Free Risk Register Template for Excel & Google Sheets

Running a small business in the UK often means wearing many hats, and managing risks is certainly one of them. A risk register is an essential tool for keeping tabs on potential pitfalls. It’s not just a one-off risk assessment where you identify and evaluate risks—it’s a living document that tracks each risk with a score, a named owner, and a clear plan of action, all set against a review date. In this guide, we’ll walk you through setting up a risk register in both Excel and Google Sheets. You’ll get a free risk register template with precise columns and formulas to ensure you can have a working register in under an hour.

Whether you’re a business owner or a project lead, understanding how to use a risk register can not only help you identify risks but also prepare you to tackle them effectively. Follow our step-by-step instructions, and you’ll soon have a practical tool in your hands to help safeguard your business operations.

Understanding Risk Registers

What is a Risk Register?

A risk register is a vital management tool that helps you track potential threats to your business. Think of it as a living document that evolves with your enterprise. The register includes a risk identification number, a description, a named owner responsible for oversight, and an assessment of each risk. Crucially, it also records the actions you’re taking to mitigate these risks and when you’ll review them next. By maintaining this document, you ensure your business remains vigilant and prepared.

Risk Register vs Risk Assessment

While both are essential, a risk register is not the same as a risk assessment. Think of a risk assessment as the activity where you identify and evaluate the risks your business faces. It’s about looking at potential hazards, estimating the likelihood and impact of those hazards, and deciding on actions to control them. For example, if you're running a café, a risk assessment might identify the risk of a fire in the kitchen. On the other hand, a risk register records these risks and is updated regularly. Continuing with our café example, your risk register would list "fire in the kitchen", assign an owner—perhaps the head chef—and note the current controls, like fire extinguishers and regular safety checks, along with any further actions, such as staff training. In short, a risk register is your ongoing record to track, manage, and review risks over time, ensuring you don't just identify risks but actively work to mitigate them. This proactive approach keeps the register from becoming just another forgotten document. Regular reviews and updates help integrate risk management into your daily operations, turning potential threats into manageable challenges.

Essential Columns for Your Risk Register

Minimum Columns

For a risk register to be effective, it's crucial to include the right information. According to UK public-sector guidance, your register should at least contain the following columns:

Column	Description	Example
Risk ID	A unique identifier for each risk.	R-001
Risk Owner	The individual responsible for managing the risk.	John Smith
Risk Description	A clear and concise description of the risk.	Loss of a major client
Likelihood	The probability of the risk occurring (scale of 1-5).	4
Impact	The potential impact if the risk occurs (scale of 1-5).	4
Score	The calculated risk score (Likelihood x Impact).	16
Mitigating Actions	Steps taken to reduce the risk.	Sign a longer contract
Next Review Date	When the risk will be next assessed.	2024-01-01

These columns establish a basic framework, ensuring each risk is clearly identified, assessed, and assigned to a responsible person.

Extra Columns for Small Business

Small businesses can benefit from additional columns that offer a more comprehensive view of their risks. Consider adding these:

• Date Logged: When the risk was first identified.
• Category: Classify risks (e.g., Financial, Operational).
• Existing Controls: Current measures in place to address the risk.
• Further Actions: Additional measures planned.
• Action Owner: The person responsible for implementing further actions.
• Status: The current state of the risk (e.g., Open, Closed).
• Residual Scores: Likelihood, Impact, and Score after actions are taken.
• Flags: Indicate overdue actions or reviews.

For example, if a small business faces a risk like a phishing attack, they might log it as "R-002" with a "High" score, noting existing controls like basic firewalls and further actions such as staff training.

These added columns not only provide a deeper insight into managing risks but also help in prioritising them based on their potential impact, using resources like our

5×5 Risk Matrix Template Excel: A Practical Guide

.

Setting Up Your Risk Register in Excel

Step-by-Step Instructions

Creating a risk register in Excel is straightforward with the right guidance. Begin by opening a new Excel workbook and setting up your columns. Use the following layout for an effective risk register:

Column	Data Entry	Example
A: Risk ID	Unique identifier for each risk	R-001
B: Date logged	Date risk was identified	01/11/2023
C: Category	Type of risk	Operational

Next, add the necessary data validation for drop-down lists. Select cells in the 'Likelihood', 'Impact', and 'Status' columns, then go to

Data > Data Validation

. Choose 'List' and enter the options: for likelihood and impact, use 1, 2, 3, 4, 5; for status, use Open, In progress, Closed, Accepted. This ensures consistency and ease of use.

Formulas and Formatting

With your structure in place, it's time to add formulas. In the 'Score' column (H), enter the formula: =IF(OR(F2="",G2=""),"",F2*G2). This calculates the risk score by multiplying likelihood and impact. For the 'Rating' (I), use: =IF(H2="","",IF(H2>=17,"Extreme",IF(H2>=10,"High",IF(H2>=5,"Medium","Low")))). Repeat these steps for residual columns (O, P, Q, R) using similar formulas. Now, add conditional formatting to highlight risks. Go to

Home > Conditional Formatting > Highlight Cells Rules > Equal To

and set rules for 'Extreme', 'High', 'Medium', and 'Low' ratings, assigning distinct colours to each. Finally, set up flags in the 'Flags' column (T) using: =IF(AND(M2<>"",M2<TODAY(),N2<>"Closed"),"Action overdue",IF(AND(S2<>"",S2<TODAY()),"Review due","")). This alerts you to overdue actions and upcoming reviews. By following these steps, you'll have a functional risk register template in Excel, ready to help you manage and track risks effectively.

