A change risk is anything on the people side that could stop the change landing. Staff who can't be released for training. A sponsor who is stretched across two programs. Teams so tired of change that they tune out.

If nobody writes these down, they surface after go-live as low adoption, and by then they are expensive to fix. The Risks page of each initiative gives every risk a category, a rating and the activities that answer it. That lets you act early and show leaders what you are doing.

By the end of this chapter you will know what belongs in the risk log and how ChangePlan rates a risk. You will also be able to add a risk, attach activities, and review and close it.

The Risks page of an initiative showing six open risks

123

What you'll end up with: the initiative's Risks page, here with 6 open risks on Larkfield's Customer billing platform replacement. 1 Risks in the initiative menu · 2 Add · 3 each risk's probability and impact.

The idea behind it: people risks, not project risks

Your project manager already keeps a risk register. It covers delivery: time, scope, budget, vendors and technology. A change risk asks a different question: what might stop people adopting and sustaining the change, even if the project delivers on time?

	Project risk	Change risk
About	Delivering the solution	People adopting it
Example	The billing vendor misses the data migration date	Billing officers don't trust the migrated data, so they keep checking the old system
Usually owned by	The project manager	The change manager, sponsor or a business lead
Answered with	Schedule, budget or scope changes	Communication, training, engagement and leadership action

Change risks also differ from impacts. An impact says who is affected and how. A risk says what might get in the way of those people adopting the change. The impact tells you where to focus; the risk tells you what to watch out for. See Understand change management risks.

One organization learned this the hard way. Its impact assessment correctly planned training on a new reporting tool. Nobody assessed the risks, and staff came to believe the tool would be used to micromanage them. Adoption lagged for months despite good training.

The risk categories

Every risk has a Category. Categories let you see patterns across initiatives, for example that sponsorship is a weak spot across the whole portfolio. Larkfield uses these seven:

Category	What it means	Example
Change fatigue	People are absorbing too many changes at once and have little capacity left.	The contact center is hit by CRM and smart meter changes as well as billing.
Cultural misalignment	The change asks for behavior that clashes with how things are really done.	A new self-service model in a team that prides itself on fixing everything by phone.
Employee resistance to change	People doubt, avoid or work around the change.	Billing officers distrust the migrated data.
Ineffective or unclear communication	People get the wrong message, a late message or none at all.	Customers aren't warned that their bill will look different.
Lack of active sponsorship	The sponsor isn't visible or doesn't have time to back the change.	The sponsor also owns another major program.
Psychosocial hazards	The change could harm wellbeing, for example through workload, stress or conflict.	A spike in calls after the first new bills increases pressure on consultants.
Resource and training deficits	People lack the time, skills or tools to make the change work.	The contact center can't release consultants for training.

Your organization's list may differ. Admins set the categories in Settings > Initiative > Risk categories.

Key terms

Change risk	Something that could stop people adopting or sustaining the change.
Category	The kind of risk, chosen from your organization's list.
Probability	How likely the risk is to happen, from Rare to Almost Certain.
Risk impact	How much damage it would do to adoption if it happened, from Insignificant to Catastrophic.
Risk rating	How serious the risk is overall. ChangePlan sets it from the probability and impact.
Level of risk (before precautions taken)	The section where you rate the risk as it stands, before your activities reduce it.
Owner	A person responsible for watching the risk. A risk can have several.
Open risks	The report that plots every open risk across your initiatives by probability and impact.

How ChangePlan rates a risk

A risk you are almost sure will happen but would barely matter needs little attention. So does a disaster that will almost certainly never happen. The risks to act on first are both likely and damaging. That is why each risk is rated on two scales, not one.

The two scales

Probability

Rare (1-5%)
Unlikely (6-35%)
Possible (36-65%)
Likely (66-95%)
Almost Certain (96-100%)

Risk impact

Insignificant
Minor
Moderate
Major
Catastrophic

Each probability comes with a percentage band, shown in the list and in the Risks table. Use the bands to keep ratings consistent between people. If two of you disagree, ask: "Out of ten initiatives like this, in how many would this happen?"

