Project Risk Management for NGOs: How to Build a Risk Register and Protect Donor-Funded Projects

Projects can face funding delays, procurement disruptions, staff turnover, safeguarding incidents, weak data quality and changes in local operating conditions. For NGOs and development agencies, effective project risk management is not about predicting every problem. It is about identifying important uncertainties, assigning responsibility and taking proportionate action before risks undermine results.

What is project risk management for NGOs?

Project risk management is the structured process of identifying, assessing, treating, monitoring and communicating uncertainty that could affect objectives. A risk may be a threat or an opportunity. In donor-funded projects, risk discussions should connect operational delivery, finance, compliance, safeguarding, community engagement and sustainability.

Why a risk register matters

A risk register provides a shared record of what could happen, why it matters, who is responsible and what action is planned. It is most useful when reviewed regularly by programme, finance, procurement and management teams rather than completed once for a proposal and then filed away.

How to score project risks

A simple starting method rates likelihood and impact on a scale from 1 (low) to 5 (high), then multiplies the scores. This produces a screening score from 1 to 25. It is an internal prioritisation aid, not a universal standard or a statistically precise probability estimate.

Example: A procurement delay with likelihood 4 and impact 4 receives a screening score of 16/25. An organisation should define its own escalation thresholds and should never use a numeric score to override urgent safeguarding or legal obligations.

Example NGO project risk register

Illustrative scenario only: The following fictional example concerns a multi-location community livelihoods programme. The scores are teaching examples, not measured risk data from an actual NGO.

Risk comparison chart: illustrative project scores

The bars below visualise the fictional risk register above. Each block represents one point on a 25-point screening scale.

Turning risk scores into action

A high score should lead to an agreed response, not just a red cell in a spreadsheet. The following actions show how an NGO might use the example register.

Seven steps to manage project risks effectively

1. Establish the context: define project objectives, locations, partners, donor conditions and decision-making authority.
2. Identify risks: consult programme staff, communities, finance, procurement and implementing partners.
3. Assess likelihood and impact: use clear criteria consistently, recording uncertainty and assumptions.
4. Prioritise responses: determine which risks require immediate action, further analysis or routine monitoring.
5. Assign risk owners: name accountable roles and agree practical actions with deadlines.
6. Track warning signs: link each important risk to observable triggers and management reporting.
7. Review and learn: revisit the register after significant changes, incidents and project milestones.

Risk management and donor compliance

Donor agreements may impose requirements for fraud reporting, procurement approvals, safeguarding, sub-grantee oversight and material project changes. Risk management supports compliance, but the register does not replace contractual obligations or mandatory reporting. Review each applicable agreement and local legal requirements.

Common mistakes in NGO risk management

• Copying generic risks into proposals without consulting delivery teams.
• Confusing an issue that has already happened with a future uncertainty.
• Using numerical ratings without explaining the criteria.
• Assigning risks to teams rather than accountable owners.
• Ignoring safeguarding concerns because their calculated likelihood is low.
• Failing to review risks when budgets, locations or partners change.

Build practical project management capability

Alverton Global Consultancy supports professional development in project management, monitoring and evaluation, governance, procurement and organisational risk. Training that combines risk registers, realistic case scenarios and management review exercises can help NGO teams make risk management a routine part of project delivery.

Frequently asked questions

What is the difference between a risk register and an issue log?

A risk register tracks uncertainties that may affect future objectives. An issue log tracks problems that have already occurred and require resolution.

How often should an NGO review its risk register?

Monthly review is often practical, with additional reviews after major changes, incidents or emerging threats. High-risk projects may require more frequent monitoring.

Is a 5 × 5 risk matrix mandatory?

No. It is a commonly used prioritisation approach. Organisations should choose a method appropriate to their operations and any relevant donor requirements.

Can risk management improve project sustainability?

It can help teams anticipate funding, operational, environmental and stakeholder challenges that might threaten benefits after project closure.

Further reading

• ISO 31000 risk management overview
• COSO enterprise risk management resources