Creating a Risk Register in Google Sheets

Google Sheets Setup

Building a risk register in Google Sheets is quite straightforward, thanks to its user-friendly interface. Start by opening a new Google Sheets document. Use the column layout provided earlier to set up your headings: from "Risk ID" in column A to "Flags" in column T. Next, you'll want to create drop-down lists for specific columns. For the "Likelihood" and "Impact" columns, click on the column letter, go to "Data" > "Data validation", and choose "Add rule". Select "Dropdown" and add the values 1 through 5. Repeat this step for "Status" with options like Open, In progress, Closed, and Accepted. For "Category", include Financial, Operational, Compliance, Cyber, People, Reputation, and Strategic. Apply conditional formatting to visually highlight risk ratings. Go to "Format" > "Conditional formatting", and set rules such as "Text is exactly" for "Extreme" risks to appear in red. This colour-coding helps you quickly identify critical risks at a glance. Finally, freeze the top row to keep your headings visible as you scroll. Simply select "View" > "Freeze" > "1 row". This setup mirrors the features in Excel but leverages the seamless sharing and collaboration that Google Sheets offers.

Transferring Files

Switching between Excel and Google Sheets is a breeze, but it requires a few checks to maintain functionality. To move an Excel file to Google Sheets, upload your .xlsx file to Google Drive. Once uploaded, right-click and select "Open with" > "Google Sheets". This converts the file, although you should verify that the formulas and drop-downs remain intact. If you need to revert to Excel, choose "File" > "Download" > "Microsoft Excel (.xlsx)" from Google Sheets. This creates a downloadable Excel version of your risk register. After conversion, always double-check formulas, particularly in columns like "Score" and "Flags", to ensure they function correctly. For those managing workplace risks, the

HSE risk assessment guide

offers comprehensive insights on what should be documented based on business size. This can complement your risk register setup, ensuring it aligns with best practices.

Worked Example and Common Mistakes

Example Register

To help you visualise how a risk register might look when completed, here's an example using common small business risks. This can guide you in filling out your own template:

Risk ID	Date Logged	Category	Risk Description	Risk Owner	Likelihood	Impact	Score	Rating	Existing Controls	Further Actions	Action Owner	Due Date	Status	Residual Likelihood	Residual Impact	Residual Score	Residual Rating	Next Review Date	Flags
R-001	01/11/2023	Financial	Loss of a major client	John Smith	4	4	16	High	Regular check-ins	Sign longer contract, win new clients	Jane Doe	15/12/2023	Open	3	3	9	Medium	01/01/2024
R-002	01/10/2023	Cyber	Phishing attack leads to data breach	Alice Brown	3	5	15	High	Antivirus software	Staff training, multi-factor authentication	Bob White	30/11/2023	In progress	2	4	8	Medium	01/12/2023
R-003	15/09/2023	Operational	Key supplier delays delivery	Tom Green	3	2	6	Medium	Alternative suppliers identified	Agree backup supplier	Lisa Black	10/11/2023	Closed	2	2	4	Low	01/12/2023

Avoiding Pitfalls

Even with a solid structure, there are common mistakes to watch out for when maintaining a risk register. A frequent error is failing to assign a specific risk owner. Every risk needs a single person responsible, ensuring accountability and clarity. Vague actions, such as "monitor closely," aren't actionable and don't guide your team effectively. Always specify clear, concrete steps, like "sign a new supplier agreement by March." Another pitfall is scoring everything as 'high' without proper assessment. Use the 5×5 risk matrix to guide your scoring objectively. Forgetting to set review dates or not updating the register regularly can render it useless. Aim for a monthly review, even if it's just a quick scan, to keep your register relevant.

Reviewing and Updating Your Risk Register

Monthly Review Checklist

Regularly updating your risk register ensures it remains a valuable tool for managing risks. For small businesses, reviewing the whole register monthly is sensible, with high and medium risks revisited at least quarterly. Here's a simple checklist to guide your monthly review:

• Update the status of each risk: Has anything changed since the last review?
• Check if any actions are overdue and update their status.
• Review risk scores and adjust if necessary. Have new controls reduced the risk?
• Ensure each risk still has a named owner and that they’re aware of their responsibilities.
• Set new review dates for each risk, keeping them realistic.
• Discuss the register in team meetings to ensure it’s integrated into decision-making processes.

Let’s say you’ve identified the risk of a supplier delay (e.g., Risk ID R-003). During your review, you find the backup supplier agreement is not finalised. This prompts an urgent follow-up, ensuring the risk is appropriately managed before it escalates.

Pro Tips

Keep your risk register simple yet comprehensive. Avoid overcomplicating it with excessive detail that could overwhelm team members. Use conditional formatting to highlight overdue actions or extreme risks, making them immediately visible.

By following these practices, your risk register will not only track potential threats but actively contribute to your organisation's resilience and preparedness. Remember, the goal is to use the register as a living document that evolves as your business does.

FAQ

How is a risk owner different from an action owner?

A risk owner is responsible for monitoring and managing a specific risk, ensuring that it is assessed and mitigated effectively. In contrast, an action owner is tasked with executing specific actions to control or reduce that risk. For example, a finance manager may own the risk of cash flow issues, while a procurement officer could own the action to renegotiate supplier terms.

How often should I update my risk register?

It’s wise to review your risk register monthly, adjusting for any changes in the risk landscape. High and medium risks should be evaluated at least quarterly. Regular updates ensure the register remains relevant and actionable, supporting agile decision-making.

Can I use this template for compliance?

While this risk register template offers a sound starting point, it isn’t a guaranteed compliance tool. Compliance requirements vary by sector; consult relevant regulations and standards for your industry. Always verify if additional documentation or processes are needed for your specific context.

When should I move beyond a spreadsheet?

Consider transitioning to more sophisticated tools when your spreadsheet becomes cumbersome, especially if multiple users need access, or if you’re in a regulated industry with stringent audit requirements. Investing in dedicated software can provide better tracking, reporting, and collaboration features.