Risk Register Maker (Likelihood x Impact Matrix)

About the Risk Register Maker (Likelihood x Impact Matrix)

Keep the risks of a project or a business in one register: for each risk its cause and effect, category and owner, the likelihood and impact on a scale you choose — 3 × 3, 4 × 4 or 5 × 5, with your own names for each level — the controls already in place, the response (avoid, reduce, transfer or share, or accept), the actions with a due date, the likelihood and impact after treatment, the status and the next review date.

The register scores each risk as likelihood × impact, rates it in the bands you set (Low, Medium, High and, on 4 × 4 and 5 × 5, Very high), ranks the risks, draws the heat maps before and after treatment and lists the reviews and actions that are overdue. Start from a template — project, IT, event or small-business operations — and change it to your own situation. The scores are your judgement on your own scale, not probabilities: they rank risks against each other.

Without a pass, the register, the scores, the heat maps, the overdue list and the checks work in full and the register shows as a free preview. A Premium pass unlocks the PDF, the Excel workbook with live score formulas, the CSV, printing and the register as text.

Common uses

• Run the risk register of a project from its kick-off to its closure.
• Review the main risks of a small business every quarter.
• Prepare the risk section of a board pack or a funding application.
• Agree with a client or a sponsor which risks they own and how they are treated.

Likelihood, impact and the score

Each risk gets two judgements on the same scale: how likely it is to happen (likelihood) and how bad it would be if it did (impact). The score is likelihood × impact, so on a 5 × 5 scale it runs from 1 to 25, and the bands turn it into a rating. The levels are words you can agree on — “Possible”, “Major” — rather than numbers you cannot know: the register ranks risks against each other, it does not predict them. Describe what each level means for your organisation (for example the money or the days of delay a “Major” impact stands for) so that everyone scores the same way.

Responses

The four responses are the usual short names for the ways of treating a risk that the UK government’s Orange Book lists, drawing on ISO 31000:

• Avoid: do not start or continue the activity that gives rise to the risk.
• Reduce: change the likelihood or the consequences — controls, safeguards, contingency plans.
• Transfer or share: hand part of the risk to another party, for example through a contract or insurance.
• Accept: keep the risk by an informed decision, and watch it.

The Orange Book also names taking on or increasing a risk to pursue an opportunity; in this register that is a risk you accept, with the reason in its actions. A response comes with actions, an owner and a due date. The likelihood and impact after treatment (the residual risk) show what the actions are expected to achieve.

Heat maps before and after

A heat map puts each open risk in the cell of its likelihood and impact, coloured by the rating of that cell, so the risks that need attention stand out at the top right. The register draws two: before treatment and after treatment, where each risk moves to its residual likelihood and impact. A risk without a residual assessment stays where it is. Closed risks are not drawn.

Reviews and overdue items

Every open risk should have a next review date. The register lists, oldest first, the reviews and actions whose date has passed on this device’s calendar, and the checks name them too. Close a risk when it can no longer happen; it stays in the register as a record, at the end of the list.

The files

• PDF: the register on landscape A4 or US Letter: the counts by rating, both heat maps, the ranked register, the overdue items and the scales.
• Excel: a workbook with the register (scores as live formulas, likelihood × impact, so a changed level re-scores in the spreadsheet), the heat maps and the scales.
• CSV: one row a risk, for any spreadsheet or tracker.
• Print and text: the PDF’s pages sent to a printer, and the register as plain text.
• Backup: the register as a small file you can open again here — your own data, always available.

Limitations

• Scores rank risks on your own scale; they are not probabilities or amounts of money, and two registers with different scales cannot be compared.
• The register does not send reminders: the overdue list follows this device’s date when you open it.
• Up to 150 risks a register and 20 registers in this browser.
• The PDF draws Latin, Cyrillic, Greek and Vietnamese letters; text in other scripts shows as “?” there, and the page says so. The Excel and CSV files keep it.

Privacy

On this device; its files download once

Everything happens in your browser. Your registers are kept in this browser’s storage on this device and are never uploaded.