Risk Register Matrix
Prioritize risks using likelihood-impact scoring with action plans. Enter values for instant results with step-by-step formulas.
Worked Examples
Example 1: Software Project
Problem:Project has 8 identified risks including key developer departure (L:5, I:9), scope creep (L:8, I:6), and API deprecation (L:3, I:8).
Solution:Developer departure: score 45 (High). Mitigation: knowledge transfer, backup resources. Scope creep: score 48 (High). Mitigation: change control process. API: score 24 (Medium), monitor vendor announcements.
Result:8 risks | 2 critical | 3 high | Mitigation plans for top 5
Example 2: Business Ops
Problem:5 organizational risks: economic downturn (L:7, I:6), supplier failure (L:4, I:9), cybersecurity (L:6, I:10), talent retention (L:5, I:7).
Solution:Cybersecurity: score 60 (Critical). Immediate action: IR plan, insurance. Supplier failure: score 36 (High). Mitigation: diversify suppliers. Talent: score 35 (High). Retention initiatives.
Result:5 risks | 1 critical | 3 high | Board-level visibility
Example 3: Startup Growth
Problem:High-growth startup tracking 6 risks including runway (L:4, I:10), scaling challenges (L:8, I:7), competitive threats (L:7, I:6).
Solution:Runway: score 40 but proximity 2 months = urgent. Immediate action: fundraise or extend runway. Scaling: score 56, plan infrastructure. Competition: monitor actively.
Result:6 risks | Runway most urgent | Mitigation roadmap created
Frequently Asked Questions
What is a risk register?
A risk register is a project management tool that documents identified risks, their likelihood, impact, owner, and mitigation strategies. It's a living document used to systematically track and manage risks throughout a project or organization.
How do you calculate risk score?
Risk Score = Likelihood × Impact. Both are typically rated 1-10. A likelihood 5 event with impact 8 scores 40. Scores above 50 are typically classified as high or critical risks requiring active management.
What is risk proximity?
Proximity (or imminence) is how soon the risk might materialize. A high-score risk 12 months away may be lower priority than a medium-score risk next month. Proximity adds urgency dimension to prioritization.
How often should risk registers be updated?
At minimum: monthly for projects, quarterly for organizations. After significant events or changes, update immediately. Risk registers that aren't maintained become obsolete and useless.