Risk Management Assessment Template

---
title: "Risk Management Assessment Template"
methodology: "universal"
complexity: "starter"
process_group: "planning"
industry: "universal"
role: "stakeholder"
tags: ["planning", "risk-management", "stakeholder-management", "communication", "planning"]
version: "1.0.0"
owner: "mirichard"
updated: "2026-09-19"
estimated_completion_time: "15-30 minutes"
primary_principles: ["continuous-learning", "risk-optimization"]
secondary_principles: ["evidence-based-decisions"]
principle_rationale: "Evaluates risk identification, ownership, response and monitoring practices to target evidence-backed improvements in risk management."
---


# Risk Management Assessment Template

## When to Use

- When assessing whether risk-management practices work across a project or organization.
- When evidence can support improvement in identification, ownership, response, and monitoring.

## When NOT to Use

- To confuse having a risk register with effective risk management.
- Do not treat completed metadata or a filled checklist as evidence that the underlying work is done. See [Metadata theater](../../../docs/principles/anti-patterns.md#metadata-theater).

## Pairs Well With

- [Risk Management Plan Template](../../../domains/measurement/project-lifecycle/02-planning/risk-management/risk-management-plan-template.md).
- [Remediation Action Plan Template](../../../domains/measurement/project-assessment-suite/remediation-action-plan-template.md).

Selection context: Measurement domain; universal methodology; starter complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../meta/architecture-research/800-801-context-assessment-model.md).

## Governance scaling recommendations

Use the [risk-based governance framework](../../../docs/governance/risk-based-scaling.md) to assess **technical, schedule, budget, organizational and compliance** exposure. Record each as low, medium, high or unknown, with risk IDs, dated evidence, current controls, an owner and next review.

- **Low:** combine evidence where the effective tier permits; retain weekly updates and required sponsor/acceptance gates.
- **Medium:** add dependency/contingency and change-impact evidence, weekly risk review and at least fortnightly sponsor review.
- **High or unknown:** use Rigorous controls, formal risk/control reporting and assurance at affected gates; assign evidence-gap owners and dates for unknowns.

Use the highest exposure, retaining higher context, size, team and policy floors; confirmed regulatory context remains Rigorous. Map local assessment scores to the approved exposure definitions with a rationale; do not average unlike scores. Reduce controls only after verified response effectiveness and sponsor/control-owner approval. Mandatory controls remain in force.

**Scaling decision:** [Five ratings and evidence; assessed/effective risk; tier and policy floor; affected artifacts/cadence; approval and effective date; next review].

This template evaluates process effectiveness. Its maturity ratings are not project exposure ratings: obtain the five-dimension assessment from risk owners before recommending governance changes.


## Executive Summary
This template provides a comprehensive framework for assessing risk management effectiveness across projects and organizations.

## Assessment Overview
**Project/Organization:** [Name being assessed]
**Assessment Date:** [Date]
**Assessor:** [Name and credentials]
**Assessment Scope:** [Areas covered]

## Risk Management Framework Assessment

### 1. Risk Identification Process
**Evaluation Areas:**
- [ ] Risk identification methodology completeness
- [ ] Stakeholder involvement in risk identification
- [ ] Risk category coverage (technical, business, external)
- [ ] Documentation and tracking processes

**Maturity Level:** [1-5 scale]
**Current State:** [Description]
**Recommendations:** [Improvement actions]

### 2. Risk Analysis and Prioritization
**Assessment Criteria:**
- [ ] Risk probability assessment accuracy
- [ ] Risk impact evaluation completeness
- [ ] Risk scoring methodology effectiveness
- [ ] Prioritization process consistency

**Scoring:** [1-5 for each area]
**Strengths:** [Effective practices]
**Gaps:** [Areas needing improvement]

### 3. Risk Response Planning
**Response Strategy Evaluation:**
- [ ] Risk mitigation strategy appropriateness
- [ ] Risk transfer mechanisms effectiveness
- [ ] Risk acceptance criteria clarity
- [ ] Contingency planning completeness

### 4. Risk Monitoring and Control
**Monitoring Effectiveness:**
- [ ] Risk tracking process maturity
- [ ] Risk indicator monitoring
- [ ] Escalation procedures clarity
- [ ] Reporting and communication effectiveness

## Assessment method and evidence

Tailor the criteria to the project before scoring. This is a lightweight internal assessment, not a certification or formal appraisal. Mark inapplicable criteria N/A with a rationale; distinguish missing evidence from poor performance.

Use a locally agreed scale: 1 = absent/ad hoc; 2 = inconsistently applied; 3 = defined and routinely applied; 4 = measured and controlled; 5 = improved using measured outcomes. Record evidence for each rating. Do not average scores with N/A or unassessed items.

| Criterion | Rating / N/A / not assessed | Dated evidence and rationale | Gap / impact | Action / owner / due date | Completion evidence |
|---|---|---|---|---|---|
| [Criterion] | [Rating] | [Source and observation] | [Gap] | [Action / name / date] | [Observable acceptance condition] |

- **Assessment limitations:** [Sampling, unavailable information, assessor familiarity]
- **Stakeholder review:** [Reviewer / date / disputed findings]
- **Follow-up review:** [Date and accountable owner]

Related Resources:
- [Risk Management Plan](../project-lifecycle/02-planning/risk-management/)
- [Governance Assessment](./governance-assessment-template.md)