The rating grid

Put the two scales together and you get a five-by-five grid. Each cell has a fixed color. This is the grid the Open risks report uses:

Risk impact	Rare	Unlikely	Possible	Likely	Almost certain
Catastrophic	Orange	Orange	Red	Red	Red
Major	Yellow	Orange	Orange	Red	Red
Moderate	Yellow	Yellow	Orange	Orange	Red
Minor	Green	Yellow	Yellow	Orange	Red
Insignificant	Green	Green	Yellow	Yellow	Orange

Read it like a map. Risks in the top right are the most serious. Risks in the bottom left can usually be watched rather than worked on. The colors follow ChangePlan's risk key: green is low, yellow low to medium, orange medium to high, and red high. See Understand the colors used in ChangePlan.

The grid is not a simple multiplication. Look at the corners: Catastrophic but Rare is orange, while Insignificant but Almost certain is also orange. Very severe outcomes stay visible even when they are unlikely.

You don't pick the rating yourself. In the Add risk panel, Risk rating shows Not rated until you have chosen both a probability and an impact. Then it fills in automatically. In Larkfield, Likely and Major gives High, which matches the red cell on the grid.

Where a risk goes after you save it

You addRiskcategory, probability, impact

→

You linkActivitiesthat reduce it

→

InitiativeRisks tablewith its rating

→

PortfolioOpen risks reportunder Reports

You can make the link from either side. Use Select activities on the risk, or Select risks on the activity, under Impacts and risks. The activities are ordinary initiative activities. They still appear on the initiative's activity plan, on the timeline and in activity burden. A risk response is planned like any other piece of change work. See Plan activities and view the timeline.

Step by step: add a risk

Before you start

You need Full access to the initiative, or to be one of its Editors (read/write access). Viewers have read-only access. See Give people access to an initiative.
To link activities while you add the risk, add the activities first. Otherwise, link them later from the activity with Select risks.

Open the initiative and click Risks in its left menu 1.
Click + Add 2. The Add risk panel opens on the right.
Choose a Category, such as Change fatigue or Lack of active sponsorship A. You can type in the list to search it.

ABCD

The Add risk panel. A Category list · B Level of risk (before precautions taken) · C Select activities · D Closed.

Set the Date raised: the date the risk was first raised. It is required.
Fill in the Description (required). Write what could happen and what it would do to adoption (see the tip below).
Under Level of risk (before precautions taken), choose the Probability and the Risk impact B. Rate the risk as it stands today, before your activities take effect.
Check the Risk rating. It changes from Not rated to a rating such as High. If the result feels wrong, revisit your probability and impact.
Under Activities, click Select activities C and choose the activities that reduce the risk. They are listed under Activities attached.
Under Owner & comments, click Add risk owners and choose one or more people to watch the risk. Add any Comments.
Click Add risk. The risk appears in the Risks table with the status Open.

Adding many risks at once

If you already have a risk log in a spreadsheet, import it with the risks template. Each row becomes an open risk. The category must match your Risk categories exactly, and probability and impact must match the allowed values. Import activities first if you want the template to link them. See Import data with Excel templates.

Step by step: review and close a risk

A risk log is only useful if it is current. Review it at each milestone, before each steering meeting, and whenever scope, dates or your audience change.

Open the initiative and click Risks. Use Filter, Columns or search if the list is long.
Open the risk to edit it.
Ask three questions. Has the probability or impact changed? Are the attached activities done, and did they work? Is a new activity needed?
Update the description, ratings or activities, and save.
When the risk has been dealt with, or no longer applies, tick Closed D at the top of the panel and save.

A closed risk stays on the initiative as a record of what you watched and how you handled it. It no longer counts as an open risk, so it drops out of the Open risks report. If the risk comes back, open it and untick Closed to reopen it. See Close a change risk.

Worked example: the billing platform's risk log

Larkfield is replacing its customer billing platform. The change manager runs a risk workshop with the contact center manager and the billing team lead. Six risks come out of it.

