The Risk Register: How to See Churn Nine to Twelve Months Early
Written by Alex Raymond, founder of AMplify and author of The Growth Department.
A Risk Register is a single, formal record of every identified risk across a customer portfolio, where each risk has one named owner, one category, a next action, and a date. It is not an account plan and not a field in the customer relationship management system. It is a discrete operating artifact whose job is to turn risk from something an Account Manager holds in their head into something the company can see, assign, and work. Josh Abdulla runs the version of this at Asana that lets his team see churn nine to twelve months before a renewal, and hold a forecast to ±3%. This page covers what the Register is, what goes in it, the risk categories, the review meeting that keeps it alive, and how to install it in thirty days.
What is a Risk Register?
The Register exists because of a specific failure: a green account churns, and afterward everyone discovers that somebody knew. The Account Manager had a feeling. Someone noticed the champion had gone quiet. A support engineer heard a complaint. None of it was ever written anywhere the company could act on, so the risk stayed personal knowledge until it became a number on a board slide.
A risk that lives only in someone's memory is not being managed. That is the whole premise. Once a risk is written down with an owner and a date, it becomes a task the organization can work and a pattern the organization can learn from. Until then it is a feeling, and feelings do not survive a busy quarter.
Four things change when the Register exists. Risks get caught earlier, because writing one down forces you to name it while it is still small. Patterns across accounts become visible, and one customer's issue is very often the early version of another customer's issue. The whole company gets involved, because a named risk with a named owner can pull in product, finance, or an executive. And the Account Manager stops holding the burden alone, which matters more than it sounds: people who feel solely responsible for bad news get quieter about bad news.
The Register is the central artifact of the Commitment phase of the Growth Department Method, and it is the highest-energy element of it. In one Building the Growth Department session, sixty of ninety minutes collapsed into Register content without anyone steering it there. That is what practitioners want to talk about, because that is where the work actually lives.
The fields: owner, category, next action, date
A per-account entry holds five things. The risk, named plainly in a sentence a person outside the account could understand. The severity, high, medium, or low. A short description of what you are seeing. The indicators, meaning the observable signals rather than your intuition about them. And the resolution plan: the next action, who owns it, and when it is due.
Three hard rules govern the Register, and each one exists because of a specific way these documents rot.
One owner per risk. No shared ownership, no "we." A risk owned by a team is a risk owned by nobody, and the first review where two people each assumed the other had it is the review where the Register stops being trusted.
One category per risk, no multi-select. Plenty of risks could plausibly sit in two categories. Forcing the call is the discipline, because a risk filed under three categories cannot be counted, sorted, or compared against anything.
No "Other" category. Other is where unresolved thinking goes to die. If a risk genuinely does not fit the named categories, the categories need updating. The risk does not get reclassified into a bucket nobody reads.
On tooling: a spreadsheet is fine. Most teams that install this successfully start in a shared sheet, and some stay there for years. What matters is that the Register is a single source rather than scattered across account plans, and that it gets reviewed on a calendar. A team with a beautiful tool and no review meeting has bought software instead of installing a discipline.
The risk categories
Categories matter because they make the portfolio legible. When forty risks sort into nine buckets, a leader can see that eleven accounts have executive sponsor exposure this quarter, which is a different conversation than eleven separate problems. These are the categories Alex teaches.
- Organizational change risk. The highest-priority category. Nothing ends a customer relationship faster than the executive sponsor leaving. Variants include senior turnover, a new decision maker with history at a competitor, merger or acquisition activity, announced strategic changes, and a new chief executive.
- Engagement risk. Signals from the meetings themselves. Is the customer on time, paying attention, asking real questions? The most dangerous version is senior people quietly being replaced by more junior ones.
- Relationship risk. Beyond the Account Manager. Do they like the people they work with on your side, and have your own high performers turned over? Roughly 60% of customer contacts are passively open to a job change at any time, which makes a single-threaded account a measurable exposure rather than a vague worry.
- Value risk. Can the customer articulate the return they are getting? If they cannot connect your product to an outcome they care about, the renewal is already in trouble regardless of usage.
