Risk register template

What a risk register is for

A risk register is the project's list of things that haven't gone wrong yet but could. Each risk gets one owner, a score, a planned response and a date to look at it again, so the team talks about the few that matter instead of all of them. Once a risk happens it isn't a risk any more: mark it Occurred and manage it as an issue.

How to write a risk

Most weak registers fail at the description. “Network” or “Supplier delays” is a heading; nobody can score it or act on it. Write the cause, what might happen, and the effect on the plan:

• Heading: “Internet connection.”
• Risk: “The carrier quotes 60 to 90 working days to install the new fiber line, so staff could arrive on Jan 18 to no internet.”

The second one tells you who owns it (whoever manages the carrier), what would make it more or less likely (when the line is ordered), and what to watch (an install date). A useful pattern: “Because of [cause], [event] might happen, which would [effect].”

What goes in each column

• Category: schedule, cost, scope, quality, people, technical, supplier, regulatory or other. It lets you spot clusters, such as five supplier risks with one owner.
• Owner: one person who watches the risk and reports on it. Not a team, and not the project manager by default.
• Probability and impact: each 1 to 5, multiplied into a score from 1 to 25. The scales are written out in the Excel template so a 4 means the same thing to everyone.
• Strategy and response: what you'll do about it, and by when. “Monitor” is not a response.
• Trigger: the early warning sign, ideally with a date. “No install date confirmed by Nov 20” tells the owner exactly when to raise the alarm.
• After the response: the probability and impact you expect once the response is in place, which is the residual risk.
• Status and review date: Open, Occurred or Closed, and when the owner re-scores it. An open risk past its review date is flagged.

Scoring and the heat map

Probability times impact puts every risk in one of 25 cells. A common banding is 1 to 4 Low, 5 to 9 Medium, 10 to 16 High and 20 to 25 Critical, and it's the one the builder and both templates use.

• Low (1 to 4): note it and review monthly.
• Medium (5 to 9): give it an owner and a response; review in each status report.
• High (10 to 16): act now and report it to the sponsor with the response.
• Critical (20 to 25): escalate this week; the plan should change if it isn't reduced.

Read the two heat maps together. The first shows where the project stands now; the second shows where it will stand if every response works. A risk that sits in the same cell on both maps has a response that isn't changing anything, which is fine for an accepted risk and a warning sign for any other. If every risk lands on 3 × 3, the scales haven't been agreed yet.

The five response strategies

PMI's PMBOK Guide lists five strategies for threats. The examples are from the office move in the builder.

• Mitigate: lower the probability, the impact or both. Order the fiber line now and rent a 5G router as a fallback.
• Avoid: change the plan so the risk can't happen. Set the move date after the line is installed instead of before.
• Transfer: move the impact to someone else. The movers' declared-value cover pays for damaged equipment.
• Accept: take no action now, but plan for it. Expect two slow weeks after the move and schedule nothing critical.
• Escalate: the decision is outside the project's authority. A $9,000 budget gap goes to the sponsor with two options.

Example: a risk register summary for the sponsor

This is the example from the builder above, as plain text. The project and names are made up.

Risk register: Head office move
As of Nov 6, 2026
6 open risks: 1 critical, 2 high, 3 medium (1 past its review date)

R1. [Critical 20 (P4 × I5), Supplier] The carrier quotes 60 to 90 working days to install the new fiber line, so staff could arrive on Jan 18 to no internet
    Owner: Sam Ortiz. Mitigate: Order the line this week and get a committed install date; rent a 5G router for the first month as a fallback. Trigger: No install date confirmed by Nov 20. After the response: Medium 6. Review by Nov 13.

R2. [High 12 (P3 × I4), Schedule] The landlord's fit-out runs past the Dec 18 handover, leaving one weekend for the move instead of three
    Owner: Grace Lin. Mitigate: Weekly site walk with the landlord's project manager; plan the move in two waves so the first fits in one weekend. Trigger: Ceilings and flooring not finished by Nov 27. After the response: Medium 6. Review by Nov 4 (overdue).

R3. [High 12 (P4 × I3), Cost] The electrical quote pushes moving costs $9,000 over the $48,000 budget
    Owner: Hana Kim. Escalate: Sponsor decides by Nov 13: approve the extra $9,000 or drop the second meeting-room fit-out. Trigger: Final electrical quote over $14,000. Review by Nov 13.

R5. [Medium 8 (P2 × I4), People] People with a longer commute leave in the first three months, taking knowledge with them
    Owner: Grace Lin. Mitigate: Publish door-to-door commute times by Nov 20; offer two remote days a week until March. Trigger: More than two resignations that mention the move. After the response: Low 4. Review by Nov 20.

R6. [Medium 8 (P4 × I2), People] Work slows for the first two weeks while people find their way around the new building
    Owner: Hana Kim. Accept: Floor maps and a help desk in reception for week one; nothing critical is due Jan 18 to 29. Trigger: More than 30 help-desk requests a day in week one. After the response: Medium 8. Review by Jan 8.

R4. [Medium 6 (P2 × I3), Technical] Laptops and screens are damaged or lost in transit, leaving people without equipment on day one
    Owner: Marcus Bell. Transfer: Use the movers' declared-value cover for all IT equipment and back up every laptop before packing. Trigger: The movers can't show proof of cover by Dec 4. After the response: Low 2. Review by Dec 4.

Occurred (now an issue; track it in the issue log):
R7. The furniture supplier misses the Dec 11 delivery, so desks arrive after the move
    Supplier confirmed Jan 6 on Nov 3; now an issue, with 40 rental desks booked for Dec 19.

1 closed risk not shown.

Three things for this week's meeting: the fiber line is the only Critical risk and its trigger date is Nov 20; the fit-out risk was due for review on Nov 4; and the budget gap needs the sponsor's decision by Nov 13. The late furniture has already happened, so it's in the issue log now, with rental desks booked.

Risk register, RAID log or issue log?

• Risk register: risks only, in detail, reviewed at the risk review or steering meeting.
• RAID log: risks, assumptions, issues and dependencies side by side, short enough for the weekly status meeting. The RAID log template scores risks the same way, so the two can share the same numbers.
• Issue log: problems that are already happening, each with an owner, a next action and a date. Risks marked Occurred move there.

Keeping it useful

• Review it on a fixed day. Weekly or every two weeks, the day before the status report, so the report and the register agree.
• Watch the triggers, not just the scores. A trigger with a date turns “keep an eye on it” into a check someone actually does.
• Close risks. When the cause is gone, close the risk. A register where nothing closes stops being read.
• Report the top few. The project status report template has a risks section; paste the summary, or the top three.

The Excel and Word versions

• Excel template (.xlsx, 16 KB): a Summary sheet with live counts by rating and two 5×5 heat maps (now, and after the responses) that fill in from the Register sheet. The register has 50 numbered rows; score, rating and residual score calculate by themselves, category, strategy and status have drop-down lists, and an open risk with a review date before the Summary's “Status as of” date turns red. A third sheet has the scoring scales and the five strategies. Opens in Excel or Google Sheets.
• Word template (.docx, 38 KB): the register table, a blank heat map to write risk IDs into, the scoring key and the strategies on landscape pages, for teams that keep the register in a document or print it for a review. Opens in Word or Google Docs.

Both are blank apart from one gray example row.

Questions

Get the updates without chasing

A register is only as current as its owners' last answers. PingCadence collects those answers for the tasks in your plan: it emails each owner a short check-in on the cadence you set, from your own Outlook or Gmail after you approve the batch, and brings back “on track” or a new date measured against your baseline. See how it works.