How do you score a risk register?
Short answer
Rate each risk's probability and impact on a 1 to 5 scale and multiply them to get a score from 1 to 25. Map the score to a rating with thresholds you set, such as Low 1 to 4, Medium 5 to 9, High 10 to 15 and Critical 16 to 25. Score again after the response to get the residual score.
A risk register lists what could go wrong on a project, how likely it is and how bad it would be. Scoring turns that into a ranking so attention goes to the right risks first.
How is the score calculated?
- Score = probability × impact, each on a scale of 1 to 5, so the score runs from 1 to 25.
- Residual score = residual probability × residual impact, after the planned response.
A probability scale can be defined as 1 Rare (under 10% chance), 2 Unlikely (10% to 30%), 3 Possible (30% to 50%), 4 Likely (50% to 80%) and 5 Almost certain (over 80%). Each impact level needs its own definition in terms of budget, schedule or quality, so that two people score the same risk the same way.
How does a score become a rating?
Thresholds map the score to a rating and a typical response:
| Rating | Score | Typical response |
|---|---|---|
| Low | 1 to 4 | Accept, or monitor at each review |
| Medium | 5 to 9 | Mitigate with a named action |
| High | 10 to 15 | Mitigate now and report to the sponsor |
| Critical | 16 to 25 | Avoid or transfer, with sponsor sign-off |
What does a worked example look like?
A vendor may deliver late. Probability is Likely (4) and impact is 3, so the score is 4 × 3 = 12, which is High. After a mitigation plan (a second supplier on standby), probability drops to Unlikely (2) with the same impact, so the residual score is 2 × 3 = 6, which is Medium.
A heat map counts the open risks in each probability and impact cell, which shows where risks cluster. A review date on every risk, with an overdue flag when the date has passed, keeps the register from going stale.
What are the limits of risk scores?
The scores are ordinal. A score of 8 is not twice as serious as a score of 4 in any measured sense, and the probability and impact levels are subjective inputs. Use the score to rank and discuss, not to calculate an expected loss.
The risk register template holds up to 100 risks with a heat map, residual scores and review flags.