Every project and business faces risks: delays, cost increases, accidents, system failures, staff turnover, supplier problems and natural events. Most of these can be reduced if they are identified early and someone is responsible for managing them. A risk management plan, built around a simple risk register, gives you a structured way to list risks, score them, decide how to respond and track progress.
Our free risk management plan template for Excel includes a ready-made risk register with automatic scoring. Enter likelihood and impact from 1 to 5, and the template calculates the risk score and colour-codes it as High, Medium or Low. Each risk has a response type, mitigation actions, an owner and a status. A scoring guide below the table keeps ratings consistent. The sample shows eight risks for a warehouse expansion project. Preview it below and download the XLSX.
Download the free risk management plan template
The template works in Microsoft Excel, Google Sheets and LibreOffice Calc. It is a practical example, not professional risk, insurance or safety advice; adapt it to your own situation and consult qualified advisers for specialist risks.
What is a risk management plan?
A risk management plan describes how an organization identifies, assesses, responds to and monitors risks for a project or for the business as a whole. Its central tool is the risk register: a table of risks with their likelihood, impact, score, response and owner. The plan also defines how often risks are reviewed and who makes decisions when a risk becomes an issue.
What the template includes
- Project or business name, risk owner and review frequency.
- A risk ID for each entry.
- Risk description and category.
- Likelihood and impact on a 1 to 5 scale.
- Automatic risk score (likelihood × impact).
- Automatic High, Medium and Low rating with colour coding.
- Response type: avoid, reduce, transfer or accept.
- Mitigation actions, owner and status.
- A scoring guide with definitions for each level.
How to build a risk register
- Gather the project team or managers for a short risk workshop.
- Brainstorm what could go wrong, by category: schedule, cost, safety, operations, people, technology, compliance and external events.
- Write each risk as a clear statement of cause and effect.
- Score the likelihood from 1 (rare) to 5 (almost certain).
- Score the impact from 1 (minimal) to 5 (severe).
- Let the template calculate the score and rating.
- Choose a response for each risk.
- Write specific mitigation actions.
- Assign an owner for every risk.
- Review and update the register at least monthly.
Understanding the risk score
The risk score is likelihood multiplied by impact, giving a number from 1 to 25. The template rates scores of 15 or more as High (red), 8 to 14 as Medium (amber) and 7 or less as Low (green). In the sample, budget overrun from rising material prices scores 4 × 4 = 16 and is rated High, so it gets the most attention. Construction delays score 12 (Medium), while flooding scores only 5 because it is rare, even though its impact would be severe. You can change the thresholds in the rating formula to suit your organization.
The four risk responses
Avoid
Change the plan to remove the risk entirely, for example by not using a dangerous process or by choosing a different site.
Reduce
Take actions that lower the likelihood or impact, such as backups, training, inspections or contingency budgets. This is the most common response.
Transfer
Pass the financial impact to another party through insurance, contracts or outsourcing. The risk still exists, but someone else bears the cost.
Accept
For low risks, or risks that cost more to manage than they would cause, accept them and monitor. Have a fallback plan in case they happen.
Writing good risk descriptions
A vague risk such as "budget" is hard to manage. A good description names the cause and the effect: "Material price rises cause a budget overrun". This helps the team choose the right actions. Avoid listing issues that have already happened as risks; those belong in an issue log and need immediate action.
Common risk categories
- Schedule: delays from contractors, approvals or suppliers.
- Financial: cost overruns, currency changes, late payments.
- Safety: injuries, fire, hazardous materials.
- Operational: power cuts, equipment failure, supply shortages.
- People: resignations, illness, skill gaps.
- Technology: data loss, cyber-attacks, system outages.
- Compliance: permits, regulations, contracts.
- External: weather, floods, market changes.
Monitoring and reviewing risks
Risks change over time. Review the register at regular meetings, update scores as actions take effect, close risks that are no longer relevant and add new ones as the project develops. Track the status of each risk (Open, Monitoring or Closed) and report the top risks to management. A short, current register is far more useful than a long one that nobody reads.
Sample risk register walkthrough
The sample register covers a warehouse expansion planned for 2027. The highest risk is a budget overrun from rising material prices, scored 4 for likelihood and 4 for impact, giving 16 (High). The finance team reduces it by fixing prices early with suppliers and holding a 10% contingency budget. Construction delays score 12 (Medium) and are managed with a penalty clause in the contract and weekly progress meetings. Workplace injury during fit-out has a lower likelihood but a severe impact, so the response is to avoid it through safety inductions, protective equipment and daily checks.
Other risks include a power outage during go-live, handled with a backup generator and UPS, and data loss during system migration, handled by a full backup and a test migration. Permit delays have been transferred to a licensed consultant and the risk is now closed. Flooding in the monsoon season is rare but severe, so it is transferred to insurance and reduced with raised racking. Each risk has a named owner, so everyone knows who is responsible.
Running a risk workshop
- Invite people from each area: operations, finance, IT, HR, safety and the project team.
- Explain the scoring scale before you start so ratings are consistent.
- Brainstorm risks for 20 to 30 minutes without judging them.
- Group similar risks and remove duplicates.
- Score each risk together and agree on the rating.
- Focus discussion on High and Medium risks.
- Agree responses, actions and owners.
- Set a date for the next review.
Linking risk management to continuity planning
Some risks, such as fire, flood, cyber-attack or long power outages, could stop the business completely. For these, a risk register is not enough on its own. A business continuity plan describes how critical functions will keep running and recover after a major disruption, including emergency contacts, recovery time targets and backup arrangements. Use the risk register to identify which disruptions need a continuity plan.
Reporting risks to management
Senior managers rarely need the full register. Instead, prepare a short summary each month: the number of risks by rating, the top three to five risks with their actions and status, any new risks and any risks that have become issues. Sort the register by score and copy the top rows into your status report. A simple heat map, with likelihood on one axis and impact on the other, is also a quick way to show where the main risks sit.
Risk management checklist
- A named owner for the risk register.
- A consistent 1 to 5 scoring scale.
- Every risk written as a cause and effect.
- A response and specific actions for every Medium and High risk.
- A named owner and due date for every action.
- A monthly review date in the calendar.
- A short summary of top risks for management.
- A link to the business continuity plan for major disruptions.
Keep the register simple enough that people actually use it. Ten well-managed risks are worth more than fifty that are never reviewed.
Frequently asked questions
Is this risk register template free?
Yes. Download and adapt it for any project or business.
Can I use a 3 × 3 scale instead of 5 × 5?
Yes. Change the scale in the scoring guide and adjust the rating thresholds in the formula.
Who should own a risk?
The person best placed to manage it, usually the manager responsible for that area, not necessarily the project manager.
How often should I review the risk register?
At least monthly, and weekly for fast-moving or high-risk projects.
What is the difference between a risk and an issue?
A risk might happen in the future; an issue has already happened and needs action now.
Is this template suitable for health and safety risk assessments?
It can record safety risks, but formal workplace risk assessments may have legal requirements. Follow your local regulations and seek qualified advice.
Can I add a risk heat map?
Yes. Create a 5 × 5 grid with likelihood down the side and impact across the top, and use COUNTIFS to count risks in each cell, then colour the grid red, amber and green.
Related templates
- Meeting minutes templates
- Incident report templates
- Action plan templates
- SWOT analysis template
- Project log template
