§1What the register is actually for
Not a form to be filled: a queue of decisions, sorted by how much they can hurt.
A risk register earns its keep when it changes what somebody does this week. Everything in this template serves that test: risks are written as cause–event–consequence so treatments aim at causes; they carry a single owner so actions have an address; and they are sorted by score so the meeting starts at the top and runs out of time at the bottom, where running out of time is safe.
How to use this page. Recreate the eleven columns of §2 in your spreadsheet or PM system, adopt the 5 × 5 scale in §3 (or substitute your organisation’s), and copy the worked entries in §4 as seed rows to set the writing standard.
§2Column-by-column anatomy
Eleven columns. Fewer and you lose decisions; more and people stop filling it in.
| Column | What goes in it — and why |
|---|---|
| ID | A short, permanent code (R-001…). Never reused, even after closure — audit trails point at IDs. |
| Title | Seven words or fewer, naming the event, not the worry. “Substation delivery slips past shutdown” beats “schedule risk”. |
| Description | Cause → event → consequence in one sentence each. If the cause is missing, the treatment will aim at symptoms. |
| Category | A small fixed list (technical, commercial, schedule, HSE, external). Resist inventing new ones per risk. |
| Likelihood (1–5) | Scored against the agreed scale, not gut feel on the day. |
| Consequence (1–5) | Worst credible outcome, costed where possible. |
| Score | Likelihood × consequence — the matrix cell, and the sort key of the register. |
| Owner | One name. A committee owning a risk is nobody owning a risk. |
| Treatment | The next physical action, with a date — not a policy statement. |
| Residual score | The score you honestly expect after the treatment lands. |
| Status & review date | Open / treating / closed, and the date it next appears on an agenda. |
§3Scoring — the 5 × 5 matrix
Multiply likelihood by consequence; read the band; argue about the inputs, never the arithmetic.
Both scales run 1–5 against written anchors (agree them once, in the project management plan). The product places the risk in one of four bands:
| Band | Score | Standing response |
|---|---|---|
| Low | 1–4 | Accept and monitor; review at the normal cadence. |
| Moderate | 5–9 | Owner assigned; treatment optional but the decision recorded. |
| High | 10–14 | Funded treatment with a date; on the project meeting agenda. |
| Extreme | 15–25 | Escalated to the sponsor; treated before dependent work proceeds. |
Every one of the 25 cells lands in exactly one band, so two people scoring the same inputs always reach the same response — the matrix removes discretion from the reaction and concentrates it where it belongs, on the scoring.
Contents§4Worked entries — the writing standard
Three seed rows that show the grain: causes named, owners singular, treatments dated.
| ID | Risk (cause → event → consequence) | L | C | Score | Owner | Treatment (next action) |
|---|---|---|---|---|---|---|
| R-001 | Single supplier for the drive unit → delivery slips past the August shutdown → tie-in deferred a full cycle. | 4 | 4 | 16 · Extreme | Project Engineer | Second source qualified and priced by 15 Aug; expedite clause added to the PO. |
| R-002 | Design review resourcing clash → comments returned late → fabrication release delayed. | 3 | 3 | 9 · Moderate | Project Manager | Review slots booked in reviewers’ diaries this week; decision recorded to accept residual. |
| R-003 | Undocumented buried services in the trench route → strike during excavation → injury and stop-work. | 2 | 5 | 10 · High | Site Lead | Ground-penetrating survey ordered; permit-to-dig gate added before any excavation. |
§5Cadence and hygiene
A register decays in weeks unless three habits hold.
Review rhythm
Extreme and High rows at every project meeting; the whole register monthly; the scales themselves once per phase. A risk nobody has looked at in a month is a rumour, not a register entry.
Closure discipline
Closed risks keep their row and their ID — struck through, never deleted. The residual-score column is the honesty check: if treatments never move the score, they are activity, not treatment.
§6Quick reference
The working core of the resource on one card rack.
Write
Cause → event → consequence, seven-word title.
Score
score = L × C
Bands: 1–4 · 5–9 · 10–14 · 15–25.
Own
One name per risk. Treatments are dated actions.
Review
High+ every meeting; everything monthly.