The Human Factor in Risk Management – Moving Past the Spreadsheets

Project risk management is a discipline dominated by processes, risk registers, scoring scales and compliance, yet adherence to the process alone will not prevent projects from going wrong. The risks with the most significant impacts on projects are often rooted in human behaviour: poor communication, poor project culture, optimism bias, reluctance to challenge unrealistic assumptions, ineffective decision-making and a failure to escalate concerns early enough.

Managing project risk requires much more than simply documenting what might go wrong. It requires developing the risk-focused culture, the human behaviours, judgement and communication skills that enable project managers and their teams to recognise increasing and emerging risks and taking action to minimise their impact on the project objectives.

In almost any project management office (PMO) or recently opened files of the project manager you will find a beautifully formatted spreadsheet or software tool that is the risk register. Each risk is meticulously categorised by probability and impact, possibly colour-coded from red to green and it will be updated ahead of any important meetings. This may look to the outsider like sophisticated risk management but, in reality, more often– it is a tick-box exercise.

2025 data from the Project Management Institute indicates that approximately 13% of total investment in projects is lost due to poor performance. This is a financial loss that has been persistently poor for decades. If current practices and industry tools were working effectively, these numbers should be dropping. Instead, many projects mistakenly focus on analysing and administering risk, rather than actively managing it.

13% of total investment in projects is lost due to poor performance

Project Management Institute

Once a tool for proactive decision-making, the risk register has degraded into a liability shield: a way for project teams to prove foresight without taking responsibility for prevention.

Why the risk management process is broken

The traditional project risk register is built with a predictable, stable world in mind, but projects usually operate in environments that are highly volatile and uncertain. Project teams treat the creation and population of the risk register as a milestone of project initiation. Once the first spreadsheet has been populated with information during project planning, it is considered that the intellectual heavy-lifting has been completed. Any updates that follow are something of an updating and formatting exercise, rather than an active interrogation of existing risks and a thorough identification of new risks.

This is a process-heavy approach that can unfortunately create a false sense of security. When risk management is reduced to simply filling out boxes, the goal simply becomes the necessity of completing the process to pass the audit, rather than securing the outcome of mitigated risk. The compliance framework gives rewards to project teams for having documented risk countermeasures, regardless of whether they are realistic, resourced, being actioned, and having the desired effect on the risk exposure of the project. If a risk materialises and impacts the project, the project manager can then point to a specific line of the spreadsheet and declare that the risk was actually identified successfully, thus shielding themselves from accountability.

This type of administrative overhead introduces an additional vulnerability: it consumes the time and energy that a project team could have spent actively managing risk.

The human gap in risk mitigation

Effective risk management is only partially a form of mathematical equation; it is mainly a human behaviour. A risk register cannot speak in a meeting when a key stakeholder demands an unrealistic project timeline. It cannot prevent a contractor from cutting corners to meet an arbitrary milestone. It cannot force a business unit to dedicate all of its best people to user testing.

When a project environment values process compliance over people and human behaviours, team members adapt to those priorities (“what gets measured, gets managed”). If a beautifully formatted risk register is used as a yardstick with which to measure the effectiveness of project risk management, then it is only natural that project teams will modify behaviour accordingly. The real risks are those which are only spoken of among team members and off the formal record. These known risks remain completely detached from any of the formal documentation, which should be used to record them and take action to manage them.

If you were to ask project stakeholders, ‘what’s concerning you most about this project?’ or ‘what keeps you awake at night about this project?’, you would get answers that don’t appear on the risk register. So why does such behaviour persist and, more importantly, how can that behaviour be changed?

Real Outcomes

“Parallel quickly became more than a training provider; they became a trusted partner. Ruth invested time in understanding our business, our people and the outcomes we wanted to achieve. The impact on project management capability has been clear.”

Sally-Ann Kirk, First Milk HR Business Partner

Moving from compliance to competence

To genuinely manage risk, organisations must create a pro-active risk management culture and involve people who possess the critical thinking skills at each stage of the process. It’s well known that ineffective communication is the major contributor to project failure, and it can impact negatively on the quality of project risk management as well.

Reducing risk means making the move away from one-size-fits-all methods and moving instead toward behavioural competence. Project teams need to understand how they should facilitate uncomfortable conversations, safely challenge assumptions, and adapt when there are early indicators of trouble. These are not skills that can be picked up by reading a manual or by completing a certification course. They need behavioural development that is specifically targeted.

Beyond simply avoiding failure, true risk management is equally about recognising and capturing value. When teams develop the behavioural flexibility to challenge assumptions and adapt early, risk management shifts from a purely defensive exercise into a strategic driver of growth. Uncovering a potential disruption often reveals adjacent opportunities, whether that means optimising a workflow, pioneering a new process, or reallocating resources to higher-value activities. By expanding the focus beyond threat mitigation to actively exploiting upside risks, projects can turn uncertainty into a competitive advantage rather than just a cost to be managed.

Crucially, building this competence relies on developing a culture that treats lessons learned from previous projects as actionable insights rather than history to be forgotten. Truly learning from past experiences requires teams to move beyond documenting what went wrong and instead to focus on whether those circumstances could recur and to change how they respond in real time. When lessons learned are embedded into daily routines, reflection becomes a driver of behavioral growth, ensuring that past project issues inform smarter decisions, stronger team dynamics, and genuine risk prevention on the next project.

Bespoke training as the strategic fix

One sustainable way in which you can bridge the gap between compliance and competence is through bespoke training tailored to the specific operational realities of the organisation and its projects. Accredited training for project managers teaches people how they can follow a process, which is, of course, an essential capability for project managers. But bespoke training teaches them to think and act differently.

Training customised to the culture of an organisation makes it possible for teams to practice scenario analysis using previous project examples, to learn how to identify the subtle organisational cues that usually precede issues, implement risk thresholds, and to develop the communication strategies that are needed to manage difficult stakeholders.

Bespoke training programmes look at risk management as a live capability instead of a static document. They equip project leaders with the tools that they need to foster psychological safety in their teams, making sure that key risks are identified, escalated and action taken before they have a chance to become real project issues. When an organisation invests in tailored learning and development, this can help to change the underlying behaviour of its people and its project culture.

Then genuine risk mitigation will be driven by skilled professionals who understand that managing risk means managing human complexity, not ticking boxes on documentation.

Why Choose Parallel?