A risk register built for weekly use. Probability/impact scoring, named owners, mitigation with real review dates. The one I keep open all week.
Probability and impact scored 1-5 each, auto-calculated severity, conditional formatting that surfaces the top 5 risks at a glance.
Every risk has a named owner, a mitigation plan, and a review date. No more orphan risks sitting on the register that nobody owns.
The five questions to ask before adding a risk, the difference between a risk and an issue, and the weekly review cadence that keeps the register alive.
One purchase, yours to keep. Use it on every program, customize for your team. Works in Excel and Google Sheets.
Almost every risk register I've inherited has the same pattern. Thirty entries, none updated in six months, all owned by "PMO" or "TBD." When the audit happens, someone updates the dates. When the project blows up, someone says "we should have flagged that risk," and it's right there, untouched since kickoff.
The problem isn't the format. It's the missing review rhythm and the missing owner. A risk owned by "the team" is a risk nobody's working.
"A risk without an owner is a worry. A risk without a review date is a journal entry."
This template fixes both. Owner is a required field with a real name on it. Review date forces re-evaluation on a cadence you set. The cheat sheet gives you the script for the weekly 15-minute review that keeps the register honest.
Most templates ship with 5x5 P/I scoring as a vague rubric. The discipline is in the definitions. This template uses:
The risk register is the governance artifact: risks only, scored deeply, reviewed quarterly with a steering committee. The RAID log is the working artifact: Risks, Assumptions, Issues, Dependencies in one place, scored simply, reviewed weekly with the program team.
Most enterprise programs run both. The RAID log is where you do the actual work, flagging, mitigating, escalating, and the risk register is where the top risks live with deeper documentation for audit and governance. They're not competing tools. They're different cadences serving different audiences.
Cadence and audience. A RAID log is your weekly working tool, Risks, Assumptions, Issues, Dependencies in one place, simple scoring, reviewed by the team. A risk register is your quarterly governance tool, risks only, deeper P/I scoring, reviewed by the steering committee. Most programs need both.
5×5 (probability × impact), with severity auto-calculated. Probability is anchored to time (1 = next year, 5 = this month). Impact is anchored to delivery, scope, or financial exposure. The cheat sheet has the full rubric.
Top risks weekly (15-min review with the team, same cadence as the RAID log). Full register quarterly with the steering committee or program board. The cheat sheet has both rhythms.
Both. The template is .xlsx and opens cleanly in Google Sheets. Conditional formatting carries over.
The register is the quarterly governance artifact. The weekly working log is the thing you open first, and the lite version is free. There is also a free browser version if you would rather not open a spreadsheet.