Free template
A free risk register template with a five by five scoring guide, escalation thresholds and worked examples, for projects and programmes of any size.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
A note before you start
A risk register earns its keep when it changes what people do this week. Most fail because every risk is scored amber, owned by the project manager and reviewed once a month. Keep the list short, give each risk an owner who can act on it, and spend the review on the actions rather than the colours.
Christopher Fagan, Managing Partner, PEF Consulting Partners
Write each risk as cause, event and effect: because of X, Y may happen, which would cause Z. Score likelihood and impact from 1 to 5 and multiply them for a score out of 25. Agree in advance which scores go to the steering committee. Give every risk one owner and a dated action, and close risks that have passed. When a risk happens, move it to your issues log the same day.
[Organisation name] | Version 0.1 | [Date] | Owner: [Name, role]
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Rare, under 10% | Negligible: no effect on time, cost or quality |
| 2 | Unlikely, 10% to 30% | Minor: absorbed within tolerance |
| 3 | Possible, 30% to 50% | Moderate: uses contingency |
| 4 | Likely, 50% to 80% | Major: breaches a tolerance and needs a decision |
| 5 | Almost certain, over 80% | Severe: threatens the business case or go live |
| Score (likelihood times impact) | Rating | Who reviews it |
|---|---|---|
| 1 to 6 | Low | Workstream lead, monthly |
| 8 to 12 | Medium | Project manager, fortnightly |
| 15 to 25 | High | Steering committee, every meeting |
One risk per row, written as cause, event and effect.
| ID | Date raised | Risk | Category | Owner | Likelihood (1 to 5) | Impact (1 to 5) | Score | Response | Actions and due dates | Status | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Risk | Likelihood | Impact | Score | Response and action |
|---|---|---|---|---|
| Because key users are also running month end, they may not finish testing on time, which would delay go live | 4 | 4 | 16 | Reduce: move the test window away from month end and backfill two roles |
| Because the legacy data holds duplicate customer records, the migration may fail reconciliation, which would block cutover | 3 | 5 | 15 | Reduce: run two trial migrations with reconciliation sign off before the cutover rehearsal |
| Because the supplier relies on one solution architect, an absence could stall design decisions, which would cost two weeks | 2 | 3 | 6 | Accept and monitor: ask the supplier to name a deputy at the next contract review |
Template by PEF Consulting Partners, pefconsultingpartners.co.uk. Free to use and adapt.
Related reading: the RAID log template, the RACI matrix template, the free project health check, programme assurance and gateway reviews.
A risk register is a list of the things that might happen and would affect a project, each with an owner, a score for likelihood and impact, and the actions that will reduce it. It is a management tool, reviewed regularly, not a record kept for audit.
A risk register covers risks only. A RAID log puts risks, assumptions, issues and dependencies in one place, which suits most programmes better because the four interact.
High risks at every steering committee, the rest fortnightly or monthly depending on the pace of the project. The register should change between reviews; if it never does, nobody is using it.
Avoid, reduce, transfer and accept. Some frameworks add exploit and enhance for opportunities, which are risks with an upside.
If your register has fifty open risks and none closed this quarter, it is a record of worry rather than a management tool, and worth a fresh pair of eyes.