Every freelance project has the same basic problem: things go wrong, but they were predictable. The asset delivery that stalls for two weeks. The new stakeholder who enters at Week 4 with veto power. The third-party tool that breaks the integration you built around it. These aren’t surprises, they’re common failure modes that nobody named upfront.
A risk register is the simplest tool in project management and the most consistently skipped. Freelancers think it’s for enterprise teams running $10M programs. It isn’t. A 6-line table built in 15 minutes at kickoff and updated in 5 minutes every Friday will save you from the conversations you dread most: “Why didn’t you tell me this was a risk?” or “This is your problem to fix.”
When a risk is documented at kickoff and the client confirmed it, it stops being your fault and starts being a shared challenge you both saw coming.
The 6-Column Format
Your risk register has exactly these columns. Don’t add more. More columns create overhead that kills the weekly update ritual.
Risk | Probability | Impact | Owner | Mitigation | Status
Here’s what each column means in practice:
Risk: A one-line description of what could go wrong. Write it as an event, not a condition: “Client assets not delivered by Day 5” not “asset delivery.”
Probability: High / Medium / Low. Don’t overthink it. H means it’s happened before or is structurally likely. M means it’s possible but not expected. L means unlikely but worth tracking.
Impact: High / Medium / Low. H means it delays a milestone or creates extra billable hours. M means it creates friction but doesn’t derail. L means it’s a nuisance.
Owner: Who is responsible for the mitigation action. Either you or a named client contact. “Both” is acceptable only when the mitigation truly requires coordination, otherwise it means nobody.
Mitigation: One sentence describing what will be done to reduce probability or impact. This is not a disaster plan, it’s a prevention action.
Status: Open / Watching / Escalated / Resolved. “Open” means the risk exists and mitigation is in progress. “Watching” means probability decreased but you’re monitoring. “Escalated” means the risk materialized and needs immediate attention. “Resolved” means it’s no longer relevant.
The 15-Minute Risk Identification at Kickoff
You build the initial register during kickoff by asking the client three questions. Ask them in this order. Take notes verbatim, their words become your risk descriptions.
Question 1: “What’s the most likely thing to cause a delay on this project?”
Clients always have an answer. It might be “getting stakeholder approval,” “waiting on our legal team,” “internal bandwidth in the next month,” or “we’re mid-platform migration.” Whatever they say, it goes in the register. Their named risk is your most important row because they’re the ones who know their organization.
Follow up: “If that happened, what’s the impact?” Probe for specifics: days of delay, cost, quality degradation. This sets the Impact rating.
Question 2: “Who outside this room has opinions about the outcome that we haven’t talked to yet?”
This surfaces hidden stakeholders. The CTO who hasn’t seen the tech brief. The sales team whose process you’re rebuilding. The CEO who “will want to see it before it goes live.” Every name they give you becomes either a stakeholder to involve or a risk row: “CTO has undocumented technical requirements.”
Question 3: “What outside factors do we depend on that we don’t control?”
This catches third-party risks: a vendor integration, a platform’s API stability, a pending board decision, a new hire who needs to be onboarded before the project can advance. None of these are your fault, but all of them can derail your timeline.
After these three questions, you’ll have 5-8 risk candidates. Add any you identified independently (scope creep, payment timeline, communication gaps). You now have your opening register.
A Sample Risk Register for a Branding Project
| Risk | Probability | Impact | Owner | Mitigation | Status |
|---|---|---|---|---|---|
| Logo assets not delivered by Day 3 | H | H | Client (Sarah) | Day 3 deadline in kickoff email; follow up Day 2 | Open |
| Stakeholder X not aligned on brand direction | M | H | You | Schedule 30-min intro call Week 1 | Open |
| Scope expansion request (social media kit added) | M | M | Both | Written CR process; CR form template ready | Watching |
| Legal review delay on tagline copy | L | H | Client (Legal) | Flag legal language early; build 5-day buffer in schedule | Open |
| Competitive reference materials unavailable | L | M | You | Use public sources; request client examples | Resolved |
| Final approval delayed (CEO travel schedule) | M | H | Client (Tom) | Book CEO review in calendar at kickoff | Open |
This is a real example. Six rows, built in 15 minutes at a branding kickoff, covering the most likely failure modes. All of them are manageable. None of them will be surprises.
A risk that surprised you is a risk you didn’t name. The register doesn’t prevent bad things from happening, it prevents you from being caught off guard when they do. Surprise is what makes a manageable problem feel like a crisis.
The 5-Minute Friday Update Ritual
Every Friday, open the risk register and do the following:
- Read each row. Has anything changed this week?
- Update Probability or Impact if circumstances changed. A “Low” probability risk that almost materialized becomes “High.”
- Update Status. Did a mitigation get executed? Mark “Watching” or “Resolved.” Did a risk materialize? Mark “Escalated.”
- Add new rows if new risks emerged during the week. You’ll typically add 0-1 new rows per week.
- Save the file with the week number appended:
RiskRegister-Week3.xlsxor equivalent.
Send the updated register with your Friday project update email. One sentence of commentary is enough: “Risk register updated: Legal review risk upgraded to Medium, recommend scheduling their review for next Wednesday.”
That sentence does two things. It keeps the client informed. And it creates a paper trail showing you identified and communicated the risk in advance.
When to Escalate vs. When to Monitor
Monitor (change to “Watching”): The risk is lower probability than expected, or a mitigation was executed and is working. No client communication needed beyond the weekly update.
Escalate (change to “Escalated” + email same day): A risk materialized, meaning it’s actively affecting the project. The escalation email has three components: what happened (factual, one sentence), what the impact is (timeline/quality/budget), and what you’re doing about it (your immediate mitigation action).
Example:
“Quick update: The legal review that was flagged as a Medium risk came up, Sarah mentioned today that legal will need 7 business days, not 3. That pushes our Week 3 milestone by 4 days. I’m rescheduling the review call to [new date] and will start the non-copy elements in parallel so we don’t lose the full week. Does this work from your side?”
This email is possible because the risk was documented. You’re not delivering a surprise, you’re reporting a known risk that materialized, with a mitigation already in motion. The tone is completely different from “we have a problem.”
What the Register Does to the Client Relationship
A risk register changes how clients perceive you. Most freelancers communicate reactively: something goes wrong, they explain it. Risk-register users communicate proactively: they named potential problems in advance, and when one materializes, they have a plan ready.
Clients don’t give top ratings to freelancers who never had problems. They give top ratings to freelancers who handled problems well. The register is the infrastructure for handling problems well.
Proactive risk communication sounds like: “This is the thing we said might happen. Here’s what I’m doing about it.” Reactive problem communication sounds like: “I’m sorry, we have an issue.” The difference in client perception is enormous, and both start from the same event.
Build the register at every kickoff. Update it every Friday. Reference it in every problem conversation. This is the habit that separates consultants who seem like they’re in control from those who seem to be surprised by their own projects.
Ready to send stronger proposals?
Build, send, and track proposals in one place so follow-up is easier.
Start your free trial →
