Certifications PMP CertificationWorld’s top PM cert CSM — Certified ScrumMasterTop agile cert CAPMEntry-level PM cert PRINCE2UK & Europe standard View All Certifications ?
PM Guides Agile GuideComplete breakdown Scrum GuideRoles, ceremonies, artifacts EVM GuideAll formulas explained View All Guides ?
Career & Salary PM Salary 2026By country & level How to Become a PMStep-by-step roadmap 50 Interview QuestionsWith strong answers
PM Software Monday.com ReviewTop pick 2026 ClickUp ReviewBest value Best Free PM ToolsNo trials, truly free View All Software ?
Free Tools & Templates EVM CalculatorFree, no signup Gantt Chart MakerBuild & export free PMP Eligibility Checker30-second result Free PM Templates30 templates — Excel, Word, PDF
Get the Free PMP Guide ?
Free Template · Updated March 2026

Free Risk Register Template
Excel, Sheets & PDF

A professional, ready-to-use risk register with 15 pre-filled example risks across 8 categories, automatic colour-coded scoring, a 5×5 probability-impact heat map, dropdown validation and residual risk tracking. Download in Excel and open in Google Sheets in one click.

By Syed Mujeeb Rehman, PMP
📅Updated March 2026
📊3 sheets · 15 example risks
🔓Free — no signup
What's Inside

Three sheets: Risk Register (15 pre-filled risks, auto-scoring, dropdowns), Risk Matrix (5×5 heat map with risks plotted), and Instructions (step-by-step guide). Scores calculate automatically. RAG colours update instantly. Fully editable.

1–4
Low
5–9
Medium
10–16
High
17–25
Critical

Risk score = Probability (1–5) × Impact (1–5) — colour updates automatically

Download Free Template

Excel (.xlsx) · Works in Google Sheets too

RISK REGISTER
R-001 · Scope Risk · CRITICAL
R-002 · Resource Risk · HIGH
R-003 · Vendor Risk · MEDIUM
R-004 · Scope Risk · LOW
+ 11 more pre-filled risks…
.XLSX Google Sheets FREE
  • 15 pre-filled risks across 8 categories
  • Auto-scoring: Prob × Impact = Score
  • RAG colours update automatically
  • 5×5 probability-impact heat map
  • Dropdown validation on all key fields
  • Residual risk tracking (post-response)
  • Risk count summary row
  • 30 blank rows for your own risks
  • Step-by-step instructions sheet
⬇ Download Free (.xlsx) Open in Google Sheets →
15
Pre-filled example risks included
3
Sheets: Register, Heat Map, Instructions
4
Auto-colour bands: Low to Critical
Free
No account or payment required
01 — Template Contents

What's Inside — All 15 Columns Explained

Every column in the risk register serves a specific purpose. Here's exactly what each one captures and why it matters.

ColumnWhat It CapturesNotes
IDUnique risk identifier (R-001, R-002…)Pre-filled — use for cross-referencing in status reports
CategoryRisk type: Scope, Resource, Schedule, Budget, Quality, Technical, Stakeholder, ExternalDropdown menu — select from 10 categories
Risk DescriptionClear statement of the risk event and its potential impactWrite as "If [event], then [consequence]" for clarity
Risk OwnerPerson accountable for executing the response planMust not default to PM for all risks
Probability (1–5)Likelihood of the risk occurringDropdown: 1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain
Impact (1–5)Severity if the risk materialisesDropdown: 1=Negligible to 5=Catastrophic
Risk ScoreProbability × Impact — auto-calculatedColour updates automatically: Green/Yellow/Orange/Red
RatingLow / Medium / High / CriticalAuto-colours based on score threshold
Response StrategyAvoid / Mitigate / Transfer / Accept / EscalateDropdown menu
Response ActionSpecific steps to execute the responseMust name who does what by when
Contingency PlanWhat to do if the risk materialises despite the responsePre-plan this — don't improvise under pressure
Residual ProbProbability after response actions are in placeShould be lower than original probability
Residual ImpactImpact after response actions are in placeSome risks can't reduce impact — only probability
Residual ScoreResidual Prob × Residual Impact — auto-calculatedShows the remaining risk exposure after mitigation
StatusOpen / In Progress / Closed / CancelledDropdown — Open risks highlighted in violet
02 — Risk Scoring

How Risk Scoring Works in This Template

The risk score is calculated automatically as Probability × Impact. Both are rated on a 1–5 scale. The resulting score (1–25) maps to a colour-coded rating that updates instantly when you change either input.

