vaayaa Inclusive Education
Professional risk assessment

Project and Program Management Risk Assessment: Ownership, Delivery and Control Risks

A worked example of how a program office finds, scores and controls the risks that threaten project delivery, budgets, suppliers, data and people, with inherent and residual ratings for each hazard.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: Critical to Medium
See the Project and Program Management course

Executive summary

This assessment shows how a program office can find, rate and control the risks that matter most to delivery, money, people and safety. Eight risks were chosen because they are plausible in everyday program work. Unclear ownership and weak corrective action carry the highest inherent score, because they allow small problems to grow into missed milestones. Supplier dependency, handover failure and budget leakage are also serious. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but budget leakage stays at Medium because the impact remains high. The first actions are named owners for every action, a written impact check for every change, call back checks on bank changes and a tested restore of the planning tool. The program is a teaching example, so every score illustrates method rather than describing a real organization.

Focus area
Project and program management
Setting
Program office coordinating several change projects in a mid-sized organization with shared teams and external suppliers
Method
Five by five likelihood and impact risk register

Scope

This assessment covers one program of linked projects, from initiation and planning through delivery, handover to operations and benefits review. It looks at risks to ownership, schedule, budget, people, suppliers, data and safety. It does not assess any real organization, contract or legal position. Sector, jurisdiction, team size and tools are assumptions made for teaching.

Context

The program has a sponsor, a program manager, four project managers, a shared resource pool, a planning tool, a risk log and a steering group that meets monthly. Two projects depend on external suppliers for software and site work. Each risk is scored before controls to show its natural level, then again after existing controls and the controls that should be added. Reviews use the same scale so the register stays comparable over time.

Objectives, assets and stakeholders

The objective is to deliver the agreed outputs on time, within budget and to the required quality, while protecting people, money, data and the trust of sponsors and users. The assets in scope are the program budget, the plan and risk log, supplier contracts, shared specialist skills, delivered systems and the reputation of the program office. Stakeholders include the sponsor, the steering group, project managers, specialist staff, suppliers, operational teams, end users and members of the public near site works. Clear roles matter: every risk has one owner role, and the program manager reports the register to the steering group each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H04 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 4, score 12, high: H03 H05 Likelihood 3, impact 5, score 15, high: H06
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07 Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H02 H03 H05 Likelihood 2, impact 4, score 8, medium: H01 H06
1 Rare Likelihood 1, impact 4, score 4, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unclear ownership and weak corrective action 20 Critical 8 Medium Program manager
H02 Scope creep and schedule slippage across dependencies 12 High 6 Medium Change control board chair
H03 Handover failure between projects and operations 12 High 6 Medium Operations handover lead
H04 Capacity shortfall and key person dependency 12 High 6 Medium Resource manager
H05 Supplier dependency and contract disputes 12 High 6 Medium Procurement lead
H06 Budget overrun, financial leakage and invoice fraud 15 High 8 Medium Finance business partner
H07 Data loss and outage of planning and reporting tools 8 Medium 4 Low Program office manager
H08 Site safety and contractor compliance failures 10 High 4 Low Site safety lead
H01

Unclear ownership and weak corrective action

Operational Before 20 After 8

Decisions, actions and risks have no single accountable owner, so issues raised at steering meetings are delayed, reassigned or forgotten until they cause visible failure in delivery.

Who or what is affected: Sponsor, project managers and delivery teams

Causes

Shared responsibilities across projects, informal decisions in corridors and actions copied without owners.

Consequences

Slipped milestones, repeated problems, loss of sponsor confidence and wasted effort.

Existing controls

  • Steering meeting minutes record actions and due dates.
  • Each project has a named project manager on the plan.

Control gaps

Owners are named in minutes but not checked against the register, and closure is not verified.

Additional controls

  • Prevent: Assign every risk and action one owner role in the register before it is accepted.
  • Detect: Review overdue actions at each steering meeting and report the count by owner.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Program manager Target: Within 30 days Early warning: Actions open beyond their due date with no named owner or revised date.
H02

Scope creep and schedule slippage across dependencies

Strategic Before 12 After 6

Requests for extra features are accepted without a change impact check, and dependencies between projects are not updated, so the schedule and benefits drift away from the approved program plan.

