Software project risk register: find delivery risks before kickoff

Contents

• Why build the register before the project starts?
• What does a risk register contain?
• How do you build the register?
• Worked register: a marketplace connecting to a legacy ERP
• What does a Netbase record show about investigating before committing?
• Which questions should you ask a supplier about risk?
• Why do risk registers fail?
• How this guide is sourced and where it stops
• Common questions
• Bring your top five risks

Why build the register before the project starts?

A risk found before kickoff costs a sentence in the proposal: a dependency with a date, an assumption with a check, a milestone reordered so the uncertain part goes first. The same risk found in month three costs a delayed launch, a rushed workaround or a dispute about who should have known. The register is how the uncertain parts of a project get priced into the plan instead of discovered in it.

It also changes the conversation with a supplier. A supplier that lists its own risks up front, including the ones on its side, is telling you how it thinks. A proposal with no risks at all has not looked.

This page is about a new project that has not started. Two neighbouring guides cover other situations: the legacy system risk assessment examines an existing system you already run, and the project rescue assessment examines a project that is already failing.

What does a risk register contain?

OutsourcingVN is operated by Netbase JSC, which builds registers like this on its own projects, so read the format as a supplier's working format; it transfers to any supplier. One row per risk:

A three-point scale is deliberate. Finer scales invite false precision on a project that has not started. Scores of 6 and 9 get an action in the plan; 3 and 4 get a trigger and a watcher; 1 and 2 are recorded and accepted. NIST SP 800-30 Rev. 1, its guide to conducting risk assessments, uses the same basic structure of likelihood and impact combined into a level of risk, which is why the model travels well between security and delivery work.

Worked register: a marketplace connecting to a legacy ERP

A wholesaler plans a buyer marketplace that reads stock and writes orders to a fifteen-year-old ERP. The discovery session produces nine risks; the top four are:

Because R-01 scored 6 and threatened the outcome, the plan moved the integration spike to the first milestone. If the spike fails, the buyer learns it in week two, not at launch.

What does a Netbase record show about investigating before committing?

For an existing client store, Netbase scoped a three-phase recovery of a compromised Magento site. The first phase is investigation and security scanning with cause analysis, a full source-code and database malware scan, server log, permission and abnormal-file checks and a damage assessment, delivering an infected-file report and a recovery plan. Cleaning, recovery and hardening follow that report, typically 6 to 13 days in total depending on the damage, and full recovery is never guaranteed. The Magento recovery and hardening record is a recovery, not a new build, but it shows the same principle a risk register serves: investigate the unknowns first, then commit to the plan.

Security risks belong in the register from the start. At Netbase, security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request; the data security and compliance guide lists the questions to settle before a supplier touches your data.

Netbase's delivery lifecycle opens with discovery and strategic alignment and then team assembly and architecture planning, which is where a register is drafted, and delivery runs with weekly reviews and a named project manager, which is where it is kept alive. Most Netbase projects are agreed as fixed-scope contracts after discovery; milestone-based arrangements are also available, and the risks found in discovery shape which fits. The project delivery page shows where the register sits alongside milestones and acceptance.

Which questions should you ask a supplier about risk?

• What are the five biggest risks you see in my project? A specific answer shows the supplier has read the brief.
• Which of those risks are on your side? Staffing, knowledge concentration and unfamiliar technology count.
• Which risk would you prove first, and how? Look for a spike or prototype early in the plan.
• Who owns each risk, by name? "The team" is not an owner.
• How often will we review the register, and where will I see it? Weekly, in a shared document, is a sound default.
• What would make you advise not starting? An honest supplier has a stop condition.

Why do risk registers fail?

• Written once for the proposal and never opened again. A register reviewed weekly is a management tool; one filed at signature is decoration.
• Topics instead of events. "Performance" cannot be owned or triggered.
• Every risk scored high. When everything is critical, nothing gets action. Force a ranking.
• Owners with no power to act. The owner must be able to trigger the response.
• Buyer-side risks left out. Late decisions, unavailable reviewers and unclean data are often the largest risks, and they sit with the buyer.
• No link to the plan. A high-scoring risk with no action in any milestone is an accepted risk that nobody accepted.

How this guide is sourced and where it stops

This guide combines NIST SP 800-30 Rev. 1 on risk assessment with Netbase records approved in the OutsourcingVN claim register: the delivery lifecycle, weekly reviews, the contracting model, security practices and the scoped Magento recovery. The methodology explains how records are sourced. The Magento record is a recovery scope for an existing store, not a new-build risk register, and Netbase publishes no statistic on risks identified, avoided or realised; this page claims none. The wholesaler register is illustrative, not a client project.

Bring your top five risks

A short list of the risks that worry you most is one of the most useful things a brief can contain. Custom Product Engineering projects start with a register built in discovery and reviewed weekly.

OutsourcingVN is Netbase's own outsourcing-services platform. Submit a project with your brief and the risks you already see, and a person will reply with the ones they would test first.

Related services and solutions