Free Project Risk Register: Risk Register with Likelihood and Impact Scores, 5x5 Risk Matrix, and a Risk Response Plan (PDF, Word, Excel)

What is on the project risk register

Risk statement

Written as "if [cause], then [effect]", which makes it clear what could happen and why. "Contractor" is not a risk; "if the contractor is unavailable in April, the build slips" is.

Likelihood and impact

Each scored 1 to 5 using the scales on the matrix page. Excel multiplies them into a score from 1 to 25.

Owner and warning sign

One person who watches the risk, and the early sign that it is starting to happen.

Strategy

Avoid (change the plan so it cannot happen), reduce (lower the likelihood or impact), transfer (insurance, contract, specialist) or accept (watch and keep a contingency).

Score after

The expected score once the response is in place, which shows whether the spending is worth it.

Identifying risks

Hold a short risk session at the start of the project with the whole team, and ask: what could stop us delivering on time, on budget, or to the quality we promised? Think through categories (schedule, cost, technical, people, suppliers, quality, compliance, business) and look at what went wrong on similar projects. Write each risk as "if... then..." and put it on the register. Expect ten to twenty risks on a small project. Then score them. Revisit the register every week or two; new risks appear and old ones fade.

Scoring with likelihood and impact

Score each risk from 1 to 5 for likelihood and 1 to 5 for impact, using the definitions on the matrix sheet so everyone scores the same way. The score is the two multiplied: 15 and above is high, 8 to 14 medium, 7 and below low. Write the risk IDs into the matrix to see the overall picture: a project with several risks in the top-right corner needs the sponsor's attention before it starts. Scores are judgments, not measurements; their value is in making the team discuss and agree them.

Planning responses

For each high and medium risk, choose a strategy and specific actions. Reducing a risk often costs little (a review step, a test, a backup person); transferring it costs a fee (insurance, a specialist, a fixed-price contract); avoiding it may change the scope. Put a cost on each response and compare it with the score after: in the sample, about $850 of responses brings the four biggest risks down to medium or low. Keep a contingency budget for the risks you accept. When a risk actually happens, move it to the issue log and act on the plan.

Reporting risks

Show the top three to five risks and their trend in the weekly status report, and tell the sponsor immediately when a risk becomes high. Record the risk-related decisions in the decision log. At the end of the project, note which risks happened and which responses worked, for the next project.

Editing the files

The PDFs are fillable. The Excel register calculates scores and can be sorted by score so the biggest risks are at the top. The matrix scores and ratings are printed in every format; change the scale descriptions in Word to fit your organization.

Questions

What is a risk register?

A list of project risks with a description, likelihood, impact, score, owner, response, warning signs and status, reviewed regularly during the project.

How is a risk score calculated?

Likelihood (1 to 5) multiplied by impact (1 to 5), giving a score from 1 to 25. Higher scores need more attention.

What is a 5x5 risk matrix?

A grid with likelihood on one side and impact on the other, where each box shows the combined score and whether it is low, medium or high.

What are the four risk response strategies?

Avoid, reduce (mitigate), transfer, and accept. Some frameworks add escalate for risks outside the project's control.

How often should the risk register be reviewed?

Weekly or every two weeks on most projects, and whenever something significant changes.