Who or what is affected: Steering group, customers of the outputs and project teams

Causes

Pressure from stakeholders, weak link between projects and optimistic initial estimates.

Consequences

Late delivery, overspend, rework and reduced benefits.

Existing controls

  • A change request form is used for scope changes.
  • Milestones are reviewed against the baseline each month.

Control gaps

Changes are logged but dependent milestones are not re-planned.

Additional controls

  • Prevent: Require a written impact on schedule, cost and dependencies before any change is approved.
  • Detect: Compare forecast dates with the baseline and flag any milestone that moves more than two weeks.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Change control board chair Target: Within 45 days Early warning: Approved changes with no matching update to dependent milestones.
H03

Handover failure between projects and operations

People Before 12 After 6

Completed outputs are passed to operational teams without complete documents, training or agreed acceptance criteria, so staff cannot run or support the new service and faults appear after the project has closed.

Who or what is affected: Operations staff, end users and support teams

Causes

Time pressure at the end of projects, unclear roles and documents written after delivery.

Consequences

Service failures, rework, user frustration and extra cost for support.

Existing controls

  • A handover checklist exists for major releases.
  • Project closure requires sign off by the sponsor.

Control gaps

The checklist is completed by the project team alone, with no operations sign off.

Additional controls

  • Prevent: Agree written acceptance criteria and training completion before a handover date is set.
  • Respond: Run a hypercare period with named support contacts and daily issue review.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Operations handover lead Target: Within 60 days Early warning: Handover items accepted with open documentation or untrained users.
H04

Capacity shortfall and key person dependency

People Before 12 After 6

Key specialists are shared across several projects or are the only people who know a system, so absence, overload or departure stops work and leaves no one able to cover critical tasks.

Who or what is affected: Project teams, specialist staff and the sponsor

Causes

Shared specialists, unplanned work, sickness and turnover without knowledge transfer.

Consequences

Delayed tasks, burnout, quality errors and missed milestones.

Existing controls

  • Resource plans show named staff for each major task.
  • Team leads hold a monthly workload review.

Control gaps

Cover for key roles is assumed rather than tested or written down.

Additional controls

  • Prevent: Record skills and cover arrangements for each critical role in the resource plan.
  • Respond: Agree a rule for moving staff between projects that the steering group must approve.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Resource manager Target: Within 60 days Early warning: Critical tasks with only one qualified person listed on the plan.
H05

Supplier dependency and contract disputes

Supplier Before 12 After 6

A key supplier misses delivery dates, produces poor quality work or disputes scope, and the program has no tested alternative, so outputs stop and claims are made against the business.

Who or what is affected: Project teams, the sponsor and end users

Causes

Single source suppliers, vague scope wording and late payment disputes.

Consequences

Program delay, extra cost, legal claims and damaged supplier relations.

Existing controls

  • Supplier contracts set delivery dates and acceptance tests.
  • Monthly supplier performance reviews are held.

Control gaps

Acceptance tests are agreed in principle but not written into each order.

Additional controls

  • Prevent: Qualify a second supplier for critical components and record the switch cost.
  • Detect: Track supplier milestones against the plan and flag missed deliveries within one week.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 90 days Early warning: Supplier deliveries that miss two consecutive milestone dates.
H06

Budget overrun, financial leakage and invoice fraud

Financial Before 15 After 8

Costs are approved without checks, invoices are paid for work not received, or false supplier details divert payments, so the budget is spent without value and funds are lost.

Who or what is affected: Sponsor, finance team and program funders

Causes

Weak receipt checks, pressure to spend budget and changes to supplier details made by email.

Consequences

Direct loss of funds, budget overrun, audit findings and reduced trust in the program.

Existing controls

  • Budgets are approved by the sponsor at each stage gate.
  • Invoices above a set value need a second signature.

Control gaps

Receipt matching is done on a sample, so small repeated payments can pass unnoticed.

Additional controls

  • Prevent: Confirm any change to supplier bank details by call back to a known contact before payment.
  • Detect: Compare invoices with goods received notes and report any payment without a matching receipt.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Finance business partner Target: Within 45 days Early warning: A supplier bank detail change that has no call back record.
H07

Data loss and outage of planning and reporting tools

Technology and data Before 8 After 4

The planning tool, risk log or shared files are corrupted, deleted or unavailable, so the plan cannot be updated, reports are wrong and decisions are made on old information.

