Risk registers
Risk Register Template: Fields, Ownership, Scoring and Escalation
Build a useful risk register with clear statements, accountable ownership, consistent scoring and actionable escalation.
A risk register should help people decide, not simply prove that risks were recorded. The strongest registers make ownership, assessment, treatment and review easy to understand.
The right fields depend on the operating model, but a practical core works across enterprise, operational, IT and cyber risk.
Write a complete risk statement
Describe the uncertain event or condition, its cause and its consequence. Avoid one-word labels such as cyber, supplier or staffing.
A useful structure is: Because of a cause, an uncertain event may occur, leading to a consequence for an objective, service or stakeholder.
- Cause or source
- Uncertain event
- Consequence
- Affected objective, service or process
Assign accountable ownership
Name one accountable risk owner who has authority to understand and influence the response. Contributors may support updates, but shared accountability often becomes no accountability.
Record the organizational area and review date. Use a visible exception when ownership is unresolved.
Use consistent categories and status values
Categories support aggregation only when people apply them consistently. Publish definitions and examples, and limit the list to values that support decisions.
Status should describe the working state, such as draft, active, under review or archived. Do not mix workflow status with risk severity.
Separate inherent and residual risk
Inherent risk reflects exposure before considering controls. Residual risk reflects exposure after considering the relevant controls and their current effectiveness.
Record likelihood and impact separately, then calculate a score or rating using an agreed matrix. A number alone is not the decision. Document the scale and what each band means.
Connect controls and treatment
List the important controls that change likelihood or impact. Record ownership and how effectiveness is assessed.
If residual exposure is outside appetite or otherwise unacceptable, document the response: avoid, reduce, transfer or accept. Connect action owners and dates to that decision.
Work through one risk before filling the register
A risk register becomes useful when someone can follow a risk through its assessment, controls and next decision. Start with one record and check whether those relationships are clear.
The example below expands the fictional supplier-service scenario already included in Parapet's Excel risk register template. It is an illustration, not a customer case study or an assessment of any real organisation. The scores are sample judgements, not evidence that a control has reduced risk.
Describe the event and the consequence
The example risk is R-001, "Loss of critical service availability". A single supplier supports a critical component. Its service may become unavailable beyond the organisation's recovery tolerance, leaving customers unable to use a critical service and potentially affecting obligations.
Keep the cause, uncertain event and consequence in their separate workbook fields. "Supplier risk" alone would not tell the owner which failure to consider or which response to review.
The sample record assigns the Service Owner, categorises the risk as Operational and marks it Active. For real use, identify the accountable person and replace the example dates. The review should answer a specific question: are the arrangements for an extended supplier interruption adequate, or does someone need to approve further treatment?
Make the scoring assumptions visible
The workbook's sample likelihood and impact scale runs from 1 to 5.
| Assessment | Likelihood | Impact | Calculated score | Supplied rating |
|---|---|---|---|---|
| Inherent | 4 | 5 | 20 | Extreme |
| Residual | 3 | 4 | 12 | High |
These are two assessments of the same risk before and after considering relevant controls, not a measured before-and-after result or a percentage reduction.
Before using either assessment, record why those likelihood and impact values fit the service and the period being assessed. What interruption is credible? Which customers or obligations would be affected? What recovery capability is supported by evidence?
Use the organisation's agreed definitions and appetite rules. The template's sample rating bands and appetite threshold are built into its formulas; changing the lookup descriptions alone does not change those calculations.
A lower score is not, by itself, a reason to accept the risk. The supplied example still shows "Review required" and the response "Reduce".
Check the control evidence
R-001 refers to C-001 in the Controls sheet. This is the "Supplier continuity review": the Service Owner reviews continuity evidence annually and after material service changes.
The sample control records design effectiveness as Effective and operating effectiveness as Partially effective, with "Supplier review record" as its evidence or source. That combination calls for a question, not an automatic conclusion: which part of the continuity arrangement is supported, and what remains untested or unreliable?
The workbook records these judgements. It does not calculate the residual likelihood or impact from the control effectiveness fields. The owner must assess the residual values and explain the basis for them.
Keep the unfinished action connected
R-001 also refers to A-001 in the Actions sheet: "Confirm alternative service arrangements and test the failover decision path." The example assigns it to the Service Owner, with High priority and status In progress. The action links back to R-001.
An in-progress action is not an implemented control. Do not lower the current residual assessment merely because this work is planned. Complete the work, review the resulting evidence and then decide whether reassessment is justified.
The workbook calculates timing from the due date and action status. That timing is a prompt to review the action; it does not prove that the work or its outcome is satisfactory.
Finish with the decision needed
At the next review, follow the three IDs together: R-001, C-001 and A-001. Confirm who owns the risk, what the existing continuity review demonstrates, what the unfinished action is meant to establish and who must decide what happens next.
If the available evidence does not justify the residual assessment, record that uncertainty and review the assessment. If the exposure requires escalation under the organisation's rules, identify the decision and decision maker. Adding more rows will not resolve an unanswered treatment decision.
Try this with one risk in the Parapet Excel risk register template. Replace the fictional records and sample dates with the context, evidence, ownership and review rules appropriate to your organisation.
Define review and escalation
Set a review frequency appropriate to volatility and significance. Event-driven review may be needed after incidents, major changes, control failures or new obligations.
Escalation rules should identify thresholds, overdue treatment, appetite exceptions and material changes. State who receives the escalation and what decision is expected.
Download the template
The free Parapet Excel risk register template includes scoring guidance, validation values, a control register and an action tracker.
When several teams need controlled access and consolidated reporting, review Parapet risk register software as the next step beyond spreadsheets.
Test the register with one decision
Choose a risk due for review and ask whether the register shows the decision needed, accountable owner, current exposure, controls that materially influence it and unfinished treatment. Remove any field that does not help that decision or a defined reporting need.
Use consistent risk scoring and escalation when a register must support decisions, not just record exposure. For a broader platform decision, compare the integrated risk management software approach with the IRM software evaluation checklist.