Index
Introduction
Contracts are created to clearly define the rights, responsibilities, obligations, risks, and expectations of the parties involved. However, signing a contract does not eliminate risk. During the contract lifecycle, organizations may face risks related to delays, cost escalation, scope changes, poor performance, payment disputes, force majeure, regulatory changes, design errors, variations, claims, and many other issues.
One of the most effective tools for proactively managing these risks is a Contract Risk Register.
A Contract Risk Register is a structured document used to identify, assess, monitor, allocate, and control risks associated with a contract. It provides contract managers, project managers, commercial teams, legal teams, and senior management with a common view of the risks that could affect contractual performance.
Instead of waiting for a risk to become a dispute or claim, the risk register helps the contract management team identify the issue early and take appropriate action.
What Is a Contract Risk Register?
A Contract Risk Register is a centralized record of potential risks associated with a contract and the actions required to manage those risks.
It normally contains information such as:
- Description of the risk
- Cause of the risk
- Potential consequences
- Probability of occurrence
- Impact if the risk occurs
- Risk rating
- Party responsible for the risk
- Risk mitigation measures
- Action owner
- Target date
- Current status
- Residual risk
The register should not be treated as a static document prepared only during contract preparation. It should be a living document that is regularly reviewed and updated throughout the contract lifecycle.
For example, in a construction contract, a contractor may identify the risk of delayed approval of drawings. The risk register can record the cause, potential delay to construction, responsibility for obtaining approvals, mitigation measures, and the person responsible for monitoring the issue.
Why Is a Contract Risk Register Important?
Contract risks can have a significant impact on project cost, schedule, quality, cash flow, and relationships between contracting parties.
A properly maintained risk register provides several benefits.
1. Early Identification of Risks
The first benefit is identifying potential problems before they occur.
For example, a construction project may have risks related to:
- Land availability
- Design approvals
- Utility shifting
- Material price escalation
- Labour shortages
- Statutory approvals
- Delayed payments
- Subcontractor performance
- Changes in law
Early identification allows the project team to take preventive action.
2. Clear Allocation of Responsibility
A contract risk register can identify which party is responsible for each risk.
For example:
| Risk | Typical Responsible Party |
| Employer delay in site handover | Employer |
| Contractor’s poor workmanship | Contractor |
| Unexpected ground conditions | Depends on contract |
| Change in law | Depends on contract |
| Design error | Designer/contractually responsible party |
| Material price escalation | Depends on contract provisions |
The actual allocation must always be checked against the specific contract.
3. Better Contract Administration
The risk register helps contract administrators focus on contractual provisions that require close monitoring.
For example, if a contract contains strict requirements for notices relating to delay or variations, the team can identify these requirements as part of its risk management process.
4. Reduction in Claims and Disputes
Many contractual disputes arise because risks were not identified or managed at an early stage.
A risk register encourages the team to address potential problems before they become formal claims.
5. Improved Decision-Making
Management can use the risk register to understand which risks require immediate attention and which risks can be monitored.
This helps prioritize resources.
Key Elements of a Contract Risk Register
A good Contract Risk Register should contain enough information to understand the risk and manage it effectively.
1. Risk ID
Each risk should have a unique identification number.
For example:
- CR-001
- CR-002
- CR-003
This makes it easier to track risks in meetings, reports, correspondence, and contract management software.
2. Risk Description
The risk should be clearly described.
For example:
“Delay in approval of construction drawings may affect planned commencement of structural works.”
Avoid vague descriptions such as “approval risk.”
3. Risk Category
Risks can be classified into categories such as:
- Commercial
- Financial
- Legal
- Technical
- Design
- Schedule
- Procurement
- Construction
- Health and safety
- Environmental
- Regulatory
- Stakeholder
- Force majeure
- Subcontractor
- Payment
Categorization makes analysis easier.
4. Risk Cause
The cause explains why the risk may occur.
