that urgency on purpose. Once a month, put the question to your steering committee: "It is six months from now. This program has failed in front of the board. Walk me through exactly what went wrong." The answers — "we never got clean data out of the legacy system," "compliance blocked the cloud deployment in the last sprint," "the sponsor stopped defending the budget" — are your real threats. They go straight to the top of the matrix, in red, with an owner. A pre-mortem gives smart people permission to say the thing they already suspect but would never volunteer in a normal status update.
The 15-minute scrub that fits a CIO's calendar
You do not have an hour for someone to read a spreadsheet aloud to you. You need a rhythm that protects the downside without eating the day. Drop a 15-minute risk scrub into the weekly status meeting and hold the clock hard:
- New reds (5 min) — What threats to the critical path emerged this week? Identification and owner assignment only. No solutioning in the room.
- Old reds (5 min) — The top three existing reds. Any red that hasn't moved to green in two weeks means the mitigation plan is failing, not the risk worsening. Escalate it that day.
- Kill list (5 min) — What can we close? A bloated register buries signal. Archive anything that didn't materialize, ruthlessly.
Your job is not to administer the program — it is to unstick it
As the enterprise technology leader, you are not there to maintain the document. You are there to break the deadlock that has the program stuck in committee. The risk register is the one place in the entire governance stack where you are explicitly allowed to write down the scary truths everyone else is talking around — the absent sponsor, the vendor incentivized to drag the timeline, the requirements that won't hold still. Use it for exactly that.
So this is the Monday move. Stop adding rows. Open the register, delete the amber, run one pre-mortem with your steering committee, and convert every 90-day-old "risk" into a decision. By Friday you will know which two or three things actually threaten the quarter — and you will be the operator who saw them coming instead of the one explaining why nobody did.
