Risk register template: five columns that catch problems early
A risk register template with five columns: risk, likelihood, impact, owner and response. With a 1–3 scoring scale and a weekly review habit.
- A risk register lists what could derail a project, scored on likelihood and impact, with one owner and one decided response per risk.
- Five columns are enough: risk, likelihood, impact, owner and response; everything beyond these is decoration.
- Score on a 1–3 scale and multiply; the number is for ordering attention, not for predicting the future.
- Responses are avoid, reduce, transfer or accept, and every active response should become a task with a date.
- Attach the review to a meeting that already exists, such as the weekly status update, and date every change.
Every project has risks, and most teams discuss them exactly once: at kickoff, with nodding. A risk register is the cheap habit that keeps those risks visible after the nodding stops.
Short answer: A risk register template needs five columns: the risk, its likelihood, its impact, an owner, and the response. Score likelihood and impact on a simple 1–3 scale, give every risk one named owner, and review the register at a fixed moment, for example in the weekly status update. Five well-kept rows beat fifty stale ones.
What is a risk register?
A risk register is a list of the things that could derail a project, with a score for how likely and how damaging each one is, a person who watches it, and a decision about what to do. It turns "we should keep an eye on that" into a row someone actually owns.
The register does not predict the future. Its job is smaller: making sure no risk is discovered twice, and that the expensive ones were decided on while they were still cheap.
What goes in a risk register template?
Five columns carry the whole thing. Everything beyond these is decoration.
- Risk. One sentence, written as an event: "The supplier delivers the test batch late." Vague entries like "timeline risk" cannot be owned or scored.
- Likelihood. How probable it is, scored 1–3. Low, medium, high is enough; percentages suggest a precision nobody has.
- Impact. How bad it is if it happens, also 1–3. Score the project effect, not the discomfort.
- Owner. One name. The owner does not fix the risk alone; they are the person who notices it moving and raises it.
- Response. The decision: what you do now, or what you will do if it fires. "Watching" is a valid response if it is a deliberate one.
How do you score likelihood and impact?
Multiply the two scores and you get a priority between 1 and 9. The point of the number is not accuracy, it is ordering: the 9s get attention this week, the 1s get a glance a month from now.
A simple 1–3 scale
|Score|Likelihood|Impact|
|1|Could happen, probably won't|Annoying, absorbed within a week|
|2|As likely as not|Costs real time or money|
|3|Expect it unless something changes|Threatens the deadline or the goal|
Score in the open, with the team, and argue about the 2s. The argument is where the register earns its keep: it surfaces what people privately believe about the project.
Which responses can you choose?
- Avoid. Change the plan so the risk cannot occur, for example by cutting the dependency that carries it.
- Reduce. Act now to lower likelihood or impact: a second supplier, an earlier test, a buffer in the schedule.
- Transfer. Move it to someone built for it, through insurance, a fixed-price contract, or an SLA.
- Accept. Decide the mitigation costs more than the risk, write that down, and set the trigger that reopens the decision.
Every response that involves action should end up as a task with a date, not as a comment in the register. A register full of responses nobody scheduled is a diary, not a tool.
How do you keep a risk register alive?
Registers die of ceremony: too many columns, reviewed too rarely. Keep five columns and attach the review to a meeting that already exists. The natural host is the weekly status update, where the top risks are one of the five fields anyway; a status report that names its risks is a risk register review in disguise. Close rows that no longer apply, and date every change, so the register tells you when the team last actually looked.
Where should a risk register live?
In SketchMind, an AI whiteboard, the register can sit on the same board as the work it protects. A table frame holds the five columns, and the board is shared by link, so the register is open during the meeting instead of attached to its invite. Describe the project in Create with AI, up to 3,000 characters with an optional PDF of up to 5 MB as context, and work through the risks with the team on the result.
Risk thinking is also built into Plans, SketchMind's planning tool: when the AI drafts a plan from your description, steps come with risks and a "What we do about it" line, so mitigation starts as part of the plan instead of as a separate document. Each step lands on its owner's agenda, which is where responses stop being intentions. For the follow-up actions a register produces, a Checklist frame takes about 15 seconds to generate from a description.
Last updated: October 29, 2026. Checked against the current SketchMind app.
What is the difference between a risk register and a risk matrix?
The matrix is the scoring picture: likelihood by impact. The register is the living list of risks with owners and responses. The matrix helps you fill the register, not replace it.
How many risks should a register hold?
As many as the team actually reviews. For most projects that is five to ten open rows; close what no longer applies.
How often should you review a risk register?
At a fixed, existing moment, weekly for active projects. A register that is only read at kickoff is a diary.
What is a good likelihood and impact scale?
1–3 for both. Percentages suggest a precision nobody has; low, medium and high are enough to order the list.
Can SketchMind help with a risk register?
A table frame holds the five columns on the board where the work happens, and when the AI in Plans drafts a plan from your description, steps come with risks and a "What we do about it" line.
