Risk assessments

Request the risk register or risk assessments for a named project.

Public bodies maintain risk registers that record identified risks to projects, services, and finances, along with how they plan to manage them. These documents show what could go wrong and whether there is a plan to deal with it.

Dear [AUTHORITY NAME], I am writing to request the following information: The current risk register or risk assessment for [PROJECT OR SERVICE NAME], including the description of each risk, its likelihood and impact rating, and the planned mitigations. I would prefer to receive this by email. Yours faithfully, [YOUR NAME]
Back to top ↑

Who to send it to#

The public authority responsible for the project or service. You can find the right authority in the Commissioner’s directory of Scottish public authorities. You can also send your request through WhatDoTheyKnow, which publishes responses online.

Back to top ↑

Tips#

  • Name the specific project or service. If you are not sure what it is called, ask for “the risk register relating to [brief description]”.
  • Authorities sometimes withhold risk registers under the “effective conduct of public affairs” exemption. This is challengeable, particularly for projects that are already under way or completed.
  • Risk registers are updated regularly, so specifying “the current version” ensures you get the most recent one.