Free tool
Risk register scorer
- Time
- About 10 minutes
- What you'll get
- Your risks scored, sorted and on a 5×5 heat map, each with an owner and a review date.
Add the risks to your business, rate each one, and get a scored, sorted register and a 5×5 heat map to copy or print. Free, with no sign-up.
A risk register is one list of the things that could hurt your business, each with its likelihood, impact, score, owner, action and review date. The score is likelihood × impact, each rated from 1 to 5, so it runs from 1 to 25: 15 and over is High, 8 to 12 Medium and 6 or under Low. The scales and bands are the ones in our risk register template.
Nothing you type is saved or sent anywhere. It stays in this browser tab, and closing or leaving the page clears it, so copy or print your register before you go.
The scales: what each number means
| Score | Likelihood (in the next year) | Impact (if it happens) |
|---|---|---|
| 1 | Very unlikely: Hard to imagine it happening | Minor: A few hours lost, no client notices |
| 2 | Unlikely: Could happen, but you'd be surprised | Noticeable: A day or two of disruption, or a small unplanned cost |
| 3 | Possible: It's happened to firms like yours | Significant: A client is affected, or a cost you'd have to plan around |
| 4 | Likely: You'd expect it to happen at some point this year | Serious: A client lost, a deadline missed, or a cost that hurts cash flow |
| 5 | Almost certain: It's already happening, or about to | Severe: The business would struggle to carry on as it is |
Your risk register
Rate a risk’s likelihood and impact to score it.
Risk register
Not filled in
- Date
- Not filled in
- Prepared by
- Not filled in
- Scored
- 0 High, 0 Medium, 0 Low
| ID | Risk | Score | Owner | Action | Review |
|---|---|---|---|---|---|
| No risks scored yet. | |||||
| Likelihood 1 | Likelihood 2 | Likelihood 3 | Likelihood 4 | Likelihood 5 | |
|---|---|---|---|---|---|
| Impact 5 | Low, score 5 | Medium, score 10 | High, score 15 | High, score 20 | High, score 25 |
| Impact 4 | Low, score 4 | Medium, score 8 | Medium, score 12 | High, score 16 | High, score 20 |
| Impact 3 | Low, score 3 | Low, score 6 | Medium, score 9 | Medium, score 12 | High, score 15 |
| Impact 2 | Low, score 2 | Low, score 4 | Low, score 6 | Medium, score 8 | Medium, score 10 |
| Impact 1 | Low, score 1 | Low, score 2 | Low, score 3 | Low, score 4 | Low, score 5 |
- High (15 to 25): Act now. It needs an action with a date, and a check each month.
- Medium (8 to 12): Plan an action, and review it every quarter.
- Low (1 to 6): Accept and watch. Look at it again at the yearly review.
Want the register, a risk appetite statement and a quarterly review in one place? The Operational Risk Register, with a filled-in example and a guide, is in the Communication, Governance and Visibility Vault, as done-for-you templates in Word and PDF.
How to use the risk register scorer
- Write each risk as “If… then…”. “IT problems” can't be scored. “If our file storage fails, then live work stops” can, because it names a cause and what it would do.
- Rate the likelihood and the impact. Use the written scales below, so a 4 means the same thing to everyone. Rate how things stand today, before any new action.
- Give it one owner. One named person who keeps an eye on it and makes sure the action happens. A risk owned by “the team” is owned by nobody.
- Write the action and a review date. What you'll do to make it less likely or less damaging, or “accept and watch”. The button under each risk sets a review date for its band: a month for High, a quarter for Medium, a year for Low.
- Read the register and the heat map. Risks are sorted highest score first. Copy the register into Word, Excel or Google Sheets, or print the sheet to take to a meeting.
The scales and bands
These are typical starting points. Change the wording to suit your business, but keep the same scales for every risk.
| Score | Likelihood (in the next year) | Impact (if it happens) |
|---|---|---|
| 1 | Very unlikely: Hard to imagine it happening | Minor: A few hours lost, no client notices |
| 2 | Unlikely: Could happen, but you'd be surprised | Noticeable: A day or two of disruption, or a small unplanned cost |
| 3 | Possible: It's happened to firms like yours | Significant: A client is affected, or a cost you'd have to plan around |
| 4 | Likely: You'd expect it to happen at some point this year | Serious: A client lost, a deadline missed, or a cost that hurts cash flow |
| 5 | Almost certain: It's already happening, or about to | Severe: The business would struggle to carry on as it is |
- High, 15 to 25: Act now. It needs an action with a date, and a check each month.
