What is a Risk Register?

If you’re running a project or programme of any size then a Risk Register is an essential document. Find out more about what a Risk Register is below, or download our free Risk Register template here.

What is a Risk Register?

A Risk Register is a document that keeps track of all the potential problems and risks that you anticipate may arise during a project. It’s a living document that is produced at the start of a project and updated on a regular basis. The Risk Register, along with the Budget Sheet and Project Plan form the triumvirate of documents that are maintained and updated throughout any project, big or small.

What should I record in my Risk Register?

The Risk Register will normally take the form of an Excel or Google Sheet and be a list of individually assessed risks.

Columns in the Risk Register will normally include:

  1. Title of Risk
  2. Risk description – an outline of the risk, it’s causes and the potential impact it may have.
  3. Impact score – If the risk becomes reality how severe will the impact on the project be? Usually expressed as a number from 1 to 5, with 1 a very high risk, 5 very low.
  4. Probability score – chances of the risk materialising. Again, usually expressed as a number from 1 to 5, with 1 a very high risk, 5 very low.
  5. Overall risk score – this is usually calculated by multiplying the Impact score with the Probability score.  A low final score meaning a higher risk.
  6. Mitigation – what, if any, actions can to be undertaken to mitigate (or lower) the chances of the risk happening.
  7. Contingency – What alternative actions would be taken if the risk materialized.
  8. Risk Owner –  one person who has the best understanding or responsibility for the risk.
  9. Risk author – who raised the risk.
  10. Impact date – when is the risk likely to happen?
  11. Risk status – active or closed.

Reviewing and updating the Risk Register

Your Risk Register should be updated regularly and presented for review at project board meetings to key project stakeholders. In advance of meetings the individual risk owners should be contacted and asked to provide updates to the individual risks next to their names.

At the end of a project the Risk Register can be officially closed, or if individual risks still remain then these can be transferred to the departmental or company-wide risk register to ensure they remain on somebody’s radar going forward.


Please enter your comment!
Please enter your name here