ParrotNotes

Free Risk Register Template

List what could go wrong on the project, rollout or territory change. Rate how likely each risk is and how bad it would be, and the register works out the score, colours it low, medium or high, and places it on a 5 × 5 heat map. Name an owner, a response and the actions, sort by score for the meeting, then print it, save a PDF or download a CSV.

A template, not legal or compliance advice. If your organization has a risk policy, use its scales and bands.

What goes in a risk register

  • Header

    Project name, who prepared the register, the date and the next review date, so everyone knows which version is current and when it will be looked at again.

  • ID, risk and category

    A short ID (R1, R2…) to refer to in meetings, the risk written as cause and effect ("Data migration runs late, so go-live slips"), and a category such as schedule, budget, people or supplier.

  • Likelihood and impact

    Two ratings from 1 to 5. Likelihood runs rare, unlikely, possible, likely, almost certain; impact runs minor, moderate, serious, major, catastrophic.

  • Score and rating

    Likelihood × impact, from 1 to 25, banded low (1 to 4), medium (5 to 12) or high (15 to 25). The heat map shows where the open risks sit.

  • Owner and response

    One named owner per risk, and the response: avoid it, mitigate it, transfer it to someone better placed to carry it, or accept it.

  • Actions, due date and status

    What will be done and by when, and whether the risk is open, being monitored or closed. Closed risks stay on the register but leave the heat map.

How to score and review risks

Rate each risk on two 1 to 5 scales and multiply them. The University of Greenwich risk matrix, used here, multiplies likelihood by impact for a score from 1 to 25 and bands it: low 1 to 4, medium 5 to 12, high 15 or more. A risk that is likely (4) with a major impact (4) scores 16, high. One that is possible (3) with a major impact (4) scores 12, medium. A rare (1) catastrophe (5) scores 5: medium, not low, because the impact alone earns attention.

Then choose a response. NIST lists the ways to respond to a risk as accepting, avoiding, mitigating, sharing or transferring it. Avoid means changing the plan so the risk cannot happen; mitigate means lowering the likelihood or the impact; transfer means moving it to someone better placed to carry it, such as an insurer or a supplier under the contract; accept means living with it and watching it. High risks need an owner and actions with dates; low ones can usually be accepted and monitored.

Review the register in the same meeting each time, sorted by score, highest first. Ask the owner of each high risk what has changed, re-rate it if the actions worked, and close the risks that can no longer happen. Set the next review date before everyone leaves.

Need to agree who owns what before you assign risks? Start with the RACI chart template.

Reporting the top risks upward? Put them in the project status report template with the RAG status.

Risk register, risk matrix, issue log, RAID log

Risk register
The list of things that might happen, each with a score, an owner, a response and actions: this template.
Risk matrix
The 5 × 5 grid of likelihood against impact that turns two ratings into a band. It is the scoring part of the register, shown here as the heat map.
Issue log
Problems that have already happened. When a risk occurs it becomes an issue, and moves to the issue log with its own actions.
RAID log
Risks, assumptions, issues and dependencies in one place. The risk register is the R; teams that keep a RAID log often start from a register like this one.

Tips for a register people actually use

  • Write cause and effect

    "Resourcing" is not a risk. "Two reps leave before training, so the rollout slips a month" is: it names what could happen and what it would cost.

  • One owner, by name

    A risk owned by "the team" is owned by nobody. Put one name in the owner column, even when several people do the actions.

  • Agree the scales first

    Say what a 4 for impact means on this project (a month's delay, a lost account) before anyone rates, or every score becomes an argument.

  • Close risks, do not delete them

    Mark a risk closed when it can no longer happen. The history shows what the team saw coming, which is useful in the lessons learned meeting.

For project and sales leaders running the meeting: the project kickoff meeting agenda, the decision log template, the action items template, sales territory alignment.

Sources

The risks get named in the meeting. The owners and dates get lost after it.

Risk reviews move fast: someone raises a risk, someone else takes it, a date gets agreed. Record the meeting in ParrotNotes and get the transcript, a summary and the action items, so every owner and action named in the room is there to copy into the register. Free for 100 minutes of recording a month.

Get Started Free

Related tools

Risk register questions