Use this template to manage risk before it becomes an issue
The risk register provides one controlled place to track risk exposure, mitigation actions, ownership, review dates, and escalation status.
Its value depends on regular review, clear ownership, and timely action.
Template fields
Risk ID
Unique reference number.
Risk Title
Short name summarizing the risk.
Risk Description
Clear description of the uncertain event or condition.
Cause
The reason the risk may occur.
Impact
The effect on the project if the risk occurs.
Impact Area
Scope, schedule, cost, quality, safety, contract, stakeholders, resources, benefits, or reputation.
Probability
Likelihood that the risk will occur.
Impact Rating
Severity of the effect if the risk occurs.
Risk Score
Combined view of probability and impact.
Risk Level
Low, medium, high, or critical.
Risk Owner
Person accountable for monitoring the risk and ensuring response actions are completed.
Response Strategy
Avoid, mitigate, transfer, accept, or escalate.
Mitigation Actions
Actions agreed to reduce probability or impact.
Action Owner
Person responsible for completing the mitigation action.
Due Date
Target date for completing the action.
Status
Open, in progress, monitoring, escalated, or closed.
Escalation Required
Yes or no, with escalation level if needed.
Review Date
Next date when the risk should be reviewed.
Recommended risk review process
- Identify new risks.
- Validate existing risks.
- Update probability and impact.
- Review mitigation actions.
- Confirm owners and due dates.
- Escalate risks outside project tolerance.
- Close risks that are no longer relevant.
- Report major risks through governance forums.
Good risk statement format
Example: Because design approvals are delayed, there is a risk that procurement will start late, which may result in schedule delay and increased delivery cost.
Common mistakes
- Listing issues as risks
- Writing vague risk descriptions
- Not assigning risk owners
- Using the risk register only for reporting
- Not escalating high risks
- Closing risks without evidence
- Ignoring schedule, cost, and contractual impacts