Project information
0
0
0
0
0
0
0
0.0
Add or edit risk
Risk register
| ID | Risk | Category | P | I | Score | Rating | Residual | Owner | Response | Status | Deadline | Actions |
|---|
5×5 probability-impact matrix
Each cell shows the number of current risks at that score.
Risk overview
Scoring customization
Scores above the high maximum are classified Critical.
What is a risk register?
A risk register is a structured record of uncertainties that may affect objectives. It gives teams one place to describe threats, assign owners, evaluate severity, and plan responses. A practical register also tracks review dates, mitigation actions, warning indicators, deadlines, and residual exposure after controls are applied.
How risk scoring works
This generator uses a common probability-impact method. Probability is rated from one to five, while impact uses the same scale. Multiplying both values produces a score between one and twenty-five. Thresholds then convert that score into Low, Moderate, High, or Critical. Teams should adapt thresholds to their governance rules and risk appetite.
How to use this generator
Start by entering project details, then add each identifiable risk. Describe the event clearly and select a category, owner, probability, impact, response strategy, and status. Add mitigation actions, controls, contingency steps, deadlines, financial effects, and a key risk indicator when available. After planned controls, estimate residual probability and impact. Review the matrix and dashboard to find priority risks quickly.
Managing risk over time
A register is most useful when it stays current. Review open and critical risks regularly, confirm owners remain accountable, and update action completion. Close risks only when the exposure no longer needs active management. Reopen a risk if circumstances change. Exporting CSV supports further analysis, while PDF creates a convenient snapshot for meetings, audits, governance packs, and stakeholder reporting.
Choosing a risk response
Different risks need different responses. Avoidance removes the activity creating the exposure. Mitigation reduces probability, impact, or both through planned controls. Transfer moves part of the financial or contractual effect to another party. Acceptance records a conscious decision to retain the exposure within approved tolerance. Escalation sends a risk to higher authority when the current owner lacks sufficient control. A contingency plan should describe practical actions if the risk event occurs despite preventive measures.
Example scoring table
| Probability | Impact | Score | Typical rating | Suggested attention |
|---|---|---|---|---|
| 1 | 2 | 2 | Low | Routine monitoring |
| 2 | 3 | 6 | Moderate | Assign actions |
| 4 | 4 | 16 | High | Management attention |
| 5 | 5 | 25 | Critical | Immediate escalation |
Frequently asked questions
What is a risk register?
It is a central list of identified risks, scores, owners, controls, responses, review dates, and current status.
How is a risk score calculated?
The default formula is probability multiplied by impact. A 4 probability and 5 impact produces a score of 20.
What is inherent risk?
Inherent risk is the exposure before new mitigation measures or additional controls are considered.
What is residual risk?
Residual risk is the remaining exposure after controls, mitigation, transfer, or other responses are applied.
How often should risks be reviewed?
Review frequency depends on volatility and severity. Critical risks normally deserve much more frequent attention than low risks.
Who should own a risk?
The owner should have enough authority and knowledge to monitor the exposure and coordinate appropriate action.
What is a 5×5 risk matrix?
It plots five probability levels against five impact levels, creating twenty-five cells that help teams visualize relative priority.
What is the difference between mitigation and contingency?
Mitigation reduces probability or impact before an event, while contingency actions are used if the risk actually occurs.