See a complete risk register example with inherent and residual scores, linked controls, owners and triggers. Copy the structure or import it into Cilver.
What is a risk register?
A risk register is the single list of everything that could knock your project or organisation off course, with a score, an owner and a plan for each item. It is the working record of your risk management process, not a one-off workshop output.
Most risk register examples online stop at a description and a red, amber or green cell. That is enough to fill a slide, but not enough to manage anything. Below is a complete, worked example from a mid-sized construction and IT programme, showing the columns we would expect a risk manager to defend in front of a board.
You can copy the structure into Excel, or bring it straight into Cilver's risk register software and keep it live.
The columns a useful risk register needs
A register that only scores risk once will always look better than reality. These twelve fields are the minimum for a register that shows both exposure and whether your controls are working.
| Field | What it captures | Why it matters |
|---|---|---|
| ID | Unique reference, e.g. R-014 | Lets actions, minutes and reports point to one risk |
| Risk statement | Cause, event and effect in one sentence | Stops vague entries like "budget risk" |
| Category | Commercial, schedule, technical, cyber, people | Drives roll-up reporting |
| Owner | One named person | Shared ownership means no ownership |
| Inherent likelihood x impact | Score before any controls, on a 5x5 | Shows how bad it could be |
| Controls | Existing measures and their effectiveness | Explains the gap between inherent and residual |
| Residual likelihood x impact | Score after current controls | The exposure you actually carry today |
| Target score | Where you want residual to land | Tells you whether more action is needed |
| Response | Avoid, reduce, transfer or accept | Forces a decision |
| Actions | Owner and due date for each extra mitigation | Turns the register into work |
| Trigger | Early warning sign that the risk is materialising | Lets you act before it becomes an issue |
| Last reviewed | Date of last review | Exposes stale entries |
Risk register example: six real entries
The example below covers a 14-month office fit-out and IT migration. Scores use a 5x5 matrix (likelihood x impact, so 25 is the maximum). Treat the content as illustrative; the structure is what to copy.
| ID | Risk statement | Category | Owner | Inherent (L x I) | Key controls | Residual (L x I) | Target | Response | Next action | Trigger |
|---|---|---|---|---|---|---|---|---|---|---|
| R-001 | Because the main contractor is resource-constrained, fit-out could slip past the lease exit date, causing double rent of about $85k a month | Schedule | Project Director | 4 x 5 = 20 | Weekly progress reviews; LDs in contract (partly effective) | 3 x 5 = 15 | 8 | Reduce | Agree recovery programme with contractor by 15 Nov | Two consecutive weeks below 90% planned progress |
| R-002 | Because long-lead switchgear is single-sourced, a supplier delay could stop power-on, delaying handover by 6 to 8 weeks | Supply chain | Procurement Lead | 3 x 4 = 12 | Early order placed; monthly supplier updates (effective) | 2 x 4 = 8 | 6 | Reduce | Identify second supplier and get a quote | Supplier misses factory test date |
| R-003 | Because legacy file shares hold unclassified data, migration could expose confidential files to all staff, causing a reportable data breach | Cyber | IT Security Manager | 3 x 5 = 15 | DLP scanning; permission audit before cutover (partly effective) | 2 x 5 = 10 | 5 | Reduce | Complete permission audit on remaining 40% of shares | Any audit finding of "Everyone" access on HR or finance folders |
| R-004 | Because steel prices are volatile, material costs could rise above the 5% contingency, causing budget overrun | Commercial | Commercial Manager | 3 x 3 = 9 | Fixed-price package for 70% of steel (effective) | 2 x 3 = 6 | 6 | Accept | None. Monitor monthly | Index rises more than 8% in a quarter |
| R-005 | Because only one engineer knows the network design, their absence could stall cutover, delaying go-live by 2 weeks | People | IT Manager | 2 x 4 = 8 | None in place | 2 x 4 = 8 | 4 | Reduce | Document design and pair a second engineer by 30 Nov | Leave request or resignation from key engineer |
| R-006 | Because the building is in a flood-risk zone, a storm event could damage ground-floor plant, causing outage and repair cost | Operational | Facilities Manager | 1 x 5 = 5 | Plant raised 600mm; building insurance (effective) | 1 x 3 = 3 | 3 | Transfer | None | Severe weather warning for the area |
How to read this example
The useful information sits in the gaps between columns, not in any single score.
- Inherent vs residual tells you if controls are earning their keep. R-001 only drops from 20 to 15 because its controls are partly effective. That is the risk the board should hear about first. R-005 has no controls at all, so inherent and residual are the same, which is a warning sign on its own.
- Residual vs target tells you whether to act. R-004 already sits on its target of 6, so the right response is accept and monitor. Spending more effort there would be waste. R-003 is still double its target, so the open action matters.
- Triggers turn a register into an early warning system. Every trigger in the example is observable: a progress percentage, a missed test date, an audit finding. If you cannot see a trigger happen, rewrite it.
- One owner per row. Each risk names a role, not a team. When the trigger fires, there is no debate about who moves.
Five mistakes that make a risk register useless
- Listing issues as risks. "Contractor is behind schedule" has already happened. It belongs in the issue log; the risk is what that delay could cause next.
- Scoring once. A single score hides whether controls work. Always record inherent and residual.
- Controls with no effectiveness rating. A control that exists on paper but is never tested should not cut a score from 20 to 6.
- No review rhythm. Registers go stale the week after the workshop. Review high risks monthly and the rest quarterly, and record the date each time. More on that in why risk registers go stale.
- Overwriting history. If last month's score is typed over, you can never show the board how exposure moved. Keep a snapshot each reporting period.
Risk register template or risk register software?
An Excel risk register template is fine for one project and one owner. It breaks down when several people edit it, when you need history, or when the board wants to see how exposure moved since last quarter.
That is the point where teams move to dedicated risk register software. Cilver imports the spreadsheet you already have, keeps inherent and residual scores tied to rated controls, reminds owners before reviews slip, and snapshots every reporting period for board-ready reporting or Power BI dashboards.
Bring your current register and see it live in an afternoon. Start a 14-day free trial, no credit card needed.
FAQ
What should a risk register include?
At minimum: ID, risk statement, category, owner, inherent score, controls, residual score, response, actions, trigger and last review date.
What is the difference between a risk register and an issue log?
A risk register tracks things that might happen. An issue log tracks things that already have. When a risk materialises, close it in the register and open an issue.
How often should a risk register be reviewed?
High and critical risks monthly, the rest at least quarterly, and immediately when a trigger fires.
What is the difference between inherent and residual risk?
Inherent risk is the exposure before any controls. Residual risk is what remains after the controls you have in place today.
Can I use a risk register in Excel?
Yes, for a single project. Most teams outgrow it once they need multiple editors, audit history or period-on-period reporting.