For example:
Risk: Delay in material delivery
Cause: Supplier capacity constraints or transportation disruption.
Understanding the cause helps develop appropriate mitigation measures.
5. Risk Event
The risk event describes what may happen.
For example:
“Critical construction materials may not be delivered within the required period.”
6. Risk Consequence
The consequence explains what could happen if the risk materializes.
Potential consequences include:
- Cost increase
- Schedule delay
- Liquidated damages
- Reduced productivity
- Cash-flow problems
- Quality problems
- Contractual claims
- Disputes
- Termination
- Reputational damage
7. Probability
Probability indicates how likely the risk is to occur.
A simple scale can be used:
1 – Very Low
2 – Low
3 – Medium
4 – High
5 – Very High
8. Impact
Impact measures the potential severity of the risk.
The impact can be assessed against:
- Cost
- Time
- Quality
- Safety
- Legal exposure
- Reputation
A 1–5 scale is commonly used.
9. Risk Rating
A simple risk score can be calculated as:
Risk Score = Probability × Impact
For example:
Probability = 4
Impact = 5
Risk Score = 4 × 5 = 20
Organizations can then define risk categories such as:
- 1–4: Low
- 5–9: Moderate
- 10–16: High
- 17–25: Critical
The exact scoring system should be established by the organization.
10. Risk Owner
Every significant risk should have a person responsible for monitoring and managing it.
The risk owner could be:
- Project Manager
- Contract Manager
- Commercial Manager
- Procurement Manager
- Design Manager
- Construction Manager
- Legal Manager
The risk owner is not necessarily the party contractually responsible for the risk.
11. Contractual Risk Owner
It is useful to separately identify which contracting party bears the risk.
For example:
Risk Owner: Contractor
Contractual Risk Allocation: Employer
This distinction can be particularly important in construction contracts.
12. Mitigation Measures
Mitigation measures describe what will be done to reduce the probability or impact of the risk.
For example:
Risk: Delay in approval of drawings
Mitigation: Establish an approval tracker, define review deadlines, conduct weekly design coordination meetings, and issue timely contractual notices.
13. Contingency or Response Plan
Mitigation is generally proactive. A contingency plan explains what will be done if the risk actually occurs.
For example:
“If the nominated supplier fails to deliver, activate an approved alternative supplier.”
14. Risk Status
The register should indicate the current status:
- Open
- Monitoring
- Mitigated
- Escalated
- Closed
- Occurred
15. Target Date
A target date can be assigned for completing mitigation actions.
16. Residual Risk
Even after mitigation, some risk may remain.
This is known as residual risk.
For example:
Initial risk score = 20
Mitigation implemented
Residual risk score = 8
This allows management to determine whether additional action is required.
How to Use a Contract Risk Register for Managing Contracts
A risk register becomes valuable when it is actively used rather than simply prepared and filed.
Step 1: Review the Contract
Start by reviewing the complete contract.
Important documents may include:
- Contract agreement
- General conditions
- Particular conditions
- Scope of work
- Specifications
- BOQ
- Drawings
- Schedules
- Employer’s requirements
- Technical requirements
- Payment provisions
- Insurance requirements
- Bonds and guarantees
- Variation provisions
- Extension-of-time provisions
- Dispute resolution provisions
The objective is to identify contractual obligations and potential areas of exposure.
Step 2: Identify Contract Risks
Conduct a risk identification workshop involving relevant stakeholders.
Participants may include:
- Contract manager
- Project manager
- Commercial manager
- Planning manager
- Procurement team
- Design team
- Construction team
- Finance team
- Legal team
Each participant may identify risks from their area of responsibility.
Step 3: Assess the Risks
Evaluate each risk based on probability and impact.
For example:
| Probability | Impact | Score |
| 2 | 3 | 6 |
| 3 | 4 | 12 |
| 4 | 5 | 20 |
High and critical risks should receive greater management attention.
