Risk register template

A risk register template is the reusable document that records each risk, its owner, its score and the date it was last reviewed. Fill it in and you have a register. The template is the fixed shape; the register is the living content.

The template does one job. A risk-based approach decides how much control each risk earns. A risk transfer strategy moves exposure to another party. This page is about the record both of those depend on.

It is not enterprise risk management either. That is the company wide programme, with its committee, its appetite statement and its board pack.

The template is only the artefact that programme writes into — and a five person team can run one perfectly well without any of the rest of it.

Key takeaways

• Four columns carry the weight: the risk written as a cause and an effect, the owner, the score, and the review date.
• One named person owns each row, because a department label means nobody owns it.
• Score likelihood and impact on a single shared scale, or rows from different teams cannot be compared.
• An untouched register is a document rather than a control — so put the next review date in the template itself.

How it works

A risk register template fixes the columns so every team records the same things. Each row names one risk, says who owns it, scores likelihood and impact, states the chosen treatment, and carries the date somebody looks at it again.

Write each risk as a sentence with a cause and a consequence. “Cyber” is a topic. “A phishing compromise of the finance mailbox leads to a fraudulent payment” is something a person can own, score and test.

Scores need a scale with written anchors. If “high impact” is not defined as a money figure, a delay or a regulatory consequence, two teams will score the same event three points apart.

Public sector practice pushed registers into the open. A 2016 report from the Government Accountability Office (GAO) records that a July 2016 OMB circular required agencies to implement enterprise risk management against their strategic objectives.

Hazard planning uses the same sequence. The Federal Emergency Management Agency points practitioners at resources built to identify, assess and prioritize possible risks before anybody chooses what to do about them.

Version control matters more than people expect. A register circulated as an email attachment forks within a month — so keep one copy in one place and let the review date decide who edits it.

The template is not a substitute for thinking about business risk in the round. It is where that thinking gets written down in a form two teams can compare.

Two other templates feed it. A pre mortem template generates candidate risks by asking a team to imagine the project has already failed, and a gap analysis template surfaces control weaknesses that belong in the register as rows.

On projects the register usually starts inside the project charter template, under the risks and assumptions field that records what the plan is betting on.

Examples

Registers look identical on paper and behave very differently in practice. What separates a working one from a spreadsheet is whether the owner column names a person and whether the review date has ever moved.

Offshore transition. A buyer moving a 200 seat contact centre offshore opens a register at contract signature with attrition, telecoms failure and data transfer approval as its first three rows, each owned by a named lead.

Construction and infrastructure. Programme registers run to hundreds of rows, scored on cost and schedule impact, and reviewed monthly at the project board because a single ground condition row can move a completion date by a quarter.

Financial services. A compliance register carries regulatory obligations as rows with evidence attached, so the same document answers both the internal risk question and the supervisor’s request for proof.

Charities and small teams. A one page register with six honest rows and a named trustee against each beats a forty row spreadsheet nobody has reopened since the funding bid was written.

Related terms

A risk register template sits in a family of fixed format documents that each capture one part of how work is planned, run and reviewed. These five are the ones teams usually open alongside it.

• Enterprise risk management: the company wide programme the register reports into.
• Business risk: the category of exposure most rows in a register belong to.
• Pre mortem template: the workshop format that generates candidate risks before work starts.
• Post mortem template: the review format that captures what actually went wrong afterwards.
• Communication plan project: the document deciding who hears about a risk once it is escalated.

FAQ

What goes in a risk register template?

At minimum: a risk statement with a cause and an effect, a named owner, likelihood and impact scores, the chosen treatment, and the next review date. Everything else is optional detail.

How often should a risk register be reviewed?

Quarterly is the usual floor, and monthly suits active projects. The review date belongs in the template so the question answers itself.

Who owns a risk register?

One named person owns each row and one function owns the document — usually the risk team, the project manager or the compliance lead depending on scope.

Is a risk register the same as a risk assessment?

No. The assessment is the method that produces a score, and the register is the record that stores it alongside the owner, the treatment and the review date.

Should a small team bother with one?

Yes, because a one page register with five honest rows beats a forty row document nobody has reopened since the kick off meeting.

Find providers who already run this discipline across the Outsource Accelerator network before you hand a process offshore.