Risk ID
A short, unique reference such as RSK-001. It lets you link a risk to its treatment, its owner, and any incident, without retyping the full description.
Free template · use it on this page · updated 2026
Risk assessment template
A risk assessment template is a structured form for recording each risk, scoring how likely and how damaging it is, and deciding what to do about it. This one is rendered in full on the page: risk ID, description, category, likelihood and impact, inherent and residual scores, owner, treatment, and status. Copy it as is, or take the editable version with you.
- Fields
- 10 columns
- Scoring
- 5-by-5 matrix
- Aligns to
- ISO 31000 · NIST
- Cost
- Free
01 · What it is
What a risk assessment template is
A risk assessment template is a repeatable form for capturing what could go wrong, scoring how likely and how damaging each risk is, and recording the decision on what to do about it. Completed row by row, it produces a register of named risks with scores, owners, controls, and treatment plans that a board, an auditor, or an insurer can read in one pass.
The structure is not proprietary. It follows the same activity every credible framework describes, identify, analyse, evaluate, treat, and monitor, so a template built this way carries cleanly into ISO 31000, NIST SP 800-30, ISO 27005, or COSO ERM work. It also doubles as a risk assessment form for a single project and, once you keep it current, as a risk register for the whole organization. For the wider context, read what a risk assessment is.
02 · The fields
The fields a good template has
Ten columns cover a working assessment. The two that separate a real template from a static list are the inherent and residual scores, and a named owner on every row.
Risk description
One sentence that names the threat, the vulnerability, and the consequence. Write it so a reader outside the team understands what could go wrong and why it matters.
Category
The risk family: cyber and IT, operational, financial, strategic, compliance, or physical and environmental. Categories let you roll risk up and spot concentrations.
Likelihood (1 to 5)
How probable the risk is over the review window, from 1 (rare) to 5 (almost certain). Score against a written scale so two assessors land on the same number.
Impact (1 to 5)
How damaging the consequence would be, from 1 (insignificant) to 5 (severe). Cover money, downtime, safety, and regulatory or reputational harm.
Inherent score
Likelihood multiplied by impact, from 1 to 25, before controls are credited. It ranks raw exposure so the biggest problems sort to the top.
Owner
One named person accountable for the risk, not a department. A risk without an owner is a risk nobody is treating.
Treatment
The decision and the action: accept, treat, transfer, or avoid, plus the controls that carry it out. This is where the register turns into work.
Residual score
Likelihood multiplied by impact again, after the controls in place are credited. Residual, not inherent, is what you manage day to day.
Status
Where the risk sits now: open, in treatment, monitored, or accepted, with the next review date. It keeps the register current instead of a one-off snapshot.
03 · The template
The risk assessment template, worked through
Six example rows across the common risk categories. The inherent and residual scores are colour-banded so exposure reads at a glance. Copy the columns straight into your own document, or take the editable version below.
| Risk ID | Risk description | Category | Likelihood | Impact | Inherent | Owner | Treatment | Residual | Status |
|---|---|---|---|---|---|---|---|---|---|
| RSK-001 | Phishing leads to stolen staff credentials | Cyber and IT | 4 | 5 | 20Extreme | CISO | Treat: enforce MFA, run quarterly awareness training | 8Medium | In treatment |
| RSK-002 | Critical vendor outage halts order processing | Vendor and third party | 3 | 4 | 12High | Head of Procurement | Treat: contractual SLA, qualify a backup supplier | 6Medium | Monitored |
| RSK-003 | Loss of a key person in the finance team | Operational | 3 | 3 | 9Medium | CFO | Treat: cross-train and document core processes | 6Medium | Open |
| RSK-004 | Non-compliance with the HIPAA Security Rule | Compliance | 2 | 5 | 10High | Compliance Lead | Treat: annual risk analysis, close control gaps | 5Medium | In treatment |
| RSK-005 | Water ingress damages the on-site server room | Physical and environmental | 2 | 4 | 8Medium | Facilities Manager | Transfer: insurance plus verified offsite backups | 4Low | Accepted |
| RSK-006 | Currency volatility erodes overseas margin | Financial | 3 | 3 | 9Medium | Treasurer | Treat: board-approved FX hedging policy | 6Medium | Monitored |
Inherent score is likelihood multiplied by impact before controls. Residual score is the same calculation after the controls in place are credited. The drop between them is the value your controls are adding.
