Project Risk Register: Template, Scale and Worked Example

What a project risk register is

A project risk register is the living list of uncertain events that can affect schedule, cost or quality, with the probability, impact, planned response and owner for each one. It turns the project manager's vague worry into decisions with an owner and a date.

A risk is an event that may still happen; an issue is something that already happened. When a risk occurs, it leaves the risk register and enters the action plan. A well-kept register stops the project from learning by surprise what the team already suspected.

Visual map of the risk register

The map walks through the four steps, identify, assess, respond and monitor, with the numerical example used below.

Minimum fields of the register

• ID and description: written as cause, event and consequence (for example: "because the supplier is overseas, the machine may arrive late, and production would start after the promised date").
• Probability (P) and impact (I): scores from 1 to 5 on a scale defined beforehand.
• Score: P × I.
• Response strategy and action: what will be done, not just the label.
• Owner and due date: one person, not a department.
• Residual risk: the expected score after the response.
• Trigger and status: the signal that the risk is approaching, and whether it is open, occurred or closed.

Define the probability and impact scale

Without an agreed scale, everyone assesses with a personal ruler. In this example impact is measured in schedule; in other projects, add cost, safety and quality.

Risk score = probability × impact

Bands used in the example: 1 to 5 is low risk, 6 to 12 is medium and 15 or more is high. High risks require an active response and weekly follow-up.

Example: installing a new machining cell

Fictional example: a project to install an imported machine has six risks identified in a meeting with purchasing, engineering, maintenance and production. The assessment, in score order:

Risk R1 (delivery delay) leads with 16 points: probability 4 and impact 4. The scores add up to 63. Risks R2 to R5 sit in the medium band and R6 in the low band.

Responses and residual risk

Each risk gets one of the classic strategies: avoid (remove the cause), mitigate (reduce probability or impact), transfer (contract, insurance, supplier) or accept (monitor, with or without a reserve). For opportunities, the mirror strategies are exploit, enhance, share and accept.

After the responses, the total drops from 63 to 32. R1 falls from 16 to 8 (probability 2, impact 4): still medium, but no longer the biggest risk. R6 was accepted because its score is 4 and the cost of acting would exceed the gain.

Contingency reserve and expected value

For risks with an estimable cost, expected monetary value helps size the reserve. If a 3-week machine delay costs $15,000 per week, the impact is $45,000. With a 60% probability: expected value = 0.60 × $45,000 = $27,000. Add up the expected values of accepted or residual risks to suggest the project reserve. The method is the same as in the decision tree and expected monetary value. When schedule and cost risks combine across many uncertainties, a Monte Carlo simulation gives a range of outcomes instead of a single number.

How to keep the register alive

1. Review high risks at every weekly project meeting and the rest once a month.
2. Update probability and impact when the trigger appears or the response is completed.
3. Log new risks at each milestone or scope change.
4. Close risks that can no longer occur and note the lesson for the next project.
5. Compare forecast and actual: if "low" risks keep happening, the scale is too optimistic.

The register connects with other project tools. Activities come from the work breakdown structure and the Gantt chart, and the effect of an occurred risk is tracked in earned value. For occupational safety risks, use the risk matrix and preliminary risk analysis; for product and process failures, the FMEA. To choose between alternatives while weighing their risks, see the weighted decision matrix.

Common mistakes

• A register made once and forgotten. Without periodic review it becomes a shelf document.
• Vague risks. "Supplier problems" does not allow action. Describe cause, event and consequence.
• Mixing risks and issues. What has already happened goes to the action plan.
• A collective owner. A risk owned by "the whole team" has no owner.
• Mitigating by default. Check whether avoiding, transferring or accepting costs less.
• Ignoring residual risk. A response never brings risk to zero; record what remains and who tracks it.

Frequently asked questions

What is a risk register?

A list of project risks with probability, impact, response, owner and status, updated throughout execution.

How do you calculate a risk score?

Multiply probability by impact. In the example, risk R1 scores 4 × 4 = 16 points.

What are the risk response strategies?

Avoid, mitigate, transfer and accept. For opportunities: exploit, enhance, share and accept.

What is the difference between a risk and an issue?

A risk is an uncertain event that may occur; an issue is something that has already occurred and needs immediate action.

How often should the register be reviewed?

High risks weekly; the others monthly and at each project milestone.

What is residual risk?

The risk that remains after the response. In the example, R1 drops from 16 to 8 points.

About the author

Vagner Soares

Lean Manufacturing & Behavioral Management Specialist

Over 20 years in the automotive and metalworking industries (GM and Dana), Lean Manufacturing practitioner since 2006. SENAI instructor and mentor in Brazil’s Brasil Mais Produtivo program, delivering consulting, training and audits for 50+ companies, combining quality, productivity and people development.

LinkedInInstagramFull profile →