Risk Management Matrix
A risk register that scores each risk by likelihood and impact, rates it low to critical, tracks owner, mitigation, residual risk and review date, and counts a 5 by 5 heat map.
Free. Fill in, print, save as PDF or download as Word without an account. Saving to your account needs a free account.
Country versions
- International
A template, not advice.
Read more
What it is
A risk register is a table of things that could go wrong, with a score that shows how much attention each one deserves. Every risk gets two numbers from 1 to 5: how likely it is, and how bad it would be. Multiplied, they give a score from 1 to 25, and the rating bands (low, medium, high, critical) say which risks to deal with first. The familiar 5 by 5 matrix shows where your risks sit; this form counts it from the rows, so it never drifts away from the list.
The score is only the start. Each risk also has an owner, a concrete mitigation, a second score for the risk that remains after the mitigation, a status and a date to look at it again. That is what turns a list of worries into something a small business can manage. The ratings are written out in words as well as counted, so a black-and-white print or a screen reader shows the same picture. The structure follows the common pattern of risk-management guidance such as ISO 31000, without claiming conformity with any standard. It is a general template, not legal, financial or safety advice.
When to use it
- You are starting a project, a new product or a new site and want the main risks written down.
- A bank, investor, insurer or client asks how you manage risk.
- Your yearly planning needs a short list of what to watch and who watches it.
- An incident or a near miss showed that an earlier risk was rated too low.
- You want to check that mitigations really lower the score, not just exist on paper.
How to fill it in
- Name what is assessed, who assesses it and the date. Set the next full review.
- List one risk per row as a short sentence: what could go wrong and what would follow.
- Score each risk before any mitigation: pick L and I from 1 to 5 with the scales at the end. The score and the rating appear by themselves.
- Give every risk an owner who can act on it, and write the mitigation as a concrete action.
- Score the risk again as it will be once the mitigation is in place, and set the status.
- Set a review date for each risk. Look at the heat map and the counts by rating, before and after.
- Print the register for the owner to sign and share it with the people named in it.
Common mistakes
- Scoring almost everything 3 because it feels like the safe middle. The scales exist to force a decision.
- Putting several risks into one row, or mixing a cause and an event. One risk per row keeps the score honest.
- Having no owner. A risk that belongs to "the team" is usually handled by nobody.
- Scoring the residual risk as if the mitigation already works. Score what is in place, and rescore when it is.
- Changing the band limits to make the picture look better. Change them only by agreement and keep them for the next review.
- Reading the score as a measurement. It orders risks; two risks with the same score are not equal in every way.
Steps at a glance
- Fill in
- Check the preview
- Save as PDF, Word or Excel
Country versions
Pick the country you need. Each version uses the wording and layout commonly found there; a version marked “check with local advice” should be read by someone who knows the local rules before it is used.
- International (XX): Written in English, Korean, Japanese, German
Designs
The same form in several designs. The fields and the wording stay the same; only the look changes.
- Compact
- Ledger
- Boxed form
- Plain (black and white)
- Banner
- Classic
- Modern
- Minimal
- Side band
- Warm
- Formal
- Executive
Your details fill it in
Fields that ask for your name, address or company details are filled from My details, so you do not type them again; you can still change any field for one form. Signed in, your details stay in your account; otherwise they stay in this browser only. A passport, identity or social security number is never saved.
Questions
- How are the score and the rating worked out?
- The score is likelihood times impact. The rating comes from three limits you can see and change under "Rating bands": by default medium starts at 5, high at 10 and critical at 15. Change them only by agreement, and keep them the same from one review to the next.
- What is residual risk?
- It is the risk that is left once the mitigation works. You score it a second time ("after"). If the score barely moves, the mitigation is probably not doing much, or the risk is accepted on purpose; set the status to say which.
- Can I use it for health and safety hazards at work?
- You can list them, but many countries require a written workplace risk assessment with their own method and content. This table does not replace that one. Check what your authority asks for and follow it.
- Why does the heat map show numbers and not colours?
- Counts and written ratings can be read on a black-and-white print and by a screen reader. Colour alone would not carry the meaning for everyone.
- How often should the register be reviewed?
- At least once a year and after any major change such as a new client, a new system or an incident. Each risk also has its own review date, so the high ones can be looked at more often.
- Is this form legal, tax or accounting advice?
- No. It is a template: it gives you the usual structure and wording, not advice. Rules differ by country and case, so have someone qualified read anything that matters before you sign, send or file it.
- Which countries and designs does it come in?
- It comes in 1 country versions: International. 12 designs.
A form is a template, not legal, tax or accounting advice. Rules differ by country and case.