- Negative feedback and silent detractors. A raised complaint is good news, because it is visible and addressable. The real exposure is the stakeholder who is unhappy and has not told you.
- Operational risk. Bugs, glitches, missed promises, broken commitments.
- Metric decline risk. Most metrics are lagging indicators, but direction still carries information.
- Renewal sentiment risk. What you hear when you ask directly, and the sense that something is off when you cannot point to why.
- Macro risk. Economic conditions, regulation, political change, industry disruption. Outside your control and still worth recording, because a risk you cannot fix is a risk the forecast still has to account for.
Two categories worth adding if your business calls for them are competitive risk and financial risk, meaning the customer's own financial position rather than yours. The principle is that the category list belongs to your business, and the discipline is that every risk gets exactly one of them.
One rule sits alongside the categories and overrides the rest. If something is badly broken when a customer meeting happens, abandon the agenda and spend the time on what is actually on everybody's mind. Running a polished review past a live operational failure costs credibility you will not easily rebuild.
Where the entries come from
The Register is only as good as what feeds it, and the feed is the customer conversation. A Growth Review is the highest-yield source, because it puts you in front of the person who controls the budget and produces evidenced answers rather than impressions. The rule that connects the two is the cleanest example of the whole system working: if no senior decision maker attends the review, the account goes red. Not yellow, not 70%. That rule converts a missing conversation into a recorded unknown, which is exactly what a Register is for.
The meeting mechanics that surface these signals are covered in the guide to Quarterly Business Reviews, and the account-level strategy that holds them is in the account planning guide. The loop that turns an observation into an entry is short: signal, implication, action. You see something, you name what it means for the relationship, and you name what you are going to do about it, by when, and who owns it. A signal without an implication is trivia. An implication without an action is anxiety.
The Bi-Weekly Risk Review
A Register without a review meeting becomes a document nobody opens. The review is what keeps it true.
Every two weeks is the typical cadence, and it is the right one for most teams because a month is long enough for a workable risk to become a fire. The meeting works the portfolio view, sorted by severity, rather than walking the whole book. The output per risk is small and specific: is this still the right severity, what happened since last time, what is the next action, and is the owner still the right owner.
The meeting has a second job that nobody puts on the agenda, which is to make surfacing bad news safe. If the person who brings a red account gets scrutinized harder than the person who brings none, you will have a Register full of greens inside two quarters. The response to bad news has to be visibly better than the response to silence, or people will choose silence.
This meeting is one of the seven that make up the Cadence phase of the Method, and it is usually the first one worth installing.
Red Renewals at Asana
Josh Abdulla, Chief Customer Officer at Asana, inherited a churn problem at a company doing $700 million in annual recurring revenue across 170,000 customers. What he built is the most complete working version of this system.
Red Renewals is a non-negotiable biweekly meeting that works renewals nine to twelve months out. Customer Success Managers categorize each risk and arrive with a proposed resolution rather than a status update. Abdulla's own leadership attends, which is the forcing function: a meeting senior people attend is a meeting people prepare for. The standard he holds the organization to is ±3% forecast accuracy quarterly, against an industry where only about one in five Customer Success organizations forecasts within ±5%.
The nine-to-twelve-month horizon is the part most teams get wrong. A risk surfaced that far ahead is workable. The same risk surfaced thirty days before renewal is a fire drill with a predictable ending. Abdulla is also blunt about the signal most teams over-rely on: low usage is a downstream symptom of an upstream failure that is already months old by the time the number drops. A team watching the dashboard is watching a lagging indicator and calling it early warning. His full account is in the Red Renewals episode.
Get to Green at IntelePeer
Mike Rapp at IntelePeer runs the complement to the Register: what happens once an account is actually red.
His Get-to-Green plan joins the account plan and the Register entry into one working document, with an explicit owner, a timeline, and metrics that define what green means for this specific account. The reason to combine them is that they answer two halves of the same question. The Register says what is wrong and who owns it. The account plan says what the relationship is supposed to become. An account in trouble needs both in front of the same people at the same time, or you get a risk being managed with no view of the relationship it sits inside.
