Risk Register Template

---
title: "Risk Register Template"
methodology: "universal"
complexity: "advanced"
owner: "mirichard"
updated: "2026-09-19"
primary_principles: ["risk-optimization"]
secondary_principles: ["evidence-based-decisions", "stewardship"]
principle_rationale: "Records threats and opportunities with assessed exposure, triggers and accountable responses for continued risk review."
---

# Risk Register Template

## When to Use

- When uncertain threats or opportunities need assessment and an accountable response.
- When risk owners must track triggers, mitigation, contingency, and residual exposure.

## When NOT to Use

- For recording only events that have already occurred; use the issue log.
- Do not use a completed template or example configuration as proof of fitness for the actual environment. See [Template as substitute for judgment](../../../../../docs/principles/anti-patterns.md#template-judgment).

## Pairs Well With

- [Risk Management Plan Template](../../../../../domains/measurement/project-lifecycle/02-planning/risk-management/risk-management-plan-template.md).
- [Issue Log Template](../../../../../domains/delivery/templates/traditional/Traditional/Templates/issue_log_template.md).

Selection context: Uncertainty domain; universal methodology; advanced complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../../../meta/architecture-research/800-801-context-assessment-model.md).

## Event-driven governance handoff

Use the [event catalog and response process](../../../../../docs/governance/event-driven-controls.md) for exceptions between scheduled reviews; retain the approved reporting cadence and mandatory gates. Record occurrence/event ID, detected time, source/as-of date, condition and baseline version, owner/backup/authority, acknowledgement and response-plan deadlines, next update, linked records and closure evidence.

Link a materialized high/critical risk or contingency condition to E03 and an issue record. Record verified response effectiveness and residual exposure here; event closure alone does not lower risk ratings or governance controls.

Use the [alert, escalation and closure notifications](../../../../../docs/governance/event-notifications.md). Missed response deadlines escalate to the backup/next authority; notification or silence never constitutes approval.


## Governance scaling recommendations

Use the [risk-based governance framework](../../../../../docs/governance/risk-based-scaling.md) to assess **technical, schedule, budget, organizational and compliance** exposure. Record each as low, medium, high or unknown, with risk IDs, dated evidence, current controls, an owner and next review.

- **Low:** combine evidence where the effective tier permits; retain weekly updates and required sponsor/acceptance gates.
- **Medium:** add dependency/contingency and change-impact evidence, weekly risk review and at least fortnightly sponsor review.
- **High or unknown:** use Rigorous controls, formal risk/control reporting and assurance at affected gates; assign evidence-gap owners and dates for unknowns.

Use the highest exposure, retaining higher context, size, team and policy floors; confirmed regulatory context remains Rigorous. Map local assessment scores to the approved exposure definitions with a rationale; do not average unlike scores. Reduce controls only after verified response effectiveness and sponsor/control-owner approval. Mandatory controls remain in force.

**Scaling decision:** [Five ratings and evidence; assessed/effective risk; tier and policy floor; affected artifacts/cadence; approval and effective date; next review].


## Purpose/Overview
This risk register template provides a systematic approach to identifying, assessing, and managing project risks throughout the project lifecycle. It serves as a central repository for all project risks, enabling proactive risk management and supporting informed decision-making. The template follows traditional project management best practices for comprehensive risk management.

## Usage Instructions
1. **Risk Identification**: Regularly brainstorm and identify potential risks with the team
2. **Assessment**: Evaluate each risk using the probability and impact scales provided
3. **Risk Scoring**: Calculate risk scores to prioritize management attention
4. **Mitigation Planning**: Develop appropriate response strategies for each significant risk
5. **Ownership Assignment**: Assign specific individuals to monitor and manage each risk
6. **Regular Reviews**: Update the register weekly during project meetings
7. **Status Tracking**: Monitor risk status and effectiveness of mitigation strategies
8. **Communication**: Share key risks with stakeholders through status reports

## Project Information
- **Project Name**: [Project Name]
- **Date**: [Date]
- **Risk Manager**: [Name]

## Risk Register

| ID | Risk Description | Category | Probability | Impact | Risk Score | Mitigation Strategy | Owner | Status |
|----|------------------|----------|-------------|--------|------------|-------------------|-------|--------|
| R001 | [Risk description] | [Technical/Business/External] | [H/M/L] | [H/M/L] | [1–9; P × I] | [Strategy] | [Owner] | [Open/Closed] |

## Risk Categories
- **Technical Risks**: Technology, integration, performance
- **Business Risks**: Requirements, stakeholder, funding
- **External Risks**: Regulatory, market, vendor
- **Project Risks**: Schedule, resource, scope

## Risk Assessment Scale
### Probability
Define an assessment horizon and calibrate these illustrative bands with the team:
- **High (H = 3)**: greater than 70% through 100%
- **Medium (M = 2)**: greater than 30% through 70%
- **Low (L = 1)**: 0% through 30%

Record the evidence or uncertainty behind each estimate. Score = probability rank × impact rank (1–9); this is ordinal prioritization, not a monetary loss estimate. Agree escalation thresholds and record override reasons.

### Impact
- **High (H = 3)**: Major impact to scope, schedule, budget
- **Medium (M = 2)**: Moderate impact, manageable
- **Low (L = 1)**: Minor impact, minimal effect

---
*Traditional-aligned risk management template*