Probability Scale (Column E)

1 — Rare: Less than 10% chance of occurring. The risk event is theoretically possible but very unlikely given the project context. 2 — Unlikely: 10–30% chance. Has happened on similar projects but not expected here. 3 — Possible: 30–60% chance. Could easily happen — essentially a coin flip. Flag all 3s for close attention. 4 — Likely: 60–80% chance. Expected to happen unless actively managed. 5 — Almost Certain: Greater than 80% chance. Treat as an issue, not just a risk.

Impact Scale (Column F)

1 — Negligible: Minor disruption, easily absorbed. 2 — Minor: Small schedule or cost impact manageable within contingency. 3 — Moderate: Noticeable impact on one or more project constraints requiring sponsor awareness. 4 — Major: Significant impact on schedule, budget or scope requiring formal change control. 5 — Catastrophic: Project failure, major financial loss, reputational damage or regulatory breach.

💡
PMP exam tip: The residual risk score after mitigation is just as important as the original score. If your mitigation plan reduces a Critical (20) risk to a High (12), that's good — but it's still High. Some risks will always have a residual score above acceptable thresholds, which means you need a contingency plan regardless of how strong your response is.
03 — Response Strategies

The Five Risk Response Strategies

Choosing the right response strategy is one of the most important decisions a PM makes. Here's when to use each one.

Avoid
Change the project plan to eliminate the risk entirely. Remove the risky activity, change the approach or scope it out.
Best for: High-probability, high-impact risks where an alternative approach exists.
Mitigate
Reduce the probability of the risk occurring, reduce the impact if it does, or both. The most commonly used strategy.
Best for: Risks you cannot avoid but can reduce through proactive action.
Transfer
Shift the financial consequence to a third party — insurance, warranty clauses, fixed-price contracts, outsourcing.
Best for: Financial or technical risks where a vendor or insurer is better placed to absorb them.
Accept
Acknowledge the risk and decide not to act unless it materialises. Active acceptance = prepare a contingency plan. Passive = do nothing.
Best for: Low-scoring risks where the cost of response exceeds the cost of the risk.
Escalate
Raise the risk to the programme manager, sponsor or organisational level because it is beyond the project manager's authority or scope to manage. Document the escalation and who it was escalated to.
Best for: Risks that affect multiple programmes, require executive decisions or need organisational-level response (regulatory risk, strategic risk, major supplier risk).
04 — FAQ

Risk Register — 5 Common Questions

A risk register is the central document that records all identified project risks, their probability and impact scores, response plans, owners and current status. It is created during the Identify Risks process (PMBOK) and updated continuously throughout the project. It should be reviewed at every steering committee and weekly with your team. A risk register that is never updated is worse than useless — it gives a false sense of security.
A complete risk register should include: unique risk ID, risk category, clear risk description, risk owner, probability score (1–5), impact score (1–5), overall risk score (probability × impact), risk rating (Low/Medium/High/Critical), response strategy, specific response actions, contingency plan, residual probability and impact after responses, and current status. This template includes all 15 fields.
Risk score = Probability × Impact, both rated 1–5. Probability: 1=Rare (<10%), 2=Unlikely (10–30%), 3=Possible (30–60%), 4=Likely (60–80%), 5=Almost Certain (>80%). Impact: 1=Negligible, 2=Minor, 3=Moderate, 4=Major, 5=Catastrophic. The score maps to: 1–4 Low (green), 5–9 Medium (yellow), 10–16 High (orange), 17–25 Critical (red). This template calculates and colours the score automatically.
The four PMI strategies for threats: Avoid (eliminate the risk by changing the plan), Mitigate (reduce probability or impact), Transfer (shift to third party — insurance, contracts), Accept (acknowledge and monitor, with or without a contingency plan). A fifth strategy, Escalate, is used when the risk is beyond the PM's authority. For opportunities (positive risks), the equivalent strategies are Exploit, Enhance, Share and Accept. See our full risk management guide →
Review the full register at every steering committee (typically fortnightly). Risk owners should update their specific risks weekly. At minimum, review every risk at each project phase gate to confirm scores and response status are still current. New risks can be identified at any time — run a risk identification session at the start of each phase. Closed risks should be kept in the register (marked as Closed) for audit trail purposes.