What is a risk register in project management?

A table of the risks that could affect a project, each with its likelihood, impact, overall score, owner, planned response, warning trigger and status. It is kept up to date for the whole project and reviewed regularly.

What is the difference between a risk and an issue?

A risk is something that might happen; an issue is something that already has. Risks are scored and given a response plan. When a risk happens it becomes an issue, which needs an owner and an action now.

How do you calculate a risk score?

A common method rates likelihood and impact each from 1 to 5 and multiplies them, giving a score from 1 to 25. The exact scale matters less than using it consistently so risks can be compared and the highest handled first.

Who owns the risk register?

The project lead usually maintains the register as a whole, while each individual risk has its own owner who watches its trigger and makes sure the response happens. The sponsor should see the highest-scoring risks regularly.

How often should a risk register be reviewed?

Weekly suits most projects, often as part of the status cycle. Review it immediately when something significant changes, such as a new dependency, a lost team member or a change in scope.

What are the four risk responses?

Avoid (change the plan so the risk cannot occur), mitigate (reduce its likelihood or impact), transfer (shift the impact to another party, such as a vendor or insurer) and accept (consciously live with it and monitor it).

Free template · no sign-up

Risk register template

A risk register is a table of the things that could go wrong on a project, kept up to date for the life of the project. For each risk it records how likely it is, how much harm it would do, an overall score, who owns it, what the team will do about it, and the warning sign that means it is starting to happen.

Start one at kickoff and review it on a schedule, weekly on most projects. Its value is not the list on day one; it is the habit of looking ahead every week and acting on a risk while it is still cheap to deal with.

The CSV is the “Risk register” table; it opens in Excel, Google Sheets or Numbers.

#When to use it

When to use a risk register template

A project has a fixed deadline, a fixed budget or outside dependencies.
A sponsor, client or auditor asks how project risks are being managed.
The team keeps being surprised by problems someone saw coming.
A project is large or long enough that conditions will change while it runs.

#The template

The risk register template

Fill in the blanks and replace the example rows with your own. Everything below is what the copy and download buttons give you.

Risk register

Score = likelihood × impact, each rated 1 (low) to 5 (high). Review the highest scores first.

ID	Risk	Category	Likelihood (1-5)	Impact (1-5)	Score	Owner	Response	Trigger	Status
R1	A key vendor delivers late	Schedule	3	4	12	Project lead	Mitigate: agree interim dates and check weekly	Missed interim date	Open
R2	A specialist is pulled onto another project	People	2	5	10	Sponsor	Mitigate: document their work; line up a backup	Resourcing request from another team	Open
R3	Requirements change after design sign-off	Scope	4	3	12	Project lead	Mitigate: change requests go through the sponsor	New request from a stakeholder	Open
R4	Costs exceed the approved budget	Budget	2	4	8	Finance contact	Monitor: compare spend with budget every two weeks	Spend above plan for two periods	Open
R5	Data migration finds poor-quality records	Technical	3	3	9	Engineer	Mitigate: run a trial migration early	Trial error rate above agreed level	Open
R6	Launch clashes with a busy period for users	External	2	2	4	Project lead	Accept: note it and review at go/no-go		Open

Scoring guide

Likelihood 1: very unlikely. 3: about as likely as not. 5: almost certain.
Impact 1: negligible. 3: noticeable delay, cost or quality loss. 5: threatens the project's objective.
Score 15 to 25: act now and report to the sponsor. 8 to 14: plan a response and watch the trigger. 1 to 7: monitor.

Response types

Avoid: change the plan so the risk cannot happen.
Mitigate: reduce the likelihood or the impact.
Transfer: move the impact to someone better placed to carry it, such as a vendor or insurer.
Accept: decide consciously to live with it, and say so in the register.

Review

Review frequency:
Who attends:
Where closed and realized risks are recorded:

#How to fill it in

How to fill it in

01
Brainstorm risks with the team
Ask "what could stop us hitting the objective, the date or the budget?" Go category by category: schedule, people, scope, budget, technical, external.
02
Write each risk as cause and effect
"A key vendor delivers late, delaying testing" is a risk you can act on. "Vendor" is not.
03
Rate likelihood and impact
Use the 1 to 5 scales in the scoring guide and multiply them for the score. The scores are rough; their job is ordering, not precision.
04
Give every risk an owner
The owner watches the trigger and makes sure the response happens. A risk with no owner is a risk nobody is watching.
05
Choose a response and a trigger
Decide whether to avoid, mitigate, transfer or accept, and write the observable sign that the risk is turning into a problem.
06
Review it on a schedule
Re-score, add new risks, close the ones that passed, and move any that happened to your issue list. Report the top few in the weekly status.

Common mistakes

Writing vague risks such as "resources" that nobody can act on.
Filling the register at kickoff and never opening it again.
Owners who are teams or committees instead of people.
Confusing risks (might happen) with issues (already happening); issues need action now, not a score.

#In Kavanah

Risk you do not have to remember to look for

A register covers the risks someone thought of. Kavanah also watches the task board for the most common one there is, work quietly slipping, and keeps the review on the calendar.

What is at risk this week

Ask the AI agent what is at risk and it scores every open task for the chance of missing its deadline, from schedule pressure, inactivity, blockers, the assignee's load and priority, and returns the riskiest with the reasons.

Learn more

Mitigations as real tasks

Each risk response can be a task with an owner, a due date, dependencies and a checklist, so a mitigation is tracked like any other work instead of living only in the register.

Learn more

A review that recurs

Set a recurring task for the weekly risk review on the project's Recurring tab, so the register is opened every week whether or not anyone remembers.

Learn more

A record of every agent action

If the agent works on the project, every action it takes is logged in an activity record you can review, filter and, for many actions, undo.

Learn more

#Questions

Risk register template questions

What is a risk register in project management?: A table of the risks that could affect a project, each with its likelihood, impact, overall score, owner, planned response, warning trigger and status. It is kept up to date for the whole project and reviewed regularly.
What is the difference between a risk and an issue?: A risk is something that might happen; an issue is something that already has. Risks are scored and given a response plan. When a risk happens it becomes an issue, which needs an owner and an action now.
How do you calculate a risk score?: A common method rates likelihood and impact each from 1 to 5 and multiplies them, giving a score from 1 to 25. The exact scale matters less than using it consistently so risks can be compared and the highest handled first.
Who owns the risk register?: The project lead usually maintains the register as a whole, while each individual risk has its own owner who watches its trigger and makes sure the response happens. The sponsor should see the highest-scoring risks regularly.
How often should a risk register be reviewed?: Weekly suits most projects, often as part of the status cycle. Review it immediately when something significant changes, such as a new dependency, a lost team member or a change in scope.
What are the four risk responses?: Avoid (change the plan so the risk cannot occur), mitigate (reduce its likelihood or impact), transfer (shift the impact to another party, such as a vendor or insurer) and accept (consciously live with it and monitor it).

More free templates

Run the work, not just the template.

Free to start, priced per seat from $3 a month with AI usage metered in credits.

Start free See pricing

Risk register template

The CSV is the “Risk register” table; it opens in Excel, Google Sheets or Numbers.

Risk