Step 4: Determine Risk Allocation
Check the contract to determine who bears the risk.
This is particularly important in construction contracts.
Do not assume that the party experiencing the risk is automatically responsible for it.
The contractual clauses should be reviewed carefully.
Step 5: Develop Mitigation Actions
For each significant risk, identify actions that can reduce the likelihood or consequences.
For example:
Risk: Delay in site possession
Mitigation actions:
- Monitor site handover milestones
- Maintain an interface register
- Issue early warnings
- Record affected areas
- Maintain contemporaneous records
- Issue contractual notices where required
Step 6: Assign Responsibility
Every action should have an owner.
A risk register without assigned responsibility can easily become an information document rather than a management tool.
Step 7: Monitor the Register Regularly
The register should be reviewed during:
- Weekly project meetings
- Monthly contract review meetings
- Commercial review meetings
- Risk review meetings
- Project management meetings
High-risk items should be discussed more frequently.
Step 8: Update the Risk Register
Risks change throughout the contract lifecycle.
A risk that was critical during procurement may become irrelevant after contract award.
Similarly, new risks can emerge during construction.
Therefore, the register should be updated whenever there is a significant change in:
- Scope
- Design
- Schedule
- Market conditions
- Legislation
- Project stakeholders
- Contractor performance
- Procurement
- Site conditions
Example of a Contract Risk Register
Consider a road construction project.
| ID | Risk | Probability | Impact | Score | Mitigation | Owner | Status |
| CR-001 | Delay in land handover | 4 | 5 | 20 | Monitor handover schedule and issue early notices | Project Manager | Open |
| CR-002 | Material price escalation | 3 | 4 | 12 | Review escalation provisions and procurement strategy | Commercial Manager | Monitoring |
| CR-003 | Delay in design approval | 4 | 4 | 16 | Design approval tracker and weekly coordination | Design Manager | Open |
| CR-004 | Poor subcontractor performance | 3 | 4 | 12 | Performance monitoring and corrective action | Construction Manager | Monitoring |
| CR-005 | Delayed interim payment | 3 | 5 | 15 | Maintain payment tracker and timely submissions | Commercial Manager | Open |
This table can be expanded to include contractual clauses, risk allocation, mitigation deadlines, residual risk, action owners, and evidence/document references.
Contract Risk Register vs Project Risk Register
Although the two are related, they are not exactly the same.
A Project Risk Register generally focuses on risks affecting overall project objectives such as cost, schedule, quality, safety, and technical performance.
A Contract Risk Register focuses more specifically on contractual exposure and obligations.
For example, a project risk register may contain:
“Project completion may be delayed by six months.”
A contract risk register may go further:
“Delay caused by late access to the site may give the contractor entitlement to an extension of time under Clause X, subject to compliance with the contractual notice requirements.”
Therefore, a contract risk register should connect project risks with contractual rights, obligations, liabilities, and remedies.
Contract Risk Register and Early Warning
An effective risk management system should identify risks before they become contractual claims.
For example:
Potential risk: Employer may not provide access to a work area on the planned date.
The contract team should:
- Identify the risk.
- Assess its potential impact.
- Notify relevant stakeholders.
- Review contractual requirements.
- Maintain records.
- Monitor the situation.
- Take mitigation measures.
- Issue contractual notices where required.
This creates a proactive approach rather than waiting until the delay has already occurred.
Contract Risk Register for Construction Projects
Contract risk registers are particularly useful in construction and infrastructure projects because these projects involve multiple stakeholders and numerous interfaces.