Defining green in advance is the part teams skip. Without a stated finish line, a red account stays red indefinitely, or gets quietly marked green because everyone is tired of discussing it. Rapp's episode is Serve, Retain, Sell.
Lisa Honaker's work on spotting risk early sits alongside this, and her framing is the useful counterweight to bloated process: the glorification of busy produces documents that get heavier while relationships get no stronger. A Register with forty fields will not get filled out honestly. Her episode on managing risk before it is too late is here.
The global Register and the Chief Financial Officer
Per-account Registers roll up into a portfolio view sorted by severity. That roll-up is what turns the Register from an Account Manager's tool into a company instrument, and it is the version that changes what the business can do.
The recurring review of that portfolio goes by several names: risk review, issue resolution meeting, or get-to-green meeting. What matters is who attends. The Chief Financial Officer, or the Chief Financial Officer's designate, should be in the room. The reason is practical rather than ceremonial. The Chief Financial Officer owns the revenue forecast, so portfolio risk is directly their problem, and they are the person who can free the resources a red account needs. A risk review that can identify problems but cannot release resources to solve them is a reporting exercise.
This is also where the Register pays back the function politically. A Post-Sale team that walks into a finance conversation with a categorized, owned, dated portfolio view is having a different conversation than a team presenting a wall of 70% probabilities. The economics justify the attention: a renewed dollar costs about thirteen cents to earn, against a new-logo dollar that costs more than a dollar at negative gross margin. Protecting the base is the cheapest revenue work the company does, and the Register is how that protection becomes visible. The renewal side of this is covered in the guide to running renewals.
How to install the Risk Register in 30 days
Week one. Create one sheet. Set the columns: account, risk, severity, category, description, indicators, next action, owner, due date. Agree the category list with your team and delete the "Other" column if someone added it.
Week two. Populate it from what people already know. Every Account Manager writes down the risks they are currently carrying in their head, one line each, for their top accounts. Expect this to be uncomfortable and expect the first pass to be thin. People under-report at first because writing a risk down feels like admitting to one.
Week three. Run the first review. Sort by severity, work the top of the list, and assign a single owner and date to each. Whoever brings the worst news gets treated best. That is a deliberate choice you make in the first meeting and it sets the tone for every meeting after.
Week four. Roll up to the portfolio view and get the Chief Financial Officer or their designate into the next one. Bring three things: the severity-sorted list, the risks that have a resolution in flight, and the specific resources you need released.
After thirty days the Register is running and the question changes from whether to keep it to what else it should feed. The answer is usually the forecast, because a portfolio with categorized, owned risk is a portfolio you can put a defensible number against.
What the Register actually buys you
Josh Abdulla's system and Mike Rapp's plan are the same insight from two directions. One says risk has to be seen nine to twelve months out to be workable. The other says a red account needs its risk and its strategy on the same page. Both are answers to the question of whether the organization can act on what its people already know, which is the only question that separates a Register from a spreadsheet.
The anti-fragility test is the one a leader should hold. If your best Account Manager left tomorrow, would the portfolio's risk picture be intact, or would it leave with them? A book held together by one person's memory is fragile by design. The Register is how that knowledge stops living in a single head.
Where to start
Open a sheet today. Write down the five risks you are currently carrying about your own accounts, one line each, with a severity and a category. Give each one an owner and a date, even if the owner is you. Put the worst one on the agenda of your next team meeting and say it out loud. That is the whole installation, at the smallest scale it works at. Everything after is the same thing with more accounts and more people in the room.
The Growth Department is the post-sale revenue operating standard for B2B companies. Take the ten-minute Post-Sale Stress Test to see where your function stands across Clarity, Commitment, and Cadence. Or download the free audiobook of The Growth Department and read the manifesto.
About the author Alex Raymond is the founder of AMplify and the author of The Growth Department, the operating standard for the function that delivers most of a company's revenue. He spent a decade building Account Management and Customer Success systems with B2B companies before founding AMplify, where he works with Post-Sale leaders on installing the Growth Department Method. He hosts the Account Management Secrets podcast.
