The register is not finished when the risks are listed. Its value comes from regular review, updated evidence, and action before the risk becomes an issue.
Risk register at a glance
| Field | What it answers |
|---|---|
| Risk statement | What uncertain event may happen, and with what consequence? |
| Likelihood | How probable is it under the agreed scale? |
| Impact | How serious would the effect be? |
| Score | Which risks need attention first? |
| Response | Will the team avoid, mitigate, transfer, or accept it? |
| Mitigation | What reduces likelihood or impact before it occurs? |
| Contingency | What happens if it occurs? |
| Owner and review date | Who watches it, and when is it reassessed? |
Copyable Markdown risk register
# Risk register: [Project or organization]
**Owner:** [Name]
**Scoring:** Likelihood 1–5 × Impact 1–5
**Review cadence:** [Cadence]
| ID | Risk statement | Likelihood | Impact | Score | Response | Mitigation | Contingency | Owner | Review | Status |
|---|---|---:|---:|---:|---|---|---|---|---|---|
| R-001 | If [event], then [consequence] | 3 | 4 | 12 | Mitigate | [Action] | [Action if it happens] | [Name] | YYYY-MM-DD | Open |
The downloadable template also includes a scoring guide, priority-risk detail, early warning indicators, residual risk, escalation thresholds, and a closed-risk record.
How to write a risk statement
Use an if–then structure:
If the external approval arrives after 15 October, then printing will miss the contracted launch window.
This separates the uncertain event from its consequence. “Approval risk” is too vague to score or manage.
Add a cause or trigger in the detailed entry when it helps the owner monitor early warning signs.
How to score likelihood and impact
Define the scale before the team scores risks. A number without a shared definition creates false precision.
For a simple 1–5 scale:
| Score | Likelihood example | Impact example |
|---|---|---|
| 1 | Rare | Negligible effect |
| 2 | Unlikely | Minor, easily absorbed |
| 3 | Possible | Moderate change to time, cost, or quality |
| 4 | Likely | Major target or obligation affected |
| 5 | Almost certain | Severe or unacceptable consequence |
Multiply likelihood by impact only if that matches your organization’s method. Some organizations use qualitative bands or separate categories for safety, finance, reputation, and compliance.
Choose a risk response
- Avoid: change the plan so the risk no longer exists.
- Mitigate: reduce the likelihood or impact.
- Transfer or share: move part of the exposure through a contract, insurance, or partner arrangement.
- Accept: take no additional preventive action, with authorized awareness and a contingency where appropriate.
Acceptance should name the person with authority and a date or condition for reconsideration.
Mitigation versus contingency
Mitigation happens before the risk occurs. Contingency happens after the trigger.
For a supplier delay:
- mitigation: place the order earlier and review progress weekly;
- contingency: switch to an approved backup supplier if shipment misses the cut-off.
Combining them in one vague sentence makes it harder to know what should happen now.
Completed risk example
| ID | Risk statement | L | I | Score | Response | Mitigation | Contingency | Owner | Review | Status |
|---|---|---:|---:|---:|---|---|---|---|---|---|
| R-007 | If compliance approval arrives after 10 Oct, French launch will miss 15 Oct | 3 | 4 | 12 | Mitigate | Daily review from 5 Oct; supply evidence pack early | Split English and French launches | Ana | 2026-10-05 | Open |
The entry makes the uncertain event, consequence, preventive action, fallback, and next review visible.
Risk register versus issue log
A risk is uncertain. An issue has already happened.
When a risk occurs, update its outcome and create the appropriate issue or action record. Do not keep scoring it as though it might still happen.
Keep the register alive
Review risks at a fixed cadence and at major decision gates. Focus first on:
- new risks;
- high or rising exposure;
- overdue mitigations;
- early warning indicators;
- assumptions that have changed;
- accepted risks approaching their review date.
Close a risk only when the exposure no longer exists, the period has passed, or authorized acceptance has been recorded.
Common risk-register mistakes
- Writing topics instead of if–then risk statements.
- Scoring without a defined scale.
- Confusing an issue with a risk.
- Assigning the risk to a team rather than one accountable owner.
- Listing mitigation that does not change likelihood or impact.
- Omitting a contingency for critical exposure.
- Never recording residual risk after controls.
- Building the register at kickoff and never reviewing it.
Risk register FAQ
What columns should a risk register include?
At minimum: ID, risk statement, likelihood, impact, priority, response, mitigation, owner, review date, and status. Add contingency and residual risk for material exposure.
How often should a risk register be reviewed?
Use a cadence that matches the pace and impact of the work. Review it at least at major milestones and whenever new evidence changes likelihood or impact.
Who owns a risk?
One named person accountable for monitoring exposure and ensuring the agreed response progresses. Other people may own individual mitigation actions.
What is residual risk?
Residual risk is the exposure remaining after existing or planned controls are considered.
Can Markdown calculate a risk score automatically?
Plain Markdown tables do not calculate values. Enter the score manually or use a spreadsheet or risk system when formulas, sorting, audit trails, or large registers are required.
Related templates
- Project plan template
- Project kickoff meeting template
- Decision log template
- Weekly status report template
- All Markdown templates
Sources
This template is general operational guidance, not compliance, legal, safety, or financial advice.