The risk register that gets maintained

Template · Excel (.xlsx) · Free, no email required · Reviewed June 2026

Most risk registers die the same death: built for an audit, scored on a five-point scale nobody can defend, reviewed never. This one is designed around the failure modes, not around looking impressive.

Why it's built this way

• 1–3 scoring, not 1–5. Small teams can't meaningfully distinguish five levels of likelihood, and pretending produces false precision and long arguments. Three levels with concrete anchors — dollar amounts, downtime hours, calendar horizons — let two people score the same risk the same way. Auditors accept it; what they actually check is that you have criteria and apply them consistently.
• Owner and Decision Maker are separate columns. The person working a risk and the person who accepted or funded it are usually different people — and the register's real job is recording the second one. Risk decisions belong to the business, not to IT.
• Risk statements have a required grammar. [Event] caused by [cause], resulting in [impact]. If you can't fill all three parts, you have a worry, not a risk — and worries don't belong on the register.
• Ten realistic example risks included. Ransomware via phished credentials, ghost accounts from broken offboarding, key person dependency, untested backups, payment fraud. They show the expected level of detail — including the honest entry most registers omit: the one where the single point of failure is you.

How to use it

Replace the examples with your own risks, keep the total under about 25, and review quarterly on a recurring calendar slot. The three rules in the Read Me tab are the whole discipline: a risk unreviewed for 90 days is decoration; "Accepted" requires a name and a review date; if everything is on the register, nothing is.

Pairs with the leadership risk briefing — the top rows of this register, translated into plain language, are section 2 of that one-pager. Background reading: Talking to leadership about risk.