Free tool
RAID log template
Log risks, assumptions, issues and dependencies in one place. Risks are scored as you type, anything past its date is flagged, and you get a summary to paste into your status email. Or download the Excel and Word versions.
Filled in with an example so you can see how it works.
1. Project
2. Risks, assumptions, issues and dependencies
R1High · 16
R2Medium · 9
R3Medium · 8
R4Medium · 9
Score = probability × impact, each 1 to 5. 1–4 Low, 5–9 Medium, 10–16 High, 20–25 Critical.
3. Summary to share
3 open risks, 2 open issues, 1 assumption to confirm, 2 open dependencies (1 high or critical, 2 overdue).
RAID log: Clinic booking system rollout
As of Nov 6, 2026
3 open risks, 2 open issues, 1 assumption to confirm, 2 open dependencies (1 high or critical, 2 overdue)
Risks (3 open)
R1. [High 16 (P4 × I4)] Moving patient records takes longer than the two weekends planned, pushing go-live past Dec 1
Owner: Priya Shah. Review by Nov 13. Response: Rehearse the move on a copy of last month's data by Nov 12; hold a third weekend in reserve.
R2. [Medium 9 (P3 × I3)] Front-desk staff aren't trained before go-live because of holiday rotas
Owner: Tom Reyes. Review by Nov 20. Response: Two short sessions per clinic, recorded for anyone who misses them.
R3. [Medium 8 (P2 × I4)] IT security doesn't approve the vendor's text-message reminders in time
Owner: Alex Chen. Review by Nov 10. Response: Security questionnaire sent Nov 2; go live without reminders if needed and add them in January.
Assumptions (1 open)
A1. [Unconfirmed] The vendor's booking API handles 100 requests a minute, enough for a busy Monday morning
Owner: Alex Chen. Confirm by Nov 4 (overdue). How it will be confirmed: Ask the vendor for the documented limit and test with last Monday's volume.
Issues (2 open)
I1. [High priority] The vendor's test environment has been down since Nov 3
Owner: Alex Chen. Resolve by Nov 9. Action to resolve: Ticket raised Nov 3; escalate to the account manager if it isn't fixed by Nov 9.
I2. [Medium priority] Two clinic managers haven't seen the new booking screens
Owner: Tom Reyes. Resolve by Nov 12. Action to resolve: Book a 30-minute walkthrough with each.
Dependencies (2 open)
D2. [At risk] Signed data-sharing agreement from the regional health board
Owner: Priya Shah. Needed by Nov 5 (overdue). What's needed, from whom: Their legal team has the draft; follow up by phone.
D1. [Waiting] Network upgrade at the North clinic, from the IT infrastructure team
Owner: Alex Chen. Needed by Nov 20. What's needed, from whom: Upgrade must finish before the tablets are installed on Nov 23.
2 closed items not shown.The summary lists open items only. The CSV has every item, open and closed. Nothing you type leaves your browser.
What a RAID log is for
A RAID log is the list of things that could knock the plan off course, kept where everyone can see them. Each entry has an owner, a date and a next action, so it gets reviewed instead of forgotten. The four sections:
- Risks: things that might happen and would hurt the plan if they did. “The data move takes three weekends, not two.”
- Assumptions: things the plan treats as true that nobody has checked yet. “The vendor's API handles our Monday-morning volume.”
- Issues: problems that are already happening. “The test environment has been down since Tuesday.”
- Dependencies: things you need from another team or supplier, or owe them. “Network upgrade at the North clinic, needed by Nov 20.”
What to put in each column
- Description: write the cause and the effect in one sentence. “Late hardware” is a heading; “the tablets arrive after Nov 23, so two clinics go live without check-in” is a risk someone can act on.
- Owner: one person, not a team. The owner doesn't have to fix it alone, but they say what's happening at each review.
- Date: each type has its own meaning. Review a risk by, confirm an assumption by, resolve an issue by, need a dependency by. An open item with a date in the past is overdue, and the builder flags it.
- Action: the response to a risk, how an assumption will be checked, the next step on an issue, or exactly what you need and from whom.
- Status: Open or Closed for risks; Unconfirmed, Confirmed or Proved wrong for assumptions; Open, In progress or Resolved for issues; Waiting, At risk or Delivered for dependencies.
How to score a risk
Rate probability and impact from 1 to 5, then multiply them. A risk that's likely (4) with a major impact (4) scores 16, which is High: act now and tell the sponsor. One that's unlikely (2) with a major impact (4) scores 8, which is Medium: give it an owner and review it in each report.
- 1 to 4, Low: note it and review monthly.
- 5 to 9, Medium: owner and response; review in each status report.
- 10 to 16, High: act now and report it with the response.
- 20 to 25, Critical: escalate this week; the plan should change if it isn't reduced.
The Excel template has a five-point scale for each, worded so people score consistently (for example, impact 3 means “a milestone moves, the launch date holds”). Agree the wording with your sponsor and keep it for the life of the project.
Example: a RAID summary for the weekly status email
This is the example from the builder above, as plain text. The project and names are made up.
