Risk register template
A risk register lists the things that could go wrong for your company, how likely and how damaging each one is, who owns it, and what you're doing about it. This free Excel template scores each risk automatically on a 5×5 scale, colour-codes it, and plots every risk on a heat map.
Running a company of 30 to 200 people? Documents like this are now worth money.
The download has four sheets: the register (with drop-downs and formulas for 100 risks), a scoring guide, the heat map, and ten example risks for a mid-sized company that you can copy or adapt.
What's in the template
Each risk gets a likelihood and an impact score from 1 to 5. The template multiplies them (1 to 25) and rates the result: 15 or more is high, 8 to 14 medium, 7 or less low. It does the same for the residual risk once your controls are in place. Six of the ten example risks:
| Risk | Owner | Likelihood | Impact | Score | Rating | Existing controls |
|---|---|---|---|---|---|---|
| Our largest customer moves to a competitor | Sales director | 3 | 4 | 12 | Medium | Quarterly account reviews; renewals tracked six months ahead |
| Ransomware locks the file server after a phishing email | IT manager | 3 | 5 | 15 | High | Email filtering; daily backups |
| Only one person can run payroll and month-end | Finance director | 3 | 4 | 12 | Medium | Partial notes |
| Cash runs short in a quarter with VAT and tax due | Finance director | 3 | 4 | 12 | Medium | 13-week cash flow forecast; credit control process |
| A fake email changes a supplier's bank details | Finance manager | 3 | 3 | 9 | Medium | Call-back check on any bank detail change |
| Our sole supplier of a key component fails | Operations manager | 2 | 4 | 8 | Medium | Annual supplier credit check |
Other columns: category, cause, consequence, further action, action owner, due date, status, residual scores and date last reviewed.
How to build a risk register
- Collect risks from each team lead. Thirty minutes each is usually enough to cover the big ones.
- Write each risk as cause, event and consequence. "Cyber" is a topic. "A member of staff opens a phishing email, ransomware locks our file server, and we can't invoice for a week" is a risk you can do something about.
- Score it before and after controls. The first score shows how serious it could be; the residual score shows how exposed you are today.
- Give every risk one owner, a named person rather than a team.
- Agree actions for anything rated high, with an owner and a date.
- Review it regularly (monthly or quarterly), and report the top risks to the board in your board report.
Scoring that people agree on
Scores only mean something if everyone uses the same scale. The template's scoring guide describes each level of likelihood (from rare to almost certain) and impact (from negligible to severe). Before your first review, adjust the impact descriptions to your company's size, for example the amount of lost profit you'd call "major", and then keep them fixed so scores stay comparable over time.
Common mistakes
- Vague risks like "market conditions" that nobody can act on.
- No owner, or "the board" as owner.
- Scoring without agreed scales, so one manager's 4 is another's 2.
- Too many risks. Keep the live register to the ones that matter; archive the rest.
- Written once and never reviewed. A register is only useful if its scores move.
Frequently asked questions
What's the difference between a risk register and a risk assessment?
A risk register tracks the business risks a company faces. A health and safety risk assessment is narrower: in the UK, employers have a specific legal duty to assess workplace health and safety risks, which the HSE explains (see sources).
What's the difference between inherent and residual risk?
Inherent risk is the score before any controls. Residual risk is what's left once your controls are working. Decisions should be based on the residual score, and the controls should be checked to make sure they work.
What is risk appetite?
How much risk the board is willing to accept in pursuit of its goals. Setting it tells managers which residual scores are acceptable and which need action. HM Treasury's Orange Book covers it in more depth.