Risks and the risk register

Play this lesson

What could go wrong?

A risk is something that has not happened yet but would hurt the plan if it did. For Shard Garden: servers buckle on launch day, a console maker rejects the build, the only artist is out for a month.

A risk register is the team's list of risks, kept up to date, with what the team is doing about each one.

Two numbers per risk

Each risk gets a likelihood (how likely, 1 to 5) and an impact (how much damage, 1 to 5). Multiply them for a score from 1 to 25.

Hertfordshire County Council's risk guide gives this example: Likely (4) times High (4) makes 16, which it calls Severe: the red category "for most immediate and comprehensive attention and action".

Quick check

Priya adds a risk with likelihood 2 and impact 5. What is its score?

  1. 10
  2. 7
  3. 25
Show the answer

10

The score is likelihood times impact: 2 times 5 is 10. Adding them (7) would make a likely but tiny risk look as bad as a rare disaster.

Four ways to respond

The UK government's Orange Book on managing risk names four responses:

One row of the register

Every row names one owner, a single person, and a review date. A row in Shard Garden's register:

R3: servers buckle on launch day. Likelihood 4, impact 4, score 16. Response: treat, with a load test at twice the expected players. Owner: Remy. Review: every Monday.

Quick check

A risk is well managed as long as it is written in the register, even with no owner.

Show the answer

False

A risk that belongs to everyone belongs to no one. The owner makes sure the response happens and brings the risk back at each review.

Pick the response

A rare storm could flood the data centre that runs our servers: likelihood 1, impact 5. Which response fits best?

  1. Treat: keep backups in a second region, so a flood costs hours, not the game
  2. Terminate: cancel Shard Garden
  3. Delete it from the register: the score is only 5
Show the answer

Treat: keep backups in a second region, so a flood costs hours, not the game

A low score means it is not first in line, not that it can be ignored. A cheap backup in another region shrinks the impact of a rare disaster.

True story: Netflix keeps streaming

On 21 April 2011, part of Amazon's cloud in the eastern US failed, and many popular websites went down or slowed.

Netflix ran on the same cloud and kept streaming. Its engineers wrote that "this Amazon failure was exactly the sort of issue that we wanted to be resilient to." They paid in advance for more servers than they used, spread across three zones, so the others could take the load "if any one zone fails". It cost money, which they called "money well spent".

It was not painless: moving traffic out of the broken zone took manual work from every team.

Source: Netflix Technology Blog: Lessons Netflix learned from the AWS outage (29 April 2011), netflixtechblog.com

Quick check

Netflix paid in advance for servers it did not use on a normal day. Which response to the risk was that?

  1. Treat: spare servers in other zones shrink the impact of losing one
  2. Tolerate: accept the outage and watch it
  3. Terminate: stop using the cloud
Show the answer

Treat: spare servers in other zones shrink the impact of losing one

Spare capacity in other zones lowers the impact of a zone failing, so it treats the risk. It cost money up front, worth it for a risk with an impact that high.

Which one first?

A register with twenty risks is useless if the team cannot tell which one to work on this week. The score sorts them.

Bolt says: Next: score Shard Garden's risks yourself.

Fact-checked 12 October 2026