Risk Management: Spotting a Problem Before It Becomes a Crisis

The Difference Between a Risk and a Crisis

A risk is something that isn't a problem yet, but could become one. A crisis is the moment a risk has already turned into reality, and the window for a calm response has closed. Most projects that end up in crisis went through a stage where a warning sign existed but wasn't recognized, or was recognized but never logged and tracked seriously. Risk management isn't an attempt to predict every possible complication — it's the discipline of regularly asking "what could go wrong" and deciding what to do about it before it happens.

Building a Simple Risk Register

You don't need complicated software or an elaborate methodology to get started. A basic risk register needs a handful of columns:

• a specific description of the risk — concrete, not vague ("equipment supplier delay of more than two weeks," not "procurement issues"),
• likelihood of it occurring,
• impact if it does,
• who is responsible for tracking it,
• the planned response if the risk materializes.

A register isn't written once at project kickoff and set aside. Its value comes from regular updates — in practice, it's enough to review it at every status meeting, even if that only takes a few minutes.

Assessing Likelihood and Impact

Not all risks carry equal weight, and trying to give everything the same attention quickly exhausts a team. It helps to roughly rank risks by the combination of likelihood and impact — something unlikely but capable of derailing the entire project deserves more attention than something likely but with negligible consequences. The goal of this exercise isn't mathematical precision; it's common-sense prioritization: what needs attention first, and what just needs to stay on the radar.

Assessing likelihood and impact isn't a one-time exercise. Circumstances shift over the life of a project — a risk that looked negligible at the outset can become serious as the project approaches a critical phase, while some early risks simply stop being relevant. That's why a risk register needs revisiting at every major milestone, not just at kickoff, so the ranking stays an accurate reflection of the current situation rather than assumptions that may be long out of date. It also helps not to do this review in isolation — a short conversation with team members closest to a given part of the work often surfaces risks a project lead, viewed only from their own vantage point, wouldn't otherwise notice.

Early Warning Signs Worth Watching

A crisis rarely arrives without warning. There are usually signals that, in hindsight, look obvious: a supplier who's getting slower to respond, a team member whose reporting starts slipping, a client changing requirements more often than before, a budget line burning through faster than planned. None of these signals necessarily means anything on its own — but tracked systematically, their accumulation is a clear cue to check something before it turns serious.

What to Do Once a Risk Materializes

Once a risk actually occurs, it shifts into the category of a problem that needs immediate management, not further analysis. This is where a pre-prepared response from the risk register saves valuable time — instead of the team asking "what now" for the first time, there's already a plan to activate, even if it needs adapting to the specific situation. That's also why a risk register should hold not just a description of the danger, but a concrete, pre-thought-through response.

Building a Culture Where Risks Get Reported

Even the best risk register is useless if the team doesn't feel it's normal to flag something that looks off. In many organizations there's an unspoken rule that problems don't get raised until they absolutely have to be — because reporting a risk can feel like admitting something isn't under control, or like raising a false alarm. That kind of culture guarantees early signals will go unnoticed, since no one wants to be the one who "cried wolf."

Changing that culture starts at the top. When a project lead responds to a reported risk with appreciation rather than irritation — even when the risk never actually materializes — the team learns that reporting is useful, not a hit to their reputation. The opposite behavior, where whoever raises a problem gets indirectly punished by being handed extra work "since they noticed it," quickly teaches the team to stay quiet.

It also helps to treat risk as a standing item, not an exceptional one. When "what's worrying us right now" is a regular part of every meeting's agenda, instead of only coming up once someone is already worried, it creates room for early, calm conversations about things that would otherwise go unspoken until they become unavoidable.

This matters especially on projects involving external partners or subcontractors, where information about a potential problem often reaches one person on the team first, before it becomes visible to everyone else. If that person has no clear, easy way to pass it along, valuable time to respond gets lost.

An Illustrative Example

Picture a business event project that relies on an external supplier for technical equipment. A month before the event, the project team notices the supplier is slower to answer emails and the last two orders arrived a few days late. On its own, that might mean nothing. But the team keeping a risk register had anticipated this scenario from the start, with a response of "identify a backup supplier within the first three weeks of delivery." When the warning sign shows up, the alternative is already vetted, and the team has a choice instead of a scramble.

Conclusion

Risk management isn't pessimism, and it isn't administrative box-ticking — it's a way of running a project with your eyes open. The difference between a problem handled calmly and one that grows into a crisis often comes down to whether someone asked "what if" in advance and wrote down the answer.

If you'd like to put a systematic approach to risk management in place for your projects, the Delta Pro team offers support through consulting and delivery management.