Who this is for: Change managers, sponsors and anyone assessing an initiative's risks.
The Risks area of each initiative is for people-side risks: things that could stop stakeholders adopting the change, such as resistance, poor communication or low leadership support. These are not delivery risks like missed deadlines.
Risk or impact?
Risks and impacts work together but answer different questions. Keep them separate so your analysis is complete and doesn't overlap:
Risk assessment | Impact assessment | |
Focus | Barriers to adoption | Scope of disruption |
Question it answers | What might get in the way of people adopting the change? | Who is affected, and how? |
Looks at | Readiness, resistance, leadership support, competing priorities, communication breakdowns | Roles, processes, tools, behaviours and structures that change |
Used to | Identify and reduce threats to adoption | Plan communications, training and engagement |
The impact tells you where to focus; the risk tells you what to watch out for.
Example change risks
Risk description | Likelihood | Impact | Notes |
Lack of senior leader sponsorship | High | High | May result in lack of visibility or urgency |
Staff overwhelmed by other changes | Medium | High | Competing initiatives may reduce attention |
Frontline staff not understanding "what's in it for me" | High | Medium | May lead to passive resistance |
Misperceptions about tool usage (e.g. fear of micromanagement) | High | Medium | Needs targeted messaging and trust-building |
Why it matters: a quick story
One organisation replaced manual spreadsheets with a new digital reporting tool. The impact assessment correctly found that frontline staff would need training on the tool, but the risk assessment was skipped. It missed a key barrier: staff believed the tool would be used to micromanage them. Adoption lagged for months despite a solid training plan. A risk assessment would have flagged the trust issue early, leading to targeted messaging and reassurance.
How much time to spend
Match your effort to the initiative's size from the Change Effort Assessment:
Change effort | Typical characteristics | Suggested time | Typical number of risks | Notes |
Small | Few groups, minimal disruption | 30–45 mins | 3–5 | Often done solo or with one stakeholder |
Medium | Some process or behaviour change | 1–2 hours | 5–7 | Consult key sponsors or leads |
Large | Cross-functional impact, visible change | 2–4 hours | 7–10 | May need a workshop or several interviews |
Extra Large | Organisation-wide, cultural or structural shift | 4+ hours over 1–2 weeks | 10–15+ | Revisit and track monthly |
Common questions
How is this different from a project risk?
Project risks are about delivery: time, scope and budget. Change management risks are about whether people will actually adopt and sustain the change.
Don't we already cover this in the impact assessment?
No. The impact assessment covers the scope of disruption. The risk assessment covers barriers to adoption, such as lack of trust, confusion or disengagement, even when the change itself is well understood.
Do I need to rate each risk?
Yes. Rating each risk by likelihood and impact helps you decide which ones need mitigation first.
What happens after I enter the risks?
Track them over time, assign owners and link activities that reduce them. Use the Risk owner field so someone is actively watching each risk; if it turns into a real issue, you're already a step ahead.
Related articles
Still stuck?
Email support@changeplan.co with a screenshot of what you see, and we'll help.
Last updated: 20 October 2026