Larkfield · Customer billing platform replacementNetwork & Customer Transformation

Category	Description (as shown in the table)	Probability	Risk impact	Grid color
Resource and training deficits	Contact center cannot release consultants fo…	Likely (66-95%)	Major	Red
Change fatigue	Contact Centre hit by CRM, smart meter com…	Likely (66-95%)	Major	Red
Ineffective or unclear communication	Customers not warned about the new bill for…	Possible (36-65%)	Moderate	Orange
Psychosocial hazards	Call spike after first bills increases consultant…	Possible (36-65%)	Moderate	Orange
Lack of active sponsorship	Sponsor also owns the CRM program and ma…	Unlikely (6-35%)	Moderate	Yellow
Employee resistance to change	Billing officers distrust migrated data	Possible (36-65%)	Minor	Yellow

Categories, descriptions, probabilities and impacts as recorded in Larkfield. Grid colors are read from the rating grid above.

What ChangePlan shows. The Risks table lists all six as Open, and the count next to the page title reads 6. On the Open risks report, the two contact center risks add to the Likely and Major cell. Across Larkfield's active initiatives that cell holds 7 risks.

7

The Open risks report: 7 likely, major risks across Larkfield's active initiatives.

What the change manager does next. The two red risks come first, and both point at the contact center.

Resource and training deficits: they attach the two training workshop sessions already on the activity plan. They also ask the contact center manager to agree release dates before the sessions are booked.
Change fatigue: they check the Change saturation report to see when the CRM and smart meter changes land on the contact center. Then they ask the sponsor whether billing go-live can move out of that peak. See How the Change saturation report works.
The two orange risks: they add a customer letter explaining the new bill. They also plan short team huddles for the first billing week.
The two yellow risks: they record them and review them monthly, with no new activities yet.

At the next steering meeting they export the Open risks report. They list the two red risks in the Risks section of their delivery update deck. See Create a Project Delivery Update.

What a good risk log looks like

The right number of risks. As a guide, 3-5 for a Small initiative and 5-7 for Medium. For Large, 7-10; for Extra Large, 10-15 or more. Size comes from the change effort assessment. See Assess change effort.
A spread of ratings. Most risks sit in the middle of the grid, with a few red ones that get real attention.
An activity behind every red and orange risk. A serious risk with nothing attached is a gap in the plan.
Recent dates. Risks are reviewed, and old ones closed, rather than left to pile up.

Common mistakes

Logging project risks. "The vendor may deliver late" belongs in the project register. Ask what the delay would do to people, and log that instead if it matters.
Vague descriptions. "Resistance" tells nobody what to do. Name the group, the cause and the consequence, using If…, then….
Rating everything Likely and Major. If every risk is red, none of them stands out. Use the percentage bands and compare risks against each other.
No activities attached. A rating without a response is just a worry. Attach at least one activity to every red or orange risk.
Never closing anything. An out-of-date log makes the Open risks report misleading for leaders. Close risks that have been dealt with.
No owner. A risk that everyone can see but nobody owns tends to drift. Add at least one person under Owner.

FAQs

Where do I see risks across all initiatives?

Click Reports in the left menu and open Open risks. Use the Initiative Status, Portfolio and Type filters to narrow it. See View and export open risks.

Can I add a category that isn't in the list?

Not from the risk itself. Ask your ChangePlan admin to add it in Settings > Initiative > Risk categories. Renaming a category there renames it on risks already filed under it. Deleting one leaves those risks as they are.

Can one activity reduce several risks?

Yes. Open the activity and use Select risks to link it to each risk it addresses. You can also attach it from each risk with Select activities.

Who can add or edit risks?

People with Full access to the initiative and its Editors, who have read/write access. Viewers have read-only access.

Should I update the probability after my activities work?

There is only one rating section, and it describes the risk before precautions are taken. If your activities have dealt with it, close the risk. If the situation itself has changed, such as a new go-live date, update the ratings. Note why in Comments.

Can a risk have more than one owner?

Yes. Owner accepts several people. Use it for the people who will actually watch the risk, such as the change manager and the business lead closest to it. Add context in Comments.

How long should a risk assessment take?

Match it to the initiative's size. Allow about 30-45 minutes for Small, 1-2 hours for Medium and 2-4 hours for Large. For Extra Large, allow 4 hours or more over 1-2 weeks.

Related articles

Next stepPlan activities and view the timeline

Understand change management risks
Manage change risks
Close a change risk
View and export open risks
Import data with Excel templates

Still stuck?

Email support@changeplan.co with a screenshot of what you see, and we'll help.

Last updated: 22 October 2026