A risk register built for weekly use. Probability/impact scoring, named owners, mitigation with real review dates. The one I keep open all week.
Probability and impact scored 1-5 each, auto-calculated severity, conditional formatting that surfaces the top 5 risks at a glance.
Every risk has a named owner, a mitigation plan, and a review date. No more orphan risks sitting on the register that nobody owns.
The five questions to ask before adding a risk, the difference between a risk and an issue, and the weekly review cadence that keeps the register alive.
One purchase, yours to keep. Use it on every program, customize for your team. Works in Excel and Google Sheets.
Almost every risk register I've inherited has the same pattern. Thirty entries, none updated in six months, all owned by "PMO" or "TBD." When the audit happens, someone updates the dates. When the project blows up, someone says "we should have flagged that risk," and it's right there, untouched since kickoff.
The problem isn't the format. It's the missing review rhythm and the missing owner. A risk owned by "the team" is a risk nobody's working.
"A risk without an owner is a worry. A risk without a review date is a journal entry."
This template fixes both. Owner is a required field with a real name on it. Review date forces re-evaluation on a cadence you set. The cheat sheet gives you the script for the weekly 15-minute review that keeps the register honest.
Most templates ship with 5x5 P/I scoring as a vague rubric. The discipline is in the definitions. This template uses:
The risk register is the governance artifact: risks only, scored deeply, reviewed quarterly with a steering committee. The RAID log is the working artifact: Risks, Assumptions, Issues, Dependencies in one place, scored simply, reviewed weekly with the program team.
Most enterprise programs run both. The RAID log is where you do the actual work, flagging, mitigating, escalating, and the risk register is where the top risks live with deeper documentation for audit and governance. They're not competing tools. They're different cadences serving different audiences.