Risk register template: the columns that matter, with an example

What a risk register is for

A risk register is the working list of uncertain events that could affect your objectives, for better or worse. It is not a compliance document to fill once. Its job is to make sure every significant risk has someone watching it and a planned action, and to give the team a shared basis for reserves and decisions.

Keep issues out of it. A risk might happen; an issue has already happened. When a risk occurs, close it in the register and open an issue. Our project risk management guide covers the full process around the register: identify, assess, respond, monitor.

The risk register template: columns

Column	What to write	Why it matters
ID	R-01, O-01	Stable reference in meetings and reports
Type	Threat or opportunity	Opportunities need owners too
Risk statement	"If [cause], then [event], leading to [effect]"	Forces a specific, testable risk
Category	Technical, supply, people, external, commercial	Helps spot clusters
Owner	One named person	Shared ownership means no ownership
Probability (1 to 5)	Score from the scale below, and the % if known	Basis for priority
Impact (1 to 5)	Score for the worst-affected objective	Basis for priority
Score	Probability × impact	Ranks risks for attention
Cost exposure and EMV	Cost impact; EMV = P × cost	Sizes contingency
Schedule exposure	Days of delay; expected days = P × days	Sizes schedule contingency
Response	Strategy and concrete actions	What will actually change
Due date	When the action must be done	Makes the response trackable
Status	Open, in progress, closed, occurred	Keeps the list current

Optional columns worth adding on larger projects: trigger (the early warning sign), residual score after the response, fallback plan, and the activity in the schedule the risk affects.

Scoring scales to agree first

Scores are meaningless unless everyone uses the same scale. Write the scale at the top of the register. An example for a mid-sized project:

Score	Probability	Cost impact
1	Under 10%	Under $5,000
2	10% to 30%	$5,000 to $10,000
3	30% to 50%	$10,000 to $25,000
4	50% to 70%	$25,000 to $50,000
5	Over 70%	Over $50,000

Add schedule, quality or safety columns to the impact scale if they matter on your project, and score impact on whichever objective is hit hardest. Adjust the money bands to your project's size: $50,000 is severe on a small project and trivial on a large one.

Filled example

Four entries from an office building services project, scored with the scales above:

ID	Risk statement	Owner	P	I	Score	EMV	Exp. days	Response, due
R-01	If the switchgear factory slot slips, delivery is late, delaying energisation (40%, $30,000, 15 days)	Procurement lead	3	4	12	$12,000	6	Mitigate: weekly factory check, pay for expediting at first slip; 15 Nov
R-02	If the controls engineer leaves, commissioning stalls (20%, $15,000, 10 days)	Project manager	2	3	6	$3,000	2	Mitigate: second engineer shadows; 30 Oct
R-03	If the permit authority requests changes, approval is late, delaying works (60%, $12,000, 20 days)	Design manager	4	3	12	$7,200	12	Mitigate: pre-submission meeting; 20 Oct
O-01	If we combine cable orders with a sister project, we get a bulk discount (45%, $8,000 saving)	Commercial manager	3	2	6	−$3,600	0	Enhance: align order dates; 10 Nov

The arithmetic: R-01 EMV is 0.40 × $30,000 = $12,000 and expected delay 0.40 × 15 = 6 days. R-02 is 0.20 × $15,000 = $3,000 and 2 days. R-03 is 0.60 × $12,000 = $7,200 and 0.60 × 20 = 12 days. O-01 is 0.45 × $8,000 = $3,600 saving. Threats total $22,200; net of the opportunity, $18,600 is a starting point for contingency.

Note that R-01 and R-03 share a score of 12, yet R-01 carries more money and R-03 more expected delay. Scores rank attention; EMV and expected days size reserves.

How to run a risk review with the register

The register earns its keep in a short, regular review. A workable agenda for 20 to 30 minutes:

1. Top risks first. Sort by score, then by EMV, and walk the top five to ten. Each owner reports in one or two sentences: has anything changed, is the response on track?
2. Overdue actions. Filter responses past their due date. Agree a new date or a new action, not a vague promise.
3. New risks. Ask what has changed since last time: new suppliers, scope, people, approvals. Write each new risk as a full statement before scoring it.
4. Close and convert. Close risks that can no longer happen. Move risks that have occurred to the issue log.
5. Re-total. Update the EMV total and compare it with the remaining contingency.

Common mistakes

• Vague risks. "Supply chain" is a category, not a risk. Write the cause, event and effect.
• Listing issues and certainties. If it is certain, put it in the plan or estimate, not the register.
• No owner or a team as owner. Name one person who will act and report.
• Responses without dates. "Monitor" with no date is not a response.
• Scoring once and never again. Review the top risks at every progress meeting and the full register at least monthly.
• Too many columns. If the team will not maintain a column, drop it. A short register kept current beats a long one kept for audit.

How to do this in Critova

Critova's risk register holds these columns as fields: threats and opportunities, owners, responses, due dates, cost and schedule exposure and EMV. You can work the same list three ways: as a list, as a board by status, or on a clickable 5×5 matrix that filters to the risks in a cell. Risk events can also be attached to schedule activities for Monte Carlo analysis, and the whole register exports to Excel or CSV for reports. To check a single score or EMV before you enter it, try the free risk score and EMV calculator.