Risk Register & Prioritization Template

Purpose

This template helps teams capture enterprise risks, estimate their likelihood and impact consistently, assign clear ownership, track mitigations, and prioritize actions so limited attention reduces the highest exposures. Use it as a shared single source of truth for risk trade-offs across initiatives.

How to use this template

1. Record each risk as a single row describing a cause, a scenario, or a potential event that could harm objectives.
2. Estimate Impact and Likelihood using the scales below. Calculate the numeric Score and determine priority according to the thresholds.
3. Assign an owner responsible for monitoring and driving mitigation actions. Capture existing controls and planned treatments.
4. Review rows at the cadence matched to priority and escalate when criteria are met.

Recommended fields (columns)

• ID — Unique short identifier for the risk (e.g., R-034).
• Area / Process / Project — Where the risk sits in the organization.
• Risk Description — Clear statement of what could go wrong and why (cause → event → consequence).
• Potential Impact — Select or estimate impact on objectives (see scale).
• Likelihood — Estimate probability of occurrence (see scale).
• Score — Numeric risk score (Impact × Likelihood).
• Existing Controls — Controls that reduce likelihood or impact today.
• Mitigation / Treatment Action — Planned actions to reduce risk.
• Owner — Person accountable for the risk and mitigation.
• Target/Completion Date — When the mitigation should be implemented.
• Residual Impact & Likelihood — Reassessed values after controls.
• Review Date — Next scheduled review.
• Status — Open / In Progress / Mitigated / Accepted.
• Notes / Links — Link to related issues, change requests, or evidence.

Scoring scales (suggested)

Use simple 1–5 scales so scores range 1–25. Calibrate these with examples tailored to your organization.

Calculate score and priority

Score = Impact × Likelihood. Use thresholds to guide attention but adapt to risk appetite.

• 1–4: Low — Monitor routinely.
• 5–9: Medium — Owner-driven mitigation; discuss in monthly team reviews.
• 10–15: High — Prioritize resourcing; visible to senior management and removed into action plans.
• 16–25: Critical — Immediate escalation to executive sponsors or risk committee; consider temporary controls to reduce exposure now.

Example row

Review cadence and owner responsibilities

Match review frequency to priority. Suggested minimums:

• Critical: weekly until reduced below Critical.
• High: monthly.
• Medium: quarterly.
• Low: semi-annually or as part of routine reporting.

Owners must maintain evidence of control effectiveness, update residual scores after mitigation, and flag issues that change risk status. Senior stakeholders should receive a roll-up of all High and Critical risks for decision-making.

Escalation guidance

Escalate risks when:

• Score ≥ 16 (Critical) persists after planned mitigations.
• New information increases score across thresholds (e.g., from Medium to High).
• A control failure results in immediate material exposure.

Define who to notify (e.g., program sponsor, risk committee, legal, safety) and the expected response time.

Tailoring and governance notes

Calibrate scales and thresholds to reflect your organization’s risk appetite, regulatory demands, and context. Consider adding columns for financial exposure estimates, regulatory classification, or risk category tags to enable filtering and reporting.

Suggested next steps to operationalize

• Agree a shared definition of Impact and Likelihood with stakeholders before populating the register.
• Train owners on scoring, control evidence, and how to propose residual scores.
• Publish and enforce review cadence; use the register as an input to investment and control decisions.