A risk register is the backbone of any risk program. Here's how to build one that people actually use — from identifying risks to scoring them and keeping it alive.
A good risk register turns a vague sense of "things that could go wrong" into a structured, prioritised, owned list you can act on. A bad one is a spreadsheet nobody has opened since the last audit. The difference is rarely the tool — it's the method. This guide walks through the eight steps that make a register useful.
Before listing a single risk, decide what the register covers — the whole organisation, one business unit, or a project — and agree on a consistent set of fields. At minimum you want: a unique ID, a title, a description, a category, an owner, inherent scores, existing controls, residual scores, a response, treatment actions, and status. Agreeing this upfront prevents the register drifting into inconsistent free text.
If you'd rather not build the structure yourself, start from our free 5×5 risk register template — it has these fields, drop-downs and automatic scoring built in.
Gather risks from the people closest to the work: interviews, workshops, incident history and past audits. Write each as a clear cause-and-effect statement — not "cyber", but "ransomware encrypts core systems, halting operations for days". A well-written risk is specific enough that two people would score it the same way.
Group each risk under a category — strategic, financial, operational, compliance, technology, and so on. Categories make the register searchable and let you roll risk up by theme. Then give every risk a single accountable owner. Shared ownership is no ownership; one named person keeps risks from being orphaned.
Rate each risk's likelihood and impact on a 1–5 scale before any controls — this is inherent risk. Multiply the two for a score of 1–25 and plot it on a 5×5 heat map. Scoring inherent risk first shows how much each risk would matter if you did nothing, which is the baseline everything else is measured against.
List the controls already in place for each risk, and rate their effectiveness honestly. A control that exists but doesn't work should be rated ineffective — pretending otherwise is how organisations get surprised. This step is where most spreadsheet registers get vague; be disciplined about it.
Now re-score likelihood and impact with those controls accounted for. This is residual risk — your real, current exposure. The gap between inherent and residual tells you how much work your controls are doing. If residual risk still sits above your risk appetite, you have more to do.
For each risk above appetite, choose a response: avoid, reduce, share or accept. "Reduce" usually means a treatment action — strengthen a control, add a new one — with an owner and a due date. Capturing the action in the register, not in a separate to-do list, is what keeps risk and remediation connected.
A register is not a one-time document. Re-score risks as conditions and controls change, close actions as they complete, and review the whole register on a regular cadence with your risk committee. This is the step spreadsheets make hardest — nothing reminds anyone — and it's exactly where dedicated software earns its keep.
A template will take you a long way. It starts to strain once several people contribute (version chaos), when follow-up depends on someone remembering, and when every board pack means rebuilding charts by hand. That's the moment to consider purpose-built risk register software — the same register, but with automatic alerts, an audit trail, permissions and one-click reports. See our honest spreadsheet vs ERM software comparison to judge where you are.
Our 5×5 Excel risk register has automatic scoring, COSO-aligned categories and a heat map — no sign-up.
Get the template See it as software
Rukn ERM