Take it with you
Get the editable template
The template above is free to copy. If you want it as an editable spreadsheet, the free Risk Register Template carries the exact same columns, plus a 5-by-5 scoring key and a guidance tab for scoring consistently across teams. It is delivered through our free resources, with no credit card required.
- Same ten columns as the on-page template
- 5-by-5 likelihood and impact scoring key
- Inherent and residual risk built in
- Guidance tab for consistent scoring
Template
Risk Register Template
RiskWatch · editable · updated 2026
Risk ID and description
Likelihood and impact
Inherent and residual
Owner, treatment, status
04 · How to use it
How to use the template
Five steps take a blank template to a scored, owned register. Run them in order so the work compounds instead of restarting each cycle.
- Step 01
List every risk against an asset or objective
Work through each part of the business and name what could go wrong. Give each risk an ID and a one-sentence description with the threat, the vulnerability, and the consequence.
- Step 02
Score likelihood and impact from 1 to 5
Use the same written scale for every row so the numbers are comparable. Rate how probable the risk is and how damaging it would be if it happened.
- Step 03
Multiply for the inherent score and rank
Likelihood times impact gives a number from 1 to 25. Sort the register by that score so the biggest raw exposures sit at the top before you credit any controls.
- Step 04
Assign an owner and decide the treatment
Give each risk one accountable owner. Choose accept, treat, transfer, or avoid, and record the controls that carry the decision out.
- Step 05
Re-score for residual risk and set a review date
Score likelihood and impact again with the controls credited. The residual score is what you manage. Add a status and a next-review date so the register stays alive.
05 · Scoring
The 5-by-5 risk assessment matrix
The matrix is how the template turns two 1-to-5 scores into a single number and a decision. Rate likelihood, rate impact, and multiply. The colour band tells you what to do. This is the same matrix behind the inherent and residual columns above.
| Likelihood / Impact | 1Insignificant | 2Minor | 3Moderate | 4Major | 5Severe |
|---|---|---|---|---|---|
| 5Almost certain | 5Medium | 10High | 15Extreme | 20Extreme | 25Extreme |
| 4Likely | 4Low | 8Medium | 12High | 16Extreme | 20Extreme |
| 3Possible | 3Low | 6Medium | 9Medium | 12High | 15Extreme |
| 2Unlikely | 2Low | 4Low | 6Medium | 8Medium | 10High |
| 1Rare | 1Low | 2Low | 3Low | 4Low | 5Medium |
Low1 to 4
Accept and monitor. Manage through routine procedures.
Medium5 to 9
Treat where it pays. Assign an owner and a review date.
High10 to 14
Treatment required. Escalate to management and track to target.
Extreme15 to 25
Act now. Senior leadership attention until it is reduced.
Document the scale in writing so "likely" and "major" mean the same thing to every assessor. A 3-by-3 matrix works for a small register, while the 5-by-5 gives a larger program the resolution it needs. For a deeper walkthrough, see the risk assessment matrix guide.
06 · When to graduate
When a spreadsheet stops being enough
A template in a spreadsheet is the right place to start, and it is where most risk programs begin. It tends to break past roughly fifty risks or controls, or the moment a second framework, a third assessor, or a fourth business unit joins in.