RAID log: Clinic booking system rollout
As of Nov 6, 2026
3 open risks, 2 open issues, 1 assumption to confirm, 2 open dependencies (1 high or critical, 2 overdue)
Risks (3 open)
R1. [High 16 (P4 × I4)] Moving patient records takes longer than the two weekends planned, pushing go-live past Dec 1
Owner: Priya Shah. Review by Nov 13. Response: Rehearse the move on a copy of last month's data by Nov 12; hold a third weekend in reserve.
R2. [Medium 9 (P3 × I3)] Front-desk staff aren't trained before go-live because of holiday rotas
Owner: Tom Reyes. Review by Nov 20. Response: Two short sessions per clinic, recorded for anyone who misses them.
R3. [Medium 8 (P2 × I4)] IT security doesn't approve the vendor's text-message reminders in time
Owner: Alex Chen. Review by Nov 10. Response: Security questionnaire sent Nov 2; go live without reminders if needed and add them in January.
Assumptions (1 open)
A1. [Unconfirmed] The vendor's booking API handles 100 requests a minute, enough for a busy Monday morning
Owner: Alex Chen. Confirm by Nov 4 (overdue). How it will be confirmed: Ask the vendor for the documented limit and test with last Monday's volume.
Issues (2 open)
I1. [High priority] The vendor's test environment has been down since Nov 3
Owner: Alex Chen. Resolve by Nov 9. Action to resolve: Ticket raised Nov 3; escalate to the account manager if it isn't fixed by Nov 9.
I2. [Medium priority] Two clinic managers haven't seen the new booking screens
Owner: Tom Reyes. Resolve by Nov 12. Action to resolve: Book a 30-minute walkthrough with each.
Dependencies (2 open)
D2. [At risk] Signed data-sharing agreement from the regional health board
Owner: Priya Shah. Needed by Nov 5 (overdue). What's needed, from whom: Their legal team has the draft; follow up by phone.
D1. [Waiting] Network upgrade at the North clinic, from the IT infrastructure team
Owner: Alex Chen. Needed by Nov 20. What's needed, from whom: Upgrade must finish before the tablets are installed on Nov 23.
2 closed items not shown.A good log makes the agenda obvious. Two items are overdue: the API assumption was meant to be confirmed by Nov 4, and the data-sharing agreement was needed by Nov 5. Add the one High risk, moving the patient records, and that's this week's meeting.
Keeping the log alive
- Review it on a fixed day. Most teams go through it weekly, the day before the status report, so the report and the log agree.
- Ask owners for a date, not a feeling. “Still in progress” tells you nothing. Ask whether the item will be closed by its date, and for a new date if not.
- Close things. A log where nothing closes stops being read. When a risk happens, close it and open the issue it became.
- Put the top items in the status report. The project status report template has a risks and issues section; paste the RAID summary there, or link the log.
The Excel and Word versions
- Excel template (.xlsx, 17 KB): a Summary sheet with live counts (open risks, how many are High or Critical, open issues, assumptions to confirm, open dependencies) and the scoring key, then one sheet per type. Score and Rating fill in from probability and impact, status and priority have drop-down lists, and any open item dated before the Summary's “Status as of” date turns red. Opens in Excel or Google Sheets.
- Word template (.docx, 38 KB): the same four tables and scoring key on landscape pages, for teams that keep the log in a document or print it for a review. Opens in Word or Google Docs.
Both are blank apart from one gray example row per section.
Questions
What does RAID stand for?
Risks, Assumptions, Issues and Dependencies. Some teams use Risks, Actions, Issues and Decisions instead. Both work; pick one, write it at the top of the log, and keep decisions and actions with an owner and a date whichever version you use.
What's the difference between a risk and an issue?
A risk might happen; an issue already has. When a risk happens, close it and log the issue it became, so the risk list stays a list of things you can still prevent.
How do you score a risk?
Rate the probability and the impact from 1 to 5 each, then multiply. Scores run from 1 to 25. A common banding is 1 to 4 Low, 5 to 9 Medium, 10 to 16 High and 20 to 25 Critical. Agree the scales with your sponsor before the first review so a 4 means the same thing every week.
Is a RAID log the same as a risk register?
A risk register holds risks only, usually with more detail per risk: cause, trigger, response strategy and residual score. A RAID log keeps risks next to the assumptions, issues and dependencies that feed them, which is what most project teams need week to week.
How often should a RAID log be updated?
Weekly on most projects, ideally the day before the status report so the report and the log agree. Each owner updates their own items; the project manager checks that every open item has a date in the future and a next action.
Is anything I type saved?
No. The log is built in your browser and nothing is sent to PingCadence or anyone else. Download the CSV or the Excel template to keep it.
Get the updates without chasing
The slow part of any log is getting each owner to say where their item stands. PingCadence does that for the tasks in your plan: it emails each owner a short check-in on the cadence you set, from your own Outlook or Gmail after you approve the batch, and collects “on track” or a new date measured against your baseline. See how it works.