Who or what is affected: Program office, steering group and project teams

Causes

Unmanaged copies of files, software faults and accidental deletion.

Consequences

Lost plans, delayed reporting, duplicated work and poor decisions.

Existing controls

  • The planning tool is backed up each night.
  • Access to the risk log is limited to named users.

Control gaps

Restore has never been tested, and offline copies of the plan are not kept.

Additional controls

  • Prevent: Keep one controlled copy of the risk log and restrict edit rights to the program office.
  • Recover: Test a restore of the planning tool each quarter and record the time taken.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Program office manager Target: Within 30 days Early warning: Plan updates older than two weeks or failed backup alerts.
H08

Site safety and contractor compliance failures

Safety Before 10 After 4

Contractors work without current permits, training or safety checks, so workers and the public may be injured and the program may breach its duties to protect people on site.

Who or what is affected: Contractors, site staff and members of the public

Causes

Pressure to meet dates, unclear responsibilities between main and sub contractors and lapsed training records.

Consequences

Injury, enforcement action, stop work orders and reputational damage.

Existing controls

  • Contractors sign a site safety induction before starting.
  • Incidents are logged and reported to the project manager.

Control gaps

Records are checked at induction but not again during long works.

Additional controls

  • Prevent: Check permits, training and insurance records before any contractor starts work.
  • Detect: Carry out weekly site walkthroughs and record hazards found and actions taken.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Site safety lead Target: Within 30 days Early warning: Contractor staff on site with expired training or missing permits.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on cost, time lost, effect on benefits, harm to people and damage to trust. A risk is never rated down only because it has not yet happened. Critical and High risks need sponsor attention and a dated plan. Medium risks need routine controls with a named owner. Low risks are accepted and watched. Team members who do the work should challenge the ratings at each review, and any rating is reopened when its early warning indicator reaches the escalation level.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Open actions beyond their due date, counted by owner role.Escalate to the program manager when any action is more than two weeks overdue, and to the sponsor when the count rises for two meetings running.
Approved scope changes with no matching update to dependent milestones.Escalate to the change control board chair at once, and hold further approvals until the plan is re-baselined.
Supplier bank detail changes made without a call back record.Escalate to the finance business partner immediately, and hold the payment until the change is confirmed.
Critical tasks with only one qualified person listed on the plan.Escalate to the resource manager when any critical task has no cover, and to the steering group if it stays uncovered for a month.
Contractor staff on site with expired training or missing permits.Escalate to the site safety lead at once, stop the affected work until records are valid, and report to the sponsor the same day.

Contingency arrangements

If a serious event occurs, such as a safety incident, a confirmed payment fraud or loss of the planning data, the program manager pauses related work and informs the sponsor within one working day. The finance business partner stops affected payments and preserves records. The program office restores the plan from the tested backup and rebuilds the risk log from the last approved copy. Legal and insurance contacts are made through the sponsor as the relevant rules require. Affected staff and suppliers receive a plain statement of what has happened and what happens next.

Prioritized action plan

  1. Assign an owner role to every open risk and action in the register, owner program manager, within 30 days.
  2. Run a written impact check on every scope change and update dependent milestones, owner change control board chair, within 45 days.
  3. Confirm every supplier bank detail change by call back before payment, owner finance business partner, within 45 days.
  4. Write handover acceptance criteria and training completion into each release plan, owner operations handover lead, within 60 days.
  5. Test a restore of the planning tool and record the recovery time, owner program office manager, within 30 days.

Conclusion

Reliable delivery depends on a few steady habits: a named owner for every action, a written impact check for every change, careful handover with operations, tested backups and proper checks on suppliers and contractors. The highest scores sit with ownership gaps and budget leakage, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real contract, legal, safety or financial question.

Assumptions and limitations

Assumptions

  • The organization runs change through a formal program structure with a named sponsor and steering group.
  • Site works involve contractors who are briefed on safety rules but are not employed by the organization.
  • Jurisdiction and governing contract law are not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real program or project.
  • Contract, safety and data protection rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not legal, financial or safety advice.

Related frameworks to study

  • Program governance with defined sponsor, board and assurance roles
  • Risk register with likelihood and impact scoring
  • Hierarchy of controls
  • Milestone and earned value tracking

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Project and Program Management course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners