Risk register template
A free risk register template for Excel, also called a risk log: 12 example project risks, each scored by probability and impact, with a severity, a response, an owner and a status. Exposure and the summary work themselves out. The same workbook is a RAID log, with Assumptions, Issues and Dependencies on their own tabs.
1. Download for Excel
Open the .xlsx in Excel on Windows, Mac or the web. Type over the example risks; the drop-down lists and the severity colours are already set up.
2. Use it in Google Sheets
In a blank spreadsheet choose File > Import > Upload, pick the file and choose Replace spreadsheet. The formulas and lists come with it.
3. Fill it in Onplana
Every Onplana project has a Risks tab on the same scale, free. Create a project and add each risk there, and the register lives beside the plan it is about.
Start free
Risk register example
The 12 risks the template opens with, the ones most projects meet in some form. Exposure is probability times impact: R1 has a 40% chance of adding 10 working days, so it carries 4 days of expected delay. The two cost and adoption risks have no schedule impact, so they have no exposure.
| ID | Risk and recommendation | Category | Probability | Impact | Exposure | Severity | Response | Owner | Status |
|---|---|---|---|---|---|---|---|---|---|
| R1 | A key supplier delivers late.Put delivery dates in the contract, order the long-lead items first and ask for a weekly status from the supplier. | External | 40% | 10 d | 4 d | High | Mitigate | Procurement lead | Open |
| R2 | Requirements change after sign-off.Freeze the scope at sign-off and send every change through a change request with its cost and its effect on the dates. | Scope | 50% | 8 d | 4 d | High | Avoid | Project manager | Open |
| R3 | A specialist leaves or is moved to another project.Pair a second person on the specialist work and write it down as it is done. | Resource | 25% | 12 d | 3 d | High | Mitigate | Delivery lead | Open |
| R4 | The estimates for the build are too optimistic.Re-estimate the largest tasks with the people doing them and keep a buffer before the deadline. | Schedule | 45% | 6 d | 2.7 d | Medium | Mitigate | Project manager | Open |
| R5 | Costs rise above the approved budget.Compare spend with the budget every month and agree with the sponsor when the contingency can be used. | Budget | n/a | n/a | n/a | High | Mitigate | Sponsor | Open |
| R6 | Approvers are not available for reviews when the plan needs them.Book the review dates at kickoff and name a deputy who can approve. | Schedule | 35% | 5 d | 1.75 d | Medium | Mitigate | Project manager | Monitoring |
| R7 | Connecting to an existing system takes longer than planned.Build a thin end-to-end connection in the first weeks, before the rest of the work depends on it. | Schedule | 30% | 10 d | 3 d | High | Mitigate | Technical lead | Open |
| R8 | The test environment is not ready when testing starts.Make the environment a task with its own owner and due date, two weeks ahead of testing. | Resource | 30% | 4 d | 1.2 d | Medium | Mitigate | Technical lead | Open |
| R9 | People do not take up the new process or system.Bring users into testing, train them before go-live and name a champion in each team. | Scope | n/a | n/a | n/a | Medium | Mitigate | Change lead | Open |
| R10 | A security or compliance review raises findings late.Share the design with the reviewers before the build and book the review early. | External | 20% | 8 d | 1.6 d | High | Avoid | Security lead | Open |
| R11 | Equipment is damaged in transit.Ship on the supplier's terms with transit insurance, so a replacement is at their cost. | External | 10% | 6 d | 0.6 d | Low | Transfer | Procurement lead | Open |
| R12 | The data in the old system is incomplete or wrong.Check a sample of the data in the first two weeks and agree who cleans each part. | Scope | 40% | 5 d | 2 d | Medium | Accept | Data lead | Monitoring |
How to fill in a risk register
- List what could go wrong. Write each risk as an event that may or may not happen, one per row, such as "a key supplier delivers late". A risk that has already happened is an issue, and goes on the Issues tab.
- Give it a category. Schedule, resource, budget, scope or external, so the register can be read by kind of risk and the same kind is spotted on the next project.
- Score probability and impact. Probability is the chance it happens, from 0 to 100 percent. Impact is the working days it would add to the plan. Exposure works itself out as probability times impact: the delay the risk carries on average. Leave both empty for a risk that would not move the dates, such as a cost risk.
