How to Write a Risk Register for a Grant Bid

Risk can feel like the section of a grant application where you are invited to talk yourself out of funding. In fact, it is one of the places where you can show a funder that you know what you are doing. This guide explains what a risk register is, what funders look for and how to write one that is clear and useful.

What a risk register is

A risk register is a table of the things that could stop your project going to plan. For each risk it records:

• the risk: what could happen
• likelihood: how likely it is
• impact: how serious it would be
• mitigation: what you will do to make it less likely or less damaging
• owner: who is responsible for watching it

Some funders ask for a separate risk register. The National Lottery Heritage Fund, for example, says all applicants to its £10,000 to £250,000 grants must submit a project plan and a risk register, and offers a template. Others ask a question about risks in the form, and some leave it to you. Either way, the thinking is the same.

What funders look for

The Heritage Fund describes its approach in a way that applies widely. It says all projects face threats and opportunities, that it wants you to be realistic about the risks your project and organisation may face, and that it will make a measured judgement on those risks and look to see whether you have identified them and explained how you will reduce them. It also asks you to consider contingency costs carefully.

So funders want:

• Realism. A register that lists only trivial risks, or claims there are none, is less convincing than one that names the real ones.
• Specific mitigations. "We will monitor this" is not a plan. "We have a second venue on standby" is.
• Organisational risks as well as project risks. For example, depending on one key person.
• Proportion. A small project needs a short register. A large capital project needs a fuller one.

Our guide to how funders assess grant applications explains where risk fits in the scoring.

Types of risk to consider

The Heritage Fund suggests considering these types of risk, with examples:

• Financial: a reduced contribution from another funding source
• Organisational: a shortage of people with the skills you need, or staff needed on other projects
• Economic: an unexpected rise in the cost of materials
• Technical: discovering unexpected damp or other problems
• Social: negative responses to consultation or a lack of interest from your audience
• Management: a significant change in the project team
• Legal: changes in law that make the project impractical
• Environmental: difficulty finding sustainable materials

For community projects, you might add:

• Demand: fewer people take part than expected, or far more
• Volunteers: not enough volunteers, or volunteers leaving
• Safeguarding: risks to children or adults at risk, if you work with them
• Partners: a partner cannot deliver its part
• Timing: delays in permissions, recruitment or other funding decisions

How to rate risks

Keep the scoring simple. Most small organisations use a three-point scale:

Score	Likelihood	Impact
Low	Unlikely to happen	Minor delay or cost
Medium	Could happen	Noticeable effect on delivery or budget
High	Likely to happen	Could stop the project or cause harm

Some people multiply likelihood by impact to get an overall score. That is fine, but the scores matter less than the mitigations. Focus your effort on the risks that are both likely and serious.

Writing good mitigations

A good mitigation is an action you will take, or have already taken. Compare:

• Weak: "Low take-up. We will promote the project."
• Strong: "Low take-up. We have agreed referrals with two GP practices and the local food bank, and will review numbers monthly. If numbers are under 10 after six weeks, we will move sessions to the evening, as requested in our survey."

Other features of strong mitigations:

• They are already in progress where possible, such as quotes obtained or permissions applied for.
• They have a trigger: the point at which you will act.
• They have an owner: a named role, not "the team".
• They are funded if they cost money. A contingency line in the budget, where the funder allows it, is a mitigation in itself. Rules vary: National Lottery Awards for All England, for example, says it cannot fund contingency costs.

A template to copy

Risk	Likelihood	Impact	Mitigation	Owner
Match funding from the council is reduced	Medium	High	Two other funders approached; project can be phased (see plan B)	Treasurer
Project lead leaves	Low	High	Second trained volunteer shadows the lead; procedures written down	Chair
Building costs rise	Medium	Medium	Estimates under three months old; contingency of 10% in budget	Project manager
Low attendance	Medium	Medium	Referral agreements with three partners; monthly review; change times if needed	Project lead
Safeguarding incident	Low	High	Safeguarding policy, trained lead, DBS checks for relevant roles	Safeguarding lead

Adapt it to your project. Five to ten well-chosen risks is plenty for most community bids.

Your plan B

Your biggest risk is often that not all the money comes in. Garfield Weston Foundation asks applicants what will happen if they cannot raise everything they plan to: whether the work can go ahead at a reduced level, be phased, or would need to be cancelled and rethought. Answer this in your risk register or alongside it. Our guide to sustainability and exit strategies covers plan B in more detail, and our match funding guide explains what to do if a contribution falls through.

Common mistakes

• Listing only external risks. Weather and pandemics matter, but funders also want to see risks inside your control, such as staff capacity and financial controls.
• Mitigations that repeat the risk. "Risk: volunteers leave. Mitigation: keep volunteers" is not a plan.
• Ratings that are all low. If nothing is rated medium or high, the register will not look realistic.
• A register that does not match the rest of the bid. If your budget has no contingency and your register relies on one, an assessor will notice.

Keep it alive

A risk register is a working document. Review it at your committee or team meetings, update the ratings and add new risks as they appear. If something goes wrong during the project, tell your funder early. Our grant monitoring and reporting guide explains what funders usually expect you to report, and our capital grants guide covers the extra risks in building projects.

Find grants and plan your bid

GrantMatch lists open grants with their requirements, so you can see early which funders ask for a risk register. Browse grants for charities or grants for community groups, or create a free profile and we will match you with the right funders.