Where the spreadsheet strains
- Version conflicts once several owners edit at once
- No audit trail of who changed a score, or when
- Manual roll-ups across departments and sites
- No automated review reminders, so the register goes stale
- Re-keying the same control for each new framework
What the platform adds
- One register with owners, dates, and a full audit trail
- Cross-mapping so one control answers many frameworks
- 40+ frameworks and 6 assessment types on one tenant
- An Audit Register that produces the evidence package on demand
- Automated review cycles and roll-ups across the organization
RiskWatch has run this pattern since 1993, holds a 4.7 rating on G2, and reaches a live register in a 30-day median implementation. When the template becomes a program, move the same columns into risk management software and keep going from where the spreadsheet left off.
07 · Frequently asked
Risk assessment template FAQ
The questions buyers ask most often about the template, the fields, and the scoring.
What is a risk assessment template?
A risk assessment template is a structured form for recording each risk your organization faces and deciding what to do about it. A good one captures, per risk, a unique ID, a plain-language description, a category, a likelihood score, an impact score, the inherent score (likelihood multiplied by impact), the owner, the treatment decision and controls, the residual score after controls, and the status. It turns a scattered set of concerns into a single, comparable register that a board or an auditor can read. The template on this page is free to copy and use, and it follows the same structure recognized by ISO 31000, NIST SP 800-30, and ISO 27005.
What should a risk assessment template include?
At a minimum: a risk ID, a risk description, a category, likelihood and impact rated on a consistent scale (usually 1 to 5), an inherent score, an owner, a treatment decision with the controls behind it, a residual score after controls, and a status with a next-review date. The two features that separate a working template from a static list are the two scores, inherent and residual, and a named owner on every row. Without inherent and residual you cannot show whether your controls are actually reducing exposure, and without an owner a risk is documented but not managed.
What is the difference between a risk assessment form and a risk register?
They are two views of the same data. A risk assessment form (or template) is the structure you use to capture and score each risk during an assessment. A risk register is the living record that the completed forms roll up into, kept current between assessments as scores change, controls are added, and reviews fall due. In practice the template becomes the register once you start maintaining it. That is why the editable version offered here is the Risk Register Template: the same columns, built to keep going after the first pass.
How do you score risk in the template?
Rate likelihood from 1 (rare) to 5 (almost certain) and impact from 1 (insignificant) to 5 (severe), then multiply the two for a score from 1 to 25. Colour bands turn the number into an action: low (1 to 4) accept and monitor, medium (5 to 9) treat where it pays, high (10 to 14) treatment required, extreme (15 to 25) act now. Score each risk twice, once before controls for the inherent score and once after controls for the residual score. Document your scale in writing so two assessors give the same risk the same number.
Is this risk assessment template free?
Yes. The full template is rendered on this page, with a worked example and the scoring matrix, and it is free to copy into your own document with no sign-up. If you want the editable spreadsheet version with the same columns and a scoring key, the free Risk Register Template is available through our resources library, and no credit card is required.
When should you move from a spreadsheet template to a platform?
A spreadsheet works until the program adds its second framework, its third assessor, or its fourth business unit. Past roughly fifty risks or controls, the cost of keeping spreadsheets in sync, chasing owners, and rebuilding the board pack by hand starts to exceed the cost of a platform. The signals are familiar: version conflicts across owners, no audit trail of who changed what, manual roll-ups across sites, and no automated review reminders. That is the point to move the same register into a system that assigns owners, cross-maps controls to your frameworks, and produces the audit package on demand.
What is inherent risk versus residual risk in the template?
Inherent risk is the exposure before any controls are credited, the raw threat against the asset. Residual risk is the exposure that remains after the controls currently in place are counted. The gap between the two is the work your existing controls are doing, and the gap between residual and your target is the work the planned treatment still owes. Recording both is what lets you prove that a control is earning its place, rather than assuming it is.
From template to a living register
Move the same columns into a live risk register in days.
Start a free trial and the template becomes a working register: owners, review cycles, cross-mapped controls across 40+ frameworks, and an audit-ready package on demand. No credit card required.
No credit card required · 30-day free trial · Cancel anytime