Project Management guide · Risk, quality and control
Risk Register: Template, Columns and Example Entries
A risk register is the document or tool where a project records its identified risks, together with their analysis, owners, responses and status. It is the working record of the risk management process.
Key takeaways
- A risk register records each risk with its score, owner, response and status.
- Use clear columns and agreed scoring definitions.
- Review it regularly and move occurred risks to the issue log.
- Keep entries specific and actionable.
What a risk register is for
- Keeps all known risks in one place, visible to the team and sponsor.
- Records who owns each risk and what is being done about it.
- Shows priority, so attention goes to the risks that matter most.
- Provides history for audits, reviews and lessons learned.
Risk register template: columns
| Column | What to record |
|---|---|
| ID | Unique reference, e.g. R-014 |
| Date raised | When the risk was first logged |
| Category | Schedule, cost, technical, resource, external, etc. |
| Risk description | Cause, event and effect |
| Threat or opportunity | Direction of the effect |
| Probability (1-5) | Likelihood using agreed definitions |
| Impact (1-5) | Severity using agreed definitions |
| Score | Probability x impact |
| Owner | Named person responsible for monitoring and response |
| Response strategy | Avoid, mitigate, transfer, accept, escalate (or exploit, enhance, share) |
| Response actions | Specific actions, with dates |
| Trigger | Warning sign that the risk is occurring |
| Contingency plan | What happens if it occurs; see contingency plan |
| Residual score | Expected score after responses; see residual risk |
| Status | Open, monitoring, closed, occurred |
| Last reviewed | Date of most recent review |
Example entries
| ID | Description | P | I | Score | Owner | Response | Status |
|---|---|---|---|---|---|---|---|
| R-001 | Because the API vendor is changing its pricing model, licence costs may rise, pushing the budget over by 8%. | 3 | 3 | 9 | Procurement lead | Mitigate: negotiate a fixed price for 24 months | Open |
| R-002 | Because only one engineer knows the legacy system, their absence could stall integration for weeks. | 2 | 5 | 10 | Delivery manager | Mitigate: pair a second engineer and document interfaces | Open |
| R-003 | Because the regulator is consulting on new rules, reporting requirements may change mid-project. | 2 | 4 | 8 | Compliance lead | Accept: monitor the consultation; hold contingency | Monitoring |
| R-004 | Because the new test framework runs in parallel, regression testing could take half the planned time. | 3 | 3 | 9 | QA lead | Enhance: pilot it in sprint 3 | Open |
How to create and maintain a risk register
- Agree the scales, columns and review frequency during planning.
- Run a risk identification workshop and log every risk.
- Score each risk and sort by score.
- Assign an owner and agree responses for high-scoring risks.
- Review the register at every project meeting, focusing on the top risks.
- Update scores, close risks that have passed and add new ones.
- Move risks that occur into the issue log.
- Summarise the top risks in the project status report.
Risk register vs other logs
| Risk register | Issue log | RAID log | |
|---|---|---|---|
| Contents | Uncertain future events | Problems happening now | Risks, assumptions, issues and dependencies |
| Main question | What might happen? | What is wrong now? | What do we need to keep track of? |
| Typical size | Detailed | Detailed | Often summary level |
Tips
- Keep the register short enough to be read. Thirty well-written risks beat three hundred vague ones.
- Use a shared tool so owners can update their own entries.
- Colour-code scores but do not rely on colour alone; include the number.
- Archive closed risks rather than deleting them.
Free templates for this topic
Frequently asked questions
What is a risk register?
A log of identified project risks with their scores, owners, responses and status.
What columns should a risk register have?
At minimum: ID, description, probability, impact, score, owner, response and status. Many teams add trigger, contingency plan and residual score.
Who owns the risk register?
The project manager usually maintains it, while individual risk owners keep their entries up to date.
How often should the risk register be updated?
At least at every regular project meeting, and whenever new information changes a risk.
Is a risk register the same as a risk log?
Yes. The terms are used interchangeably.
What is the difference between a risk register and a RAID log?
A risk register covers only risks in detail; a RAID log tracks risks, assumptions, issues and dependencies together.
Can I use Excel for a risk register?
Yes. A spreadsheet works well for most projects. Larger organisations may use a shared tool with workflow and reporting.
Should opportunities go in the risk register?
Yes. Recording opportunities alongside threats helps the team pursue them deliberately.
When should a risk be closed in the risk register?
When the event can no longer happen, for example because the relevant phase is complete, or when it has occurred and moved to the issue log.
What is a risk owner in a risk register?
The named person accountable for monitoring a risk and making sure its response is carried out.
Does PRINCE2 use a risk register?
Yes. PRINCE2 uses a risk register as one of its management products.