Free risk register template (Excel and CSV)
A ready-to-use risk register with automatic 5×5 scoring, colour-coded risk levels, dropdowns and four worked examples. No sign-up, free to adapt for your organisation or your clients.
The Excel file also opens in Google Sheets (File → Import) and Apple Numbers. The CSV holds the same columns and example rows, without formulas or formatting.
What is in the template
- Risk register sheet — 24 columns covering the full life of a risk, from cause to next review. Scores and levels calculate automatically for 200 rows.
- Scales sheet — 1–5 likelihood and impact scales with example thresholds in pounds, days of disruption and reputational effect. Replace them with your own before you start scoring.
- Matrix sheet — a colour-coded 5×5 risk matrix to paste into board papers.
- How to use sheet — the six steps below in short form.
The columns, and how to fill them in
| Column | How to fill it in |
|---|---|
| ID, Risk title | A unique code (R-01) and a short name people will recognise in a meeting. |
| Cause, Event, Consequence | Why it could happen, what would happen, and what it would cost or break. Splitting them stops vague entries like “IT risk”. |
| Category, Owner | Choose a category from the dropdown. The owner is one named person, not a department. |
| Inherent likelihood and impact | 1–5 each, as if no controls were in place. Score and level fill in automatically. |
| Existing controls | Only controls that operate today. Policies nobody follows do not count. |
| Residual likelihood and impact | 1–5 each, with current controls. This is the score you prioritise on. |
| Response | Treat, Tolerate, Transfer or Terminate. |
| Actions, Action owner, Due date | Required for every “Treat”. One action per line keeps progress visible. |
| Target score | Where the residual score should land once actions are complete. |
| Status, Last reviewed, Next review | Open, In treatment, Monitoring or Closed; dates keep the register alive. |
How the scoring works
Each score is likelihood × impact, giving a value from 1 to 25. The template converts the score into a level:
| Score | Level | Typical expectation |
|---|---|---|
| 1–4 | Low | Accept and monitor at the scheduled review |
| 5–9 | Moderate | Named owner; actions at the owner’s discretion |
| 10–14 | Significant | Treatment plan with deadlines |
| 15–25 | Critical | Escalate to leadership; review monthly |
These bands are a common starting point, not a rule. If your board has a lower appetite for, say, compliance risk, tighten the bands or set a separate threshold for that category.
How to use the template in six steps
- Calibrate the scales. Replace the example thresholds on the Scales sheet with numbers that fit your size. A £50k loss is minor for one business and severe for another.
- Collect risks. Run short workshops with each area and write each risk as cause → event → consequence. The example rows show the style — delete them when you start.
- Score inherent risk. Likelihood and impact without controls.
- Record controls and score residual risk. Be honest about what actually works today.
- Decide and plan. Pick a response; every “Treat” gets an action, an owner and a due date.
- Set review dates. Monthly for critical and significant risks, at least quarterly for the rest.
For a deeper explanation of each step, a fully worked example and the most common mistakes, read What is a risk register?
Adapting it for a project
For a project risk register, keep the same structure and add three columns: affected milestone, schedule impact (days) and cost impact (£). Multiplying probability by cost impact gives an expected monetary value you can use to size contingency. Close the register with the project, and escalate anything that outlives it to the corporate register.
When a spreadsheet stops being enough
Spreadsheets are the right way to start. These are the signs you have outgrown one:
- Several people edit the file and nobody knows which copy is current.
- You cannot say who changed a score, when, or why.
- Actions go overdue without anyone being reminded.
- Each board report means rebuilding the matrix and the top-10 list by hand.
- You run registers for several entities or clients and want them on one methodology.
Risk Samurai imports this exact template, keeps a full history of every change, reminds owners before deadlines and produces the matrix and reports automatically.
Frequently asked questions
Does the template work in Google Sheets?
Yes. Upload the .xlsx file to Google Drive and open it with Google Sheets. Formulas, dropdowns and colour coding are preserved.
Can I change the scoring scale?
Yes. Edit the descriptions on the Scales sheet. If you change the level thresholds, update the formulas in the two “level” columns as well.
Can I use it for a project?
Yes — see adapting it for a project above.
Is it really free?
Yes. No sign-up is needed, and you may use and adapt it for your organisation or your clients.
Or let AI fill it in for you
Describe your business or paste your website. Risk Samurai drafts the risks, causes, controls and scores — you review and approve each one.
Get early access