Free Risk Register Template
Excel, Sheets & PDF
I built this risk register on how I actually managed risk on construction projects in the UAE, including multi-million projects. It has 15 example risks across 8 categories, automatic colour-coded scoring, a 5x5 heat map, drop-downs and residual risk tracking. Download it free in Excel and open it in Google Sheets in one click.
Three sheets: Risk Register (15 pre-filled risks, auto-scoring, dropdowns), Risk Matrix (5x5 heat map with risks plotted), and Instructions (step-by-step guide). Scores calculate automatically. RAG colours update instantly. Fully editable.
Risk score = Probability (1–5) × Impact (1–5): colour updates automatically
Download Free Template
Excel (.xlsx) · Works in Google Sheets too
- 15 pre-filled risks across 8 categories
- Auto-scoring: Prob × Impact = Score
- RAG colours update automatically
- 5x5 probability-impact heat map
- Dropdown validation on all key fields
- Residual risk tracking (post-response)
- Risk count summary row
- 30 blank rows for your own risks
- Step-by-step instructions sheet
Quick answer
A risk register is a log of every identified project risk with its probability, impact, owner and planned response. This free Excel template has 3 sheets, 15 pre-filled example risks across 8 categories and automatic risk scoring, so you can see which risks need action first.
If you want to learn the full risk process, from finding risks to choosing responses, read my risk management guide. This page is for the template itself: how to fill it in row by row, with a worked example.
What's inside the risk register template?
Every column in this register has a reason. I did not add anything that does not earn its place on a real project. Here is exactly what each column captures and why it matters.
| Column | What It Captures | Notes |
|---|---|---|
| ID | Unique risk identifier (R-001, R-002…) | Pre-filled. Use it to cross-reference risks in status reports and steering committee packs. |
| Category | Risk type: Scope, Resource, Schedule, Budget, Quality, Technical, Stakeholder, External | Dropdown menu. Select from 10 categories. |
| Risk Description | Clear statement of the risk event and its potential impact | Write as "If [event], then [consequence]." This format forces clarity. |
| Risk Owner | Person accountable for executing the response plan | Do not default every risk to the PM. Ownership must match expertise. |
| Probability (1–5) | Likelihood of the risk occurring | Dropdown: 1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain |
| Impact (1–5) | Severity if the risk materialises | Dropdown: 1=Negligible to 5=Catastrophic |
| Risk Score | Probability × Impact: auto-calculated | Colour updates automatically: Green, Yellow, Orange, Red |
| Rating | Low / Medium / High / Critical | Auto-colours based on score threshold |
| Response Strategy | Avoid / Mitigate / Transfer / Accept / Escalate | Dropdown menu |
| Response Action | Specific steps to execute the response | Name who does what and by when. Vague actions get ignored. |
| Contingency Plan | What to do if the risk materialises despite the response | Plan this in advance. Do not improvise under pressure on a live project. |
| Residual Prob | Probability after response actions are in place | Should be lower than original probability if the response is effective. |
| Residual Impact | Impact after response actions are in place | Some risks can only reduce probability, not impact. Know the difference. |
| Residual Score | Residual Prob × Residual Impact: auto-calculated | Shows remaining risk exposure after mitigation. This is your true risk position. |
| Status | Open / In Progress / Closed / Cancelled | Dropdown. Open risks are highlighted in violet so nothing gets missed. |
How does risk scoring work?
The score works out automatically as Probability × Impact. Both use a 1 to 5 scale, so the score runs from 1 to 25. The colour changes the moment you change either number. No formulas to set up and no manual colouring.
Probability Scale (Column E)
1 · Rare: Less than 10% chance. Theoretically possible but very unlikely. 2 · Unlikely: 10 to 30% chance. Has happened on similar projects but not expected here. 3 · Possible: 30 to 60% chance. Could easily go either way. Flag every Possible risk for active attention. 4 · Likely: 60 to 80% chance. Expected to happen unless you actively manage it. 5 · Almost Certain: More than 80% chance. At this point you are dealing with an issue, not just a risk.
Impact Scale (Column F)
1 · Negligible: Minor disruption, easily absorbed within normal project operations. 2 · Minor: Small schedule or cost impact manageable within existing contingency. 3 · Moderate: Noticeable impact on one or more project constraints. Sponsor needs to be aware. 4 · Major: Significant impact on schedule, budget or scope requiring formal change control. 5 · Catastrophic: Project failure, major financial loss, reputational damage or regulatory breach. On my UAE projects, anything at Impact 5 went straight to the steering committee.
How to fill in the risk register: a worked example
Here are three rows filled in the way I would on a building project in the UAE. This is an example only, not data from a real project. Look at how each description follows "If..., then..." and how the residual score shows what is left after the response.
| ID | Risk description | P x I = Score | Response and owner | Residual |
|---|---|---|---|---|
| R-001 | If consultant approval of the facade shop drawings is late, then fabrication cannot start and the facade handover slips. | 4 x 4 = 16 (High) | Mitigate. Submit early, track in a weekly submittal log, book review meetings. Owner: design manager. | 2 x 4 = 8 (Medium) |
| R-002 | If the chillers ordered from overseas arrive late, then MEP testing and handover slip. | 3 x 5 = 15 (High) | Mitigate. Order early, track shipping weekly, agree a temporary cooling option as contingency. Owner: procurement manager. | 2 x 5 = 10 (High) |
| R-003 | If the Civil Defence inspection fails, then the completion certificate is delayed. | 3 x 4 = 12 (High) | Mitigate. Pre-inspection walk with the MEP consultant two weeks before. Owner: MEP coordinator. | 2 x 4 = 8 (Medium) |
See R-002: the response lowers probability but not impact. That is why it stays High and still needs a contingency plan.
Mistakes I see when people fill this in
- Known facts logged as risks. The summer midday work break is not a risk. It will happen. Plan for it in the schedule.
- Causes instead of risks. "Shortage of labour" is a cause. Write what might happen because of it and what it will hit.
- Every risk owned by the PM. Give each risk to the person best placed to act on it.
- Residual columns left blank. Without them, you cannot show whether your responses are working.
- Risks that happened left as risks. Once it has happened, move it to the issue log.
What are the five risk response strategies?
Picking the right response is one of the biggest calls you make as a PM. I have seen experienced PMs pick Mitigate for every risk out of habit. Here is when each strategy really fits.
Risk Register: 5 Common Questions Answered
Keep learning
- Free RACI Matrix Template: Excel & Google Sheets
- Free WBS Template: Work Breakdown Structure Word Download
- Free Gantt Chart Template: Excel Download
- Free Project Budget Template: Excel Download
- Free Communication Plan Template: Excel Download
- Free Change Management Plan Template: Word Download