Risk Register & Mitigation Template

Purpose

This risk register helps teams make risks explicit, assess likelihood and impact consistently, assign owners, and track mitigation and contingency actions so experiments and changes remain safe, explainable, and trustworthy.

Quick guidance

Use one row per identified risk. Give each risk a clear owner, describe a concrete mitigation and a trigger that tells you when the mitigation should be executed or when the contingency plan should start. Record review dates and the current status so stakeholders can see progress at a glance.

Scoring rules (consistent language helps trust)

Use the following 1–5 scales for both Likelihood and Impact, then calculate Risk Score = Likelihood × Impact (range 1–25). Prioritize by Risk Score and by time sensitivity of the trigger.

• Likelihood — 1 Rare, 2 Unlikely, 3 Possible, 4 Likely, 5 Almost Certain
• Impact — 1 Negligible, 2 Minor, 3 Moderate, 4 Major, 5 Critical
• Risk Score thresholds (example) — 1–6 Low, 7–12 Medium, 13–25 High. Adapt thresholds to your context.

How to use

1. Identify a risk concisely (what might go wrong?).
2. Assess Likelihood and Impact using the provided scales.
3. Assign a single Owner responsible for mitigation and escalation.
4. Record the primary Mitigation (what you'll do to reduce likelihood or impact).
5. Record a Trigger — observable signal that the risk is materializing or the mitigation failed.
6. Record a Contingency or Fallback action to run if the trigger is observed.
7. Set a Review Date to verify mitigation effectiveness and update Residual Risk and Status.

Fields (table columns)

• Risk ID — short unique label or number (helpful when discussing risks).
• Risk — concise description of the threat or failure mode.
• Likelihood (1–5)
• Impact (1–5)
• Risk Score — Likelihood × Impact (calculated).
• Owner — name and contact (who will monitor and act).
• Mitigation — specific prevention steps, controls, or monitoring.
• Trigger / Detection — what observable event or metric indicates the risk has surfaced.
• Contingency — fallback process or rollback plan to limit harm.
• Residual Risk — expected risk after mitigation (1–5 for Likelihood and Impact or combined score).
• Review Date — next scheduled check for this risk.
• Status — Open / Monitoring / Mitigated / Closed.
• Notes / Links — links to experiment ID, playbook, runbook, logs, or evidence.

Template table

Copy this table into your document or spreadsheet. Replace example rows with your risks.

Common pitfalls

• Using vague risk descriptions — make the failure mode observable and testable.
• Skipping the Trigger — without a clear trigger you may not notice the risk until it's too late.
• Not assigning a single owner — ownership creates accountability and faster action.
• Treating mitigation as a one-time checkbox — regularly review residual risk and update controls.

Governance & cadence

Decide a review cadence (weekly for high-risk experiments, monthly for ongoing projects). During reviews, confirm trigger logs, test mitigations, update residual risk, and close risks with evidence when mitigations reliably control the threat.

When a risk triggers

1. Owner confirms trigger and assesses scope (who/what is affected).
2. Execute contingency plan and notify stakeholders per the runbook.
3. Log actions taken, time, and outcome in Notes / Links.
4. After incident, run a short review: why the primary mitigation failed, lessons, and next steps.

Where this template helps

Good for experiments, automations, small projects, and change rollouts where teams need a compact, explainable record of risk assessment and mitigation decisions. It supports transparency, faster response, and building trust with stakeholders.

Tip: Copy this HTML table to a shared spreadsheet or project board where you can sort and filter by Risk Score, Owner, Status, or Review Date. Consider adding a column for last-updated-by and last-updated-date for auditability.