Risk Register Template

What a risk register is

A risk register is a working document that lists the risks a project or organisation faces, together with what is known about each one. It turns scattered worries into a structured record that can be reviewed, assigned and tracked over time. This template captures a header layer that identifies the register itself — the date conducted on, who prepared it, the location, the company, the register author, the date of creation and the project name — and then a repeating entry for each risk. Every risk carries a reference ID and a description, an owner, a category, a likelihood rating, an impact analysis, a mitigation response, a priority, a status, notes, an attached evidence field and a closing date.

Why keeping a register matters

Risks that are not written down are easy to forget, easy to dispute and hard to manage. A register gives you visibility over the threats and opportunities that affect a project, and it makes the management of those risks systematic rather than reactive. Because each entry names an owner and a status, you can see what is still open, what is being worked on and what has been closed. Because each entry carries a likelihood rating, an impact analysis and a priority, you can tell which risks deserve attention first. The 28 items in this checklist and its four sections — Risk Register, Risk Details, Risk, and Review and Recommendations — are built to hold that information in one place.

What a good register covers

A useful register is complete, current and honest. This template asks you to cover: - **Identification** — a risk reference ID, the project name, and the register author, date of creation, company and location. - **Description** — a written description of the risk so that anyone reading the register understands what is at stake. - **Ownership and category** — a named risk owner and a category chosen from technical, financial, commercial, operational, legal and regulatory, health, safety and environment, human resources, schedule, external and market, or other. - **Assessment** — a likelihood rating of unlikely, possible, likely or very likely, and an impact analysis on a scale from very low through low, medium and high to very high. - **Response** — a mitigation response describing how the risk will be handled. - **Priority and status** — priority set as low, medium, high or critical, and status set as open, in progress or closed. - **Evidence and notes** — attached files, notes and a closing date. - **Currency** — a last updated date. - **Governance** — an overall assessment of the register, recommendations, assigned follow-up actions, a completed review and a signature.

How to run the process

Work through the register in this order. 1. **Set up the header.** Record the date conducted on, prepared by, location, company, register author, date of creation and project name. 2. **Identify the risks.** Give each one a reference ID and describe it plainly. Avoid vague entries; a description that a new reader cannot act on is not doing its job. 3. **Assign ownership and category.** Name the risk owner and choose the category that best fits. 4. **Assess likelihood and impact.** Rate likelihood as unlikely, possible, likely or very likely. Record the impact analysis from very low to very high. 5. **Set priority and status.** Use low, medium, high or critical for priority, and open, in progress or closed for status. 6. **Define the mitigation response.** Write what will be done about the risk, and attach supporting evidence such as photos or files. 7. **Record notes and, where relevant, a closing date.** Update the last updated date whenever the register changes. 8. **Review and recommend.** Complete the Review and Recommendations section with an overall assessment, recommendations, assigned follow-up actions, a review completion mark and a signature.

Where this approach fits

Risk registers are used across sectors and alongside formal management frameworks. The template stays neutral about which framework applies to you; it simply provides the fields — description, owner, category, likelihood, impact, response, priority, status, evidence, dates and sign-off — that most registers need. Where a specific regulation or standard governs your work, apply it directly. The register is a record-keeping and tracking tool, and it does not replace the legal or technical requirements of the regimes you operate under.

Frequently Asked Questions

The register captures a company, location, project name, register author, date of creation, the person and date it was conducted on, and a risk reference ID for each entry, so the document stays traceable to a project and a point in time.

Each risk is documented with a description, an owner, a category such as technical, financial, commercial, operational, legal and regulatory, health, safety and environment, human resources, schedule, external and market, or other, a likelihood rating, an impact analysis, a mitigation response, a priority, a status, notes and a closing date. Evidence files can be attached to the entry.

Likelihood is rated as unlikely, possible, likely or very likely. Impact and priority are rated from very low through low, medium and high to very high, and priority can also be set to critical. Status is open, in progress or closed.

Yes. The register supports a closing date per risk and a status of open, in progress or closed, plus a last updated timestamp, so you can see which risks remain active and when each one was resolved.

The final section is for an overall assessment of the risk register, recommendations, assigned follow-up actions, a completed review and a signature, which gives you a record of accountability and traceability across the register.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile