A study risk register earns its place when it changes decisions. That means a short list of specific risks, each with a named owner, a clear trigger, a planned response and a review date, discussed regularly in governance meetings and updated as the study evolves. Most registers fail because they are written once to satisfy a process, filled with generic risks and never opened again.
Why do most risk registers go unused?
They are too long, listing every conceivable risk with equal weight. They are generic, copied from previous studies. Ownership is assigned to a function rather than a person. Mitigation is vague: "monitor closely". Nobody reviews them. And the register lives in a different place from where decisions are made, so it never influences them.
What makes a risk specific?
A useful risk statement names the cause, the event and the effect. Not "enrollment risk", but "if the two high-enrolling sites in our lead country activate later than planned, enrollment will fall behind, delaying topline results by a quarter". Specific risks lead to specific actions. Generic ones lead to reassurance.
What should each entry include?
The risk statement, with cause, event and effect.
Likelihood and impact, using a simple, agreed scale.
A named owner who is accountable for watching and responding.
Early warning indicators that signal the risk is materializing.
A planned response: prevent, reduce, transfer or accept, with actions and dates.
A contingency plan for the highest risks, ready if indicators fire.
A review date and the current status.
How many risks should be on it?
Few enough that the team can discuss the top ones in every governance meeting. For a typical emerging biotech study, that is often 15 to 25 active risks, with the top five or so receiving most of the attention. Retire risks once they pass, and add new ones as the study changes.
How does the register connect to governance?
Make risk review a standing agenda item. The operational tier reviews the register and its indicators regularly. The tactical tier reviews the top risks and approves contingency spending. The executive tier sees the few risks that could change the company's plans. When a risk becomes an issue, it moves into the issue log with an owner and a deadline.
How does it relate to risk-based quality management?
Risk-based quality management under ICH E6 focuses on risks to participant safety and the reliability of critical data. A study risk register can include those quality risks alongside delivery risks such as timelines, budget and vendor performance. Keeping them in one view helps the team see how they interact, while making sure quality risks are documented and handled as GCP expects.
Who should own it?
The sponsor. The CRO will maintain its own risk log, and the two should be reconciled, but the sponsor's register reflects the sponsor's priorities, including risks the CRO may not see, such as financing, supply and corporate milestones. Owning it is part of owning the study.
Keep reading: Three Tiers of Governance: Operational, Tactical and Executive