Typical construction contract risks include:
Pre-Construction Risks
- Incomplete design
- Unclear scope
- Inaccurate quantities
- Inadequate site investigation
- Land acquisition
- Statutory approvals
- Utility relocation
Construction Risks
- Delayed drawings
- Poor productivity
- Material shortages
- Labour shortages
- Equipment breakdown
- Unexpected ground conditions
- Weather-related delays
- Safety incidents
Commercial Risks
- Delayed payments
- Variations
- Claims
- Price escalation
- Incorrect measurement
- Cash-flow constraints
- Subcontractor claims
Contractual Risks
- Failure to issue notices
- Failure to maintain records
- Non-compliance with contract procedures
- Ambiguous contractual provisions
- Disputes over responsibility
- Failure to meet contractual milestones
Best Practices for Maintaining a Contract Risk Register
Keep It Simple
A risk register should be easy to understand and update. Avoid unnecessarily complicated formats.
Link Risks to Contract Clauses
Where appropriate, include the relevant contract clause.
For example:
Risk: Delay due to late information
Relevant Clause: Clause 8.3
This makes the register more useful for contract administration.
Separate Risks From Issues
A risk is something that may happen in the future.
An issue has already occurred.
For example:
“Drawing approval may be delayed” = Risk
“Drawing approval is already 30 days late” = Issue
Once a risk occurs, it should generally be transferred to the appropriate issue, claim, delay, or action-management process.
Maintain Evidence
For important risks, maintain supporting documents such as:
- Letters
- Emails
- Site instructions
- Meeting minutes
- Photographs
- Progress reports
- Programme updates
- Inspection reports
- Notices
This can become particularly important if a risk eventually develops into a claim or dispute.
Review High-Risk Items Frequently
Critical risks should not wait for a monthly review.
They should be monitored continuously and escalated when necessary.
Recommended Contract Risk Register Templates
Different organizations may require different levels of detail. Here are three practical templates.
Template 1: Basic Contract Risk Register
Suitable for small contracts.
| Risk ID | Risk Description | Probability | Impact | Risk Score | Mitigation | Owner | Status |
This is simple and easy to maintain in Excel or Google Sheets.
Template 2: Detailed Contract Risk Register
Suitable for construction and infrastructure contracts.
| Risk ID | Category | Risk Description | Cause | Consequence | Contract Clause | Probability | Impact | Initial Score | Risk Allocation | Mitigation | Action Owner | Due Date | Residual Score | Status |
This format provides much better contractual visibility.
Template 3: Contract Risk & Action Register
For large projects, it can be useful to combine risk management with action tracking.
| ID | Risk | Risk Owner | Contract Party | Mitigation Action | Action Owner | Target Date | Evidence Required | Status | Residual Risk | Escalation Required |
This format ensures that identified risks result in actual management actions.
Suggested Risk Rating Matrix
A simple 5 × 5 matrix can be used.
| Probability / Impact | 1 | 2 | 3 | 4 | 5 |
| 5 – Very High | 5 | 10 | 15 | 20 | 25 |
| 4 – High | 4 | 8 | 12 | 16 | 20 |
| 3 – Medium | 3 | 6 | 9 | 12 | 15 |
| 2 – Low | 2 | 4 | 6 | 8 | 10 |
| 1 – Very Low | 1 | 2 | 3 | 4 | 5 |
Organizations can define their own thresholds. For example:
1–4: Low
5–9: Moderate
10–16: High
17–25: Critical
Final Thoughts
A Contract Risk Register is much more than an Excel spreadsheet containing a list of potential problems. When properly implemented, it becomes an important contract management and decision-making tool.
It enables an organization to identify contractual risks early, understand who is responsible for them, evaluate their potential impact, develop mitigation strategies, assign responsibility, and continuously monitor the situation.
For construction and infrastructure projects, the risk register can be particularly valuable because contractual risks are closely connected with time, cost, variations, claims, extensions of time, payments, and disputes.
The most effective approach is to establish the register during the pre-contract or tender stage, update it after contract award, and continuously monitor it throughout contract execution and closeout.
In simple terms:
Identify → Assess → Allocate → Mitigate → Monitor → Update → Escalate
That is the essence of effective contract risk management.
A well-maintained Contract Risk Register can therefore help organizations move from reactive contract administration to proactive contract management.
