A grant risk register gives an NGO one place to identify, prioritize and manage the issues that could affect delivery, compliance, safeguarding, finances or donor confidence. It should be a working management tool, not a document that is completed once and forgotten.
Why grants need a risk register
A project can be on budget and still be at risk. Staff turnover, procurement delays, partner underperformance, weak data, safeguarding incidents, exchange-rate movement, cash-flow pressure or donor-approval delays can all undermine implementation. A risk register helps the team see these issues early enough to respond.
Write risks as cause and consequence
“Procurement delay” is too vague. A better entry is: “Late equipment procurement could delay field activities by six weeks and reduce time available for participant follow-up.” This format makes it easier to decide what action is needed and who should own it.
Score likelihood and impact simply
Use a scale such as low, medium and high, or a simple numeric score. The goal is not mathematical precision. The purpose is to focus management attention on risks that could materially affect results, compliance, budget or reputation.
Add mitigation, ownership and triggers
Every significant risk should have a named owner, mitigation action, deadline and review date. For high or medium risks, add an escalation trigger. A staffing risk might escalate when a critical vacancy remains open for 30 days; a partner risk might escalate after a missed report; a budget risk might escalate when a variance crosses an agreed threshold.
Track several types of risk
- Program delivery and milestone risk.
- Finance and cash-flow risk.
- Procurement and supply risk.
- Staffing and leadership risk.
- Partner and subrecipient risk.
- Safeguarding and security risk.
- Data quality and MEL risk.
- Donor reporting and compliance risk.
Review the register with other management information
A risk that looks manageable in isolation may become serious when several warning signs appear together. Review the register alongside budget performance, milestones, partner reports and donor approvals. Link major items to your grant compliance dashboard so leadership can see which issues need action now.
Keep the register current
Close risks that are no longer active, update the score when conditions change and record decisions taken. If a risk becomes a real issue that affects agreed scope, timing or compliance, determine whether the donor must be informed. The register should show movement over time, not just a static list of concerns.
What to do next
Use the Award Absorption Capacity Check to identify operational risks before accepting or scaling a complex award.
If you are preparing grant documents, GrantsWriterAI can help structure working drafts that your team reviews against donor requirements and organizational evidence.
Want similar funding intelligence and practical grant guidance? Subscribe to Africads Grant News.
Example risk entries
A finance risk might read: “Delayed donor reimbursement could create a payroll gap in August.” The mitigation could be monthly cash-flow forecasting, earlier invoice submission and leadership review of unrestricted reserves. A program risk might read: “Low community attendance could reduce achievement of the training target.” The response might include earlier mobilization, partner support and weekly registration tracking.
These examples are stronger than labels such as “cash flow” or “attendance” because they describe what could happen and why it matters.
Review risk ownership, not only risk scores
A risk can remain red for months simply because no one has authority to resolve it. During reviews, ask whether the named owner can actually take the required action. Some risks belong with the project manager, while others need finance, executive leadership or board attention. Escalation should be explicit.
Also distinguish between a risk and an issue. A risk is something that may happen; an issue has already happened. Once a procurement delay or safeguarding incident occurs, move it into an issue or action log while retaining the history in the risk register.
Frequently Asked Questions
What is a grant risk register?
It is a structured list of risks that could affect grant delivery, compliance, finance, partnerships, safeguarding or reporting, together with their likelihood, impact and mitigation actions.
How many risks should an NGO track?
Track the risks that could materially affect the award rather than creating a long list of minor issues. The register should remain useful for management decisions.
Who owns each risk?
Every significant risk should have a named owner responsible for monitoring the trigger, implementing mitigation and escalating changes.
How often should the risk register be updated?
Review it regularly, such as monthly, and whenever there is a major change in staffing, procurement, partners, donor requirements, security or implementation context.
What is the difference between a risk and an issue?
A risk is something that may happen; an issue has already happened. Once a risk materializes, it should move into the relevant action or issue-management process.
Conclusion
A grant risk register is useful when it focuses attention on what could derail the award and what the team will do about it. Keep it current, assign ownership and connect high-risk items to management decisions. The goal is earlier action, not more paperwork.
Put this guide into practice
Free resource: The Funding Checklist. Use this free guide to apply the article’s advice to your next funding decision or application.
Optional paid resource: Nonprofit Grant Proposal Templates. Proposal, concept note, budget, logframe, M&E and donor-document starting points. Review the product details and current price before purchasing.