- Set a severity and a response. Severity (low, medium, high or critical) says how much attention it gets. The response says what you will do: avoid it, mitigate it, transfer it to someone else, or accept it. Write the action in Recommendation.
- Name an owner and review it. Every risk gets one owner, a person rather than a team. Review the register on a fixed rhythm, such as every two weeks, close what has passed and add what is new.
Probability and impact in days are what a schedule risk analysis needs too. The free schedule risk analysis runs a plan many times over and shows how likely each finish date is.
RAID log template
A RAID log keeps four short registers side by side: Risks, Assumptions, Issues and Dependencies. The download is one: the risk register above is its first tab, and the other three follow, each with example rows and drop-down lists.
Assumptions
What the plan takes as true without proof, who checks it, by when, and what happens if it is wrong. The columns are those of Onplana’s standard Assumptions list, so the tab imports into it as it is.
| Assumption | Category | Owner | Validate by | Status | Impact if wrong |
|---|---|---|---|---|---|
| The sponsor approves the budget before the build starts. | Budget | Sponsor | Unvalidated | The build waits, and every later date moves with it. | |
| Two developers are free for the whole build. | Resource | Delivery lead | Validated | The build takes longer, or a contractor is needed. | |
| The old system stays in service until the cutover. | Technical | Technical lead | Unvalidated | A temporary workaround is needed for the gap. |
Issues
A risk that has happened, or a problem that needs an owner now: its type, severity, target date and resolution.
| ID | Issue | Type | Severity | Owner | Raised | Target date | Status | Resolution |
|---|---|---|---|---|---|---|---|---|
| I1 | The design review slipped a week. | Schedule | Medium | Project manager | Open | |||
| I2 | The test data set is missing two regions. | Quality | High | Data lead | Investigating | |||
| I3 | A licence for the build tool has expired. | Operational | Low | Technical lead | Resolved | Renewed for a year. |
Dependencies
What the project needs from someone outside it, or owes to them, and by when.
| ID | Dependency | Direction | Other party | Owner | Needed by | Status | Notes |
|---|---|---|---|---|---|---|---|
| D1 | Network access to the data centre | We need it | Infrastructure team | Technical lead | On track | ||
| D2 | Sign-off of the data model | We need it | Finance | Project manager | At risk | Their reviewer is away for two weeks. | |
| D3 | Test results for the reporting team | They need it from us | Reporting team | Delivery lead | Not started |
Not sure whether something is a risk or an issue? Read risk register vs issue log, and see how Onplana keeps both with risk and issue management.
Want the project plan as well as its risks? The project management templates for Excel are ready-made plans with every phase and task written out.
Updated .
Frequently asked questions
Is this risk register template free?
Yes. It is an Excel workbook (.xlsx) you download from this page, with no sign-up, no email and no trial.
What is the difference between a risk register and a risk log?
None in practice. Both names describe one table of the things that could go wrong on a project, with how likely each is, what it would cost, who owns it and what is being done about it. Some teams say risk log for a lighter list, but the columns are the same.
What columns should a risk register have?
At least: the risk, a category, probability, impact, a severity, a response, an action, an owner and a status. This template adds an Exposure column (probability times impact in working days) and a Next review date. Its categories, severities, probability in percent and impact in working days are the ones a risk in Onplana uses.
What is a RAID log?
RAID stands for Risks, Assumptions, Issues and Dependencies: four short registers kept side by side. This workbook is a RAID log: the risk register is its first tab, and Assumptions, Issues and Dependencies are the next three.
Does it work in Google Sheets?
Yes. Open a blank spreadsheet, choose File > Import > Upload, pick the file and choose Replace spreadsheet. The Exposure formula, the drop-down lists and the severity colours come with it.
Can I keep the risk register in Onplana instead?
Yes. Every Onplana project has a Risks tab, on the Free plan: what could go wrong, its category and severity, a recommendation, and probability with impact in working days, the same scale as this template. Dependencies are links between tasks on the Gantt chart, so a late task moves the ones after it.
Keep the register next to the plan
A register in a file goes stale between reviews. In Onplana each risk sits on the project it threatens, next to the tasks it would delay. Free, no credit card.