Three weeks before a major annual industry conference, the headline keynote — a well-known tech CEO — pulled out citing a board commitment. The event team had his name on the homepage, the press release, and thousands of registration emails. They had 21 days. What saved them: a written backup list of three "would-accept-on-72-hours'-notice" alternative keynotes, a pre-drafted "keynote update" comms plan, and a ticket transfer/refund policy that didn't require legal sign-off. They landed a strong replacement within 4 days. Registrations dipped 6% and recovered. Without the backup list, the scramble would have cost them 15-25% of registrations and a year of brand damage.
Risk management for events is mostly thinking through the obvious failure modes and writing down what to do. You will not prevent every risk; you will absorb them better when they come with a written plan. This guide covers the six categories of risk worth planning for, the day-of risk register that pulls them together, and the mistakes that turn manageable incidents into crises.
1. The six categories
Almost every event risk falls into one of these categories:
1. Speaker drops
- Likelihood: moderate. Illness, schedule conflicts, last-minute changes, contract disputes.
- Mitigation: 4:1 speaker pipeline during booking (confirm 4 prospects for every 1 slot). Named backups for each keynote, pre-approved and informed.
- Playbook: decision-maker pre-designated (event director, not committee). Comms template pre-drafted. Ticket refund/transfer policy published.
2. Weather / venue
- Likelihood: weather is regional; venue issues are rare but serious.
- Mitigation: indoor backup for any outdoor space. Backup venue shortlist with contacts. Transport contingency for attendees.
- Playbook: decision triggers in writing ("if wind > X mph" or "if venue notifies of issue by T-48h"). Comms tree tested.
3. Tech failure
- Likelihood: high for complex productions. Livestream failures, internet outages, AV crashes.
- Mitigation: backup AV rig for keynote room. Secondary internet (hotspots or secondary ISP). Paper backup of run-of-show. Backup laptop with identical slide deck.
- Playbook: named AV lead with authority to cut to backup. "We're having a brief technical issue" script ready.
4. Health / medical
- Likelihood: at any event over 500 attendees, medical events are essentially certain over the event days.
- Mitigation: on-site first aid, AED location identified and signed, nearest hospital phone numbers, named medical lead.
- Playbook: see emergency planning for conferences for protocol.
5. Security incident
- Likelihood: low but high-impact. Disruptive attendees, protests, credible threats, active-shooter scenarios.
- Mitigation: venue security contact, evacuation procedure briefed to staff, suspicious-behavior reporting protocol.
- Playbook: clear escalation chain. Spokesperson designated. Media response template ready.
6. Reputational / PR
- Likelihood: event-specific. Controversial speaker content, social media incident, sponsor conflict.
- Mitigation: speaker vetting for politically sensitive content. Social monitoring during the event. Pre-drafted response templates.
- Playbook: named spokesperson, pre-approved statements for common scenarios, escalation to executive leadership for severe issues.
2. The day-of risk register
One-page document, reviewed by the ops team each morning of the event. Not a bureaucratic exercise — a 5-minute check that keeps the team aligned.
| Risk | Trigger | Owner | Immediate action | |---|---|---|---| | Keynote no-show | 30 min before start | Program lead | Activate named backup speaker | | Main-stage AV failure | During session | AV lead | Switch to backup rig; emcee bridge | | Internet outage | Any time | Tech lead | Switch to secondary connection | | Medical incident | Any time | Medic + ops lead | Medic responds; ops clears area | | Fire alarm | Any time | Venue lead + ops lead | Evacuate per procedure | | Weather trigger | T-24h or day-of | Event director | Pre-defined decision tree | | Security incident | Any time | Security lead | Per incident-specific procedure | | Social media issue | Any time | Comms lead | Escalate to spokesperson | | Sponsor dispute | During event | Sponsorship lead | De-escalate, escalate if needed |
Each row has a named owner. Each owner knows the action. The document fits on one page. The morning stand-up walks through it in 5 minutes.
3. Pre-event risk review
At T-30 days, the event director should review a risk checklist with the ops team.
- [ ] Backup speakers named and confirmed for every keynote
- [ ] Internet redundancy tested (secondary ISP or hotspots)
- [ ] Backup AV rig quoted / on standby
- [ ] Medical lead designated and onboarded
- [ ] Venue security contact documented
- [ ] Evacuation procedure briefed to all staff
- [ ] Emergency contact tree tested
- [ ] Weather decision thresholds documented
- [ ] Pre-drafted comms templates for common incidents
- [ ] Insurance policies current and coverage verified
- [ ] Named spokesperson trained
- [ ] Day-of risk register drafted
Skipping this review is how events end up improvising at 9am on day 1. The review takes an hour. It pays back massively.
4. Common mistakes
- No named backup speakers. When a keynote drops at T-14 days, you are scrambling with no alternatives.
- No internet redundancy. Single point of failure for hybrid events. A single router outage can kill the livestream for 2,000 virtual attendees.
- No emergency contact tree. When something goes wrong at 11pm the night before, who do you call?
- Insurance only at the headline level. Read your liability limits and cancellation coverage. See event insurance guide.
- Ops team silos. AV doesn't know what medical is doing, medical doesn't know what security is doing. A morning stand-up fixes this.
- No post-incident review. If something did go wrong, what did you learn? Next-year planning should include last-year lessons.
5. Vendor and contract risk
Beyond day-of operational risks, events carry financial and contractual risk.
- Venue contract force majeure clauses. Read them. Post-2020 clauses are wide-ranging; know your exits.
- Speaker contract termination terms. What happens if a speaker cancels with 2 weeks notice? Does the honorarium come back?
- Sponsor contract delivery obligations. If you cancel the event, what do sponsors get? If a sponsor pulls out, what do you get?
- Vendor financial health. A vendor going bankrupt 30 days pre-event is rare but catastrophic. For critical vendors, check their business health; for non-critical ones, ensure you can substitute.
- Payment terms. Match your payment schedule to your risk tolerance. Large upfront deposits to unknown vendors are red flags.
Modern event management software handles contract and vendor tracking; the analysis and decision-making is still yours.
FAQ
Should I have a crisis communications plan? Yes — even a one-page document. Speed of response matters more than polish. Pre-draft templates for: speaker cancellation, weather delay, medical incident, security incident, social media controversy.
What's typical event cancellation insurance cost? 1-3% of total event budget. Always worth it. See event insurance guide.
How do I balance risk planning against "analysis paralysis"? Time-box it. Spend 4 hours at T-30 days on the risk review; don't spend 40. Most risk planning is 80/20 — the obvious failure modes are obvious, and a simple documented response covers most of the impact.
Who owns risk planning? The event director. Not a committee, not the ops lead, not the marketing lead. Risk decisions need a single accountable person.
What if a truly unexpected thing happens? You'll handle it imperfectly. The point of risk planning is not to prevent every surprise — it's to have muscle memory for the common ones so you have bandwidth to deal with the rare ones.
Should I share the risk register with sponsors? No. A risk register shared externally creates its own PR risk. Keep it internal.
Related guides
Ready to run your next event? Create your event on WebMobi →