The quality of your risk register is decided in the first two days of its life. If the facilitation is loose, the register is loose — and no amount of downstream Monte Carlo will fix that.
This is the 2-day playbook IQRM uses to run risk register workshops for UK and GCC EPC, infrastructure, and oil & gas programmes — the agenda, the techniques, and the failure modes to avoid.
A risk register workshop is not a brainstorm — it's a quantification exercise. If you leave the room without numeric probability and 3-point impact ranges per risk, you ran a meeting, not a workshop.
Before the workshop: 5 critical preparations
- Right people in the room. Project manager, lead planner, lead estimator, design lead, procurement lead, commercial manager, HSE lead. Optional: subsurface (oil & gas), construction lead, commissioning lead.
- Reference materials. WBS, schedule (P6/MSP), estimate (line items), prior project lessons learned, RDE™ reference distributions for similar projects.
- Pre-read. The WHY/WHAT/HOW framework one-pager, sent 48 hours ahead.
- Format. Whiteboard or digital register tool. Not a free-text Word document.
- Facilitator. Ideally not someone with skin in the schedule or cost number being protected.
Day 1: Identification & Statement-Writing
| Time | Activity | Output |
|---|---|---|
| 09:00–09:30 | Workshop framing, ground rules, ban on banded probabilities. | Shared understanding of what “defensible” means. |
| 09:30–11:00 | Risk identification by WBS walkthrough. One risk per sticky note. | |
| 11:15–12:30 | Risk identification by category sweep (design, ground, procurement, weather, permits, IR, commercial, HSE). | Gaps from WBS walkthrough captured. |
| 13:30–15:00 | De-duplication, category assignment, owner allocation (named, not titled). | Consolidated list of 60–100 distinct risks. |
| 15:15–17:00 | WHY/WHAT/HOW statement writing. Facilitator challenges every statement that doesn't start with “Because of…”. | Every risk is now quantifiable in principle. |
Day 2: Quantification & Response
| Time | Activity | Output |
|---|---|---|
| 09:00–10:30 | Probability assignment (numeric %). Force calibration against RDE™ historical frequencies where available. | Probability column populated. |
| 10:45–12:30 | 3-point cost impact (min / most likely / max) per risk. Force range plausibility against historical analogues. | |
| 13:30–15:00 | 3-point schedule impact (days). Map each risk to the affected P6/MSP activity ID. | Schedule impact + activity mapping. |
| 15:15–16:30 | Response strategy (Avoid / Transfer / Mitigate / Accept), with action and deadline. Residual probability and impact post-treatment. | |
| 16:30–17:00 | Correlation flag pass (commodities, labour pool, weather windows). | Inputs ready for QSRA/QCRA/JCL. |
Facilitation techniques that move the needle
- Ban banded scales. “Medium” is contraband. Force numeric %.
- Anchor with empirical reference. If RDE™ data shows similar past activities overran by 30–80%, that's the starting range. Workshop participants justify deviations.
- Force the “max” question. “If this risk goes worse than you've ever seen, how bad?” If the answer is within 10% of the most likely, push back.
- Split compound risks. Any statement with “and/or” multiple events becomes two or more separate risks.
- Capture causes, not just events. Two risks with the same WHY are correlated — flag for the Spearman matrix.
Five workshop failure modes (and how to avoid them)
- Optimism herd. Everyone pulls the “max” down to look competent. Fix: bring an outsider in the room with permission to push back.
- Anchoring on baseline. Ranges collapse around the existing schedule/estimate. Fix: hide baseline numbers during quantification.
- Compound risks. “Weather or strike or permit” on one line. Fix: split aggressively.
- Owner-by-title. “Project Manager” owns 40 risks. Fix: real names, with workload limits (no more than 8 risks per owner).
- No follow-up cadence. Register is reviewed at the workshop and then dies. Fix: schedule monthly review meeting at the close of the workshop.
How RDE™ transforms the workshop
The hardest part of workshop facilitation is calibrating ranges. Without empirical reference, “max” values collapse toward optimism. IQRM's Risk Data Engine™ (RDE™) provides activity-class reference distributions during the workshop — making the calibration argument data-driven, not personality-driven. Workshop output quality improves measurably.
Frequently asked questions
Can the workshop be done remotely?
Yes, but split it into 4 half-days rather than 2 full days. Use a structured collaborative tool (Miro, MURAL, or a register tool) instead of email.
How big should the workshop group be?
6–10 people. Larger groups dilute accountability and slow quantification. Smaller groups miss disciplines.
Should the sponsor or programme director attend?
For the framing (day 1 morning) and the wrap-up (day 2 afternoon) — yes. For the granular quantification — no. Sponsor presence often suppresses the “max” values.
What's the right cadence after the initial workshop?
Monthly review for the full register. Weekly for top-quartile risks. Major change events trigger immediate review.
Run workshops that produce decision-grade registers
The QRM Professional Programme covers risk workshop facilitation, RDE™ calibration, and register design end-to-end.
Explore the Programme →Related: Risk Register Guide · Risk Register Audit · WHY / WHAT / HOW · 3-Point Estimates & RDE™
