Risk management on a workplace project: the strategic risks that matter.

Why standard risk registers miss the point

A typical contractor-led risk register focuses on construction risk: subcontractor performance, material delivery, weather. Those are operational risks with operational mitigations and they belong in the project team. They are not the risks that matter at board level.

Board-level risk on a workplace investment is about whether the asset will deliver what was promised — strategically and financially — over the decade after move-in. That's a different register, owned by different people.

The five strategic risk categories

At board level, five categories of risk drive most material outcomes:

• Demand risk — under- or over-sizing relative to actual hybrid behaviour.
• Lease and balance-sheet risk — covenant, rating and exit-flexibility exposure.
• Talent risk — failing to deliver the recruitment and retention case the investment was justified on.
• Reputational risk — visible mis-spend or strategic incoherence on a high-visibility project.
• Governance risk — decisions taken at the wrong level, or in the wrong order, leading to lock-in on weak assumptions.

Mitigation that actually works

Demand risk is mitigated with evidence-based occupancy analysis and modular scope, not larger margins. Lease risk is mitigated with structured break and expansion options modelled into the term sheet. Talent risk is mitigated with explicit KPI baselines and HR co-ownership. Reputational risk is mitigated with a clear external narrative agreed at the top.

Governance risk is mitigated structurally — see Governance of large workplace projects for the framework. It's the single category most often left unmitigated because it's invisible until it materialises.

The do-nothing risk

Almost no risk register includes the risk of not investing — yet for many organisations this is the largest exposure. Continuing in a building that no longer matches working patterns, lease maturity that constrains future flexibility, brand drift relative to peers: each carries quantifiable cost. A serious risk framework names them explicitly so the board can weigh action against inaction.

Ownership and cadence

Each strategic risk has a named owner at executive level, a quantified exposure, and a mitigation status updated monthly during active phases. Without ownership, risks drift toward the project team — where they get re-categorised as operational and lose board visibility.