A Simple Spreadsheet Risk Register

Obviously, there’s a lot of nice and expensive risk register solutions to be found on the net (e.g. Primavera Risk Analysis, RM Studio, RiskMate and RamRisk). You don’t need to work with risk in more than a few organisations to figure out, that most risk registers are simple, homemade spreadsheets. They may differ in quality and functionality, but they are essentially just spreadsheet models (with all the benefits and limitations that come with it).

I won’t claim to have made the template of all spreadsheet risk registers. Rather the opposite, in fact. All organisations are different (if nothing else, then in their language, culture and abbreviations) and no risk register can embrace all. I’ve made a risk register template and you’re free to use it as you please (either as it is, as a base for further development or simply for inspiration) as long you respect the embedded references to this website (logos, links, etc.).

A Few Mandatory Screenshots

Just to show ‘the stuff’ before stealing anymore of your valuable time. Take a look a below to get a glimpse of the the setup page, risk matrix, the report and the risk register.

When and How To Use a Risk Register?

The so-called best practices for risk management defined and described by the big-money industry of project management standards (like the PMBOK and PRINCE2) always seem to point to a risk register as the primary tool for assessing and managing risk. I think it fair to point at the risk register as one way of assessing and managing risk, but I’m stunned to see the weight it’s being given in the organisations around the country.

I’m stunned by not so the fact that people prefer use a table to note down the risks they to wish to focus on, but more by the conformity surrounding the perception, construction and usage of risk registers. There are many instances, where forcing (project) risk exposures on the ‘cause-event-effect’ form isn’t the best practice way for neither analysing nor mitigating the risks (e.g. the reason for the decline of oil prices in 2014 may be completely irrelevant and yet compose the largest risk to your business case – a stochastic input to your business case will likely be the preferred approach).

Just to carve out my point in stone, here’s a few examples on risk assessment techniques that doesn’t necessarily require a risk register:

• Scenario analysis
• Decision tree analysis
• Monte Carlo simulation
• The Successive Principle
• Bayesian networks

You may argue that an action plan or a backup plan will be required to manage the risk exposure uncovered by such assessments. While that’s absolutely correct, the ‘best practice’ risk register as describe by the project management framework will likely not be the preferred approach. The point being, that you should really always consider whether the qualitative or semi-quantitative risk management approach supported by the risk register is the best way to go about it in the specific context.

A Few Practical Remarks

Spreadsheets models are easy to build, easy to use and easy to fuck up. The spreadsheet below isn’t any different. It’s basically unstable, meaning that some actions may mess up your references leading to ‘easy to fix’ errors (e.g. sorting the risk register on expected value or risk score a few times often does the trick). I haven’t spent much time debugging it, so you should expect to encounter a few random minor errors here and there.

The spreadsheet uses a few macros (e.g. for building the ‘last saved by’ log), so please enable these. It’s in alignment with ‘best practice’, so it should into your organisation whether you swear to PRINCE2, PMBOK or something else. If not, feel free to adjust it to match or needs. If you create something even nicer out of it, then show your gratitude by sharing with the rest of us – whether in here or through other channels.

The spreadsheet is split in a setup page, a risk matrix, a risk register, a risk report and save log. All pages have been protected to prevent the most basic user created errors, but no password has been used (you may want to add a password of your own). Most of the action will occur on the risk register sheet. It’s got room for 50 risks. If you need to extend it, then add additional lines within the table (not at the bottom) and copy down the formulas of rows above.

Please note, that if you run the macro on the setup page after taking the tool into use, you may end up losing the information in the save log. And finally, the spreadsheet is compatible with Excel 365 (2015). I haven't tryed it out with prior versions and you should expect to experience some problems (although managable) if you run it in an older version of Excel.

Download

Download Risk Register v1.0 (.xlsm)

Last updated on 17-11-2015