- Medium, 8 to 12: Plan an action, and review it every quarter.
- Low, 1 to 6: Accept and watch. Look at it again at the yearly review.
A worked example: a typical small agency
Press “Fill in an example” to load six risks for a typical 15-person design and marketing agency. The firm and its scores are made up to show the format.
Two risks come out High. Someone falling for a phishing email and exposing client files is likely (4) and serious (4), so it scores 16. The largest client leaving is only possible (3) but severe (5), so it scores 15. Both need an action with a date and a check each month. Late payment scores 12 and sits at the top of Medium, alongside two risks at 8: the account manager for two key clients leaving, and the main file storage failing. The office lease not being renewed scores 3 and is accepted and watched.
On the heat map, the two High risks sit in the top right, and R3 and R4 share a square, at likelihood 2 and impact 4. The file storage risk points to the continuity plan, because the register says how likely something is and the plan says what you'll do when it happens anyway.
How to read the result
The sorted list is your order of work. Where two risks score the same, the one with the bigger impact comes first, since it would hurt more if it happened. The heat map shows the shape of the whole register: each square is marked H, M or L with its score, and lists the risks in it. A cluster in the top right means several risks that are both likely and damaging; a lot in the bottom left means you can probably merge some.
Common mistakes
- Scores without scales. Without written definitions, one person's 3 is another's 5, and the scores mean nothing.
- Too many risks. A register of 60 rows never gets reviewed. Keep to the 10 to 20 that could hurt the whole business.
- Actions with no date. “Look into it” isn't an action. Give it an owner and a due date, like any other piece of work.
- Filed and forgotten. Book the quarterly review into the calendar before you finish the first version.
When to use something else
This scorer is for risks to the business as a whole. When a risk happens anyway, you need a plan for what to do first: that's a business continuity plan, and for systems and data, a disaster recovery plan. Where the risk is one person who's the only one who can do a job, a succession plan deals with it properly. Risks that belong to one project can stay on that project's own list.
Questions about risk registers and risk scores
How do you calculate a risk score?
Rate the likelihood and the impact from 1 to 5 each, using written definitions so everyone scores the same way, then multiply them. That gives a score from 1 to 25. Here, 15 to 25 is High, 8 to 12 Medium and 1 to 6 Low.
What is a 5×5 risk matrix?
A grid with likelihood along one side and impact along the other, each from 1 to 5. Every risk sits in the square for its two ratings, so you can see at a glance which ones are both likely and damaging. It is also called a risk heat map.
What should a risk register include?
At least a short description of the risk, its likelihood, its impact, a score, one owner, the action or control, the status and a review date. Some registers add a score after the action and the date the risk was added.
How often should a risk register be reviewed?
For a small business, a full review once a quarter works well, with High risks checked monthly. Add or rescore a risk whenever something changes, rather than waiting for the next review.
Why multiply likelihood by impact instead of adding them?
Multiplying means a risk only scores high when it is both fairly likely and fairly damaging. Some firms add the two numbers instead. Either works if you stick with one and write down what each band means.
Is anything I type saved?
No. The register stays in this browser tab and is never saved or sent anywhere. Leaving the page clears it, so copy or print it first.
More on risk and continuity
Other free tools
Business Score
About 5 minutes
A score out of 48, your lowest areas and a first step for each.
Use it: Business ScoreWhat is this problem costing you?
About 2 minutes
The cost a week and a year, and how long a fix would take to pay for itself.
Use it: What is this problem costing you?Free SOP generator
About 15 minutes
A one-page SOP to copy into Word or Google Docs, or print.
Use it: Free SOP generatorFree 5 Whys tool
About 10 minutes
The cause you can change, one fix, an owner and a dated check, ready to copy.
Use it: Free 5 Whys toolOperational maturity check
About 2 minutes
Your level, from 1 (reactive) to 5 (adaptive), and the one change that moves you up.
Use it: Operational maturity checkMeeting cost calculator
About 1 minute
The cost per meeting, per month and per year, with the working shown.
Use it: Meeting cost calculatorMeeting agenda builder
About 5 minutes
A timed agenda with a lead and a Decide, Discuss or Inform label on every item.
Use it: Meeting agenda builderRACI chart builder
About 10 minutes
A RACI chart with one Accountable per task, checked, ready to copy or print.
Use it: RACI chart builderDecision matrix
About 10 minutes
A weighted total and rank for each option, with the working shown.
Use it: Decision matrixOverdue invoice email writer
About 3 minutes
A subject line and email for the stage you are at, the next step and when to send the next one.
Use it: Overdue invoice email writer