I'd like to come up with a "3x5 card risk board" which is essentially a movable dry-erase board where 3x5 sticky cards can be posted by the team and moved/reviewed daily/weekly as needed. (I use the 2-D grid of probability & impact for placement)

I'd like a reasonable minimum set of data for the cards so they are readable and contain just enough info to be useful. I can follow up with the author/owner after the meeting to get details that I can put into the actual register, but people tend to only look at/use the board.

Other than Title, what would people suggest be a minimum set of data for the cards?

4 Answers 4


First, I like the idea of a risk board with the probability/impact axis. It can make the team more focused on the risks of the project and can create the desire to mitigate risks and thus pull them to the lower-left side of the board.

Now, I would add the following to the risk cards:

  • A unique ID for each of the risks, that can be used to identify them in the risk register (just a running number)
  • Risk title, should be a short sentence describing just the event that could occur.
  • Risk owner

The rest of the details should be maintained in the risk register.

IMO, if the team discusses the risks on a frequent basis, this level of detail is just enough.

  • Like this set. And yes, the risk board is reviewed weekly. The only problem is that with the focus on the risk cards in yellow/red zones, many of the "small risks" don't get talked about for a while and they get "forgotten" Without the owner/id on the context is lost/forgotten.
    – Al Biglan
    May 11, 2011 at 13:06

You will also need the course of action. You can use a simple code to keep the data on the card to a minimum. Use like M for mitigate, A for accept, etc. I'd also include a code to indicate if there is a contingency plan and resources in place. Include estimated date of impact.

If you have available landscape, you can also indicate if this risk is associated with another risk or issue(s).

Finally, I'd add a stop light indicator to report its current health.


Since it sounds like you're running an independent risk register and this board is only for team use and review/identification of risks, I'd forget the 2D grid and use just use a blank space. This will eliminate the focus on "high probability/high impact" risks, and keep everyone looking at them all. You could if you wanted order them according to severity or proximity, but the grid creates an unconscious focus on specifics.

As for information, I'd suggest using both sides of the card. The front side (visible to all) would be just the risk, and its impact. On the back I'd add the risk register code as Oren suggested, the M,A,T codes per David, the risk Owner, and the date the risk was identified.

The key here is that you don't want to clutter the cards, but you don't want to lose valuable information. So separate what you need from what you want the team focusing on.

  • I like the idea of using both sides of the card! Front for "very visible" and easy to read title and the back for more of the details. I will say that the 2D grid actually aids in the discussion/focus with the team over either a blank space or having them sorted linearly.
    – Al Biglan
    May 12, 2011 at 3:14
  • Thanks Al. I probably mis-stated my intent with eliminating the grid. I think a grid during the review process is a good idea. But I think the process and ordering or risks needs to start fresh at each review to ensure clarity. Coming up to a board where risks are already ranked can lead to preconceived ideas about which is most important/severe. May 12, 2011 at 15:48
  • Actually, the grid hasn't been in the way. It helps to ensure we focus first on the "big ones" then when we start running out of time (we timebox the risk discussion) we ask owners if they want to promote any of the non-discussed risks. But yeah, we talk more about "delta Impact" and "delta probability" than assessing from scratch
    – Al Biglan
    May 12, 2011 at 20:57

I'm going by memory, but Waltzing with Bears taught me to record the following for each risk: description, cost, probability, indicators, mitigation strategies. An indicator is something you can notice that tells you that the risk is about to be realised and become a problem. I don't know whether you can fit all that on a 3x5, but I'd try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.