Project Setup
Risk Summary
5×5 Risk Matrix
Risk Register
| # | Phase | Risk Description | Category | L | I | Score | Level | Mitigation / Response | Owner | Status |
|---|
About this risk register and risk matrix
This tool combines two things every project needs: a structured risk register that records what could go wrong and who is dealing with it, and a 5×5 likelihood and impact matrix that shows at a glance where the serious risks are clustered. It is built for project managers, design managers, risk and QHSE coordinators and engineering consultants running design or construction packages.
What each risk entry captures
- Phase — design or construction, so the register can be filtered by stage
- Risk description and category
- Likelihood (L) and Impact (I), each scored 1 to 5
- Risk score, calculated as
Score = L × I - Severity level, banded automatically from the score
- Mitigation or response, owner and current status
How scores are banded
The 5×5 grid produces scores from 1 to 25, banded as:
- 1–4 — Low
- 5–9 — Medium
- 10–14 — High
- 15–25 — Extreme
The matrix cell counts and the summary KPIs both respond to the phase filter, so you can look at design risks and construction risks separately or together.
Getting the ratings right
Likelihood and impact are rated independently, and that separation is the point. A near-certain nuisance and a remote catastrophe can land on similar scores while demanding completely different responses — the first is managed by absorbing it, the second by contingency planning. Read the score as a ranking device for directing attention, not as a prediction of cost.
Keeping it useful
A register is only worth the reviews it gets. Revisit it at each progress meeting and at every stage gate, confirm whether scores have moved and whether mitigation actions were actually carried out, and close risks that have passed. Assign each risk to a single named owner who has the authority to act; ownership without authority is the usual reason mitigation stalls.
Getting data in and out
Risks can be imported from an Excel or CSV file rather than typed, with a date format selector for imports that use day-first or month-first conventions. The register exports back to CSV and prints as a PDF for issue with monthly reports.
Frequently asked questions
What is a project risk register?
A risk register is the working record of everything that could go wrong on a project and what is being done about it. Each entry captures the risk description, its category, how likely it is, how bad the consequence would be, the resulting score, the mitigation or response planned, who owns it and its current status. It is a live document, reviewed and updated throughout the project rather than written once.
What is a 5×5 risk matrix and how does it work?
A 5 by 5 risk matrix is a grid with likelihood on one axis and impact on the other, each rated from 1 to 5. Plotting a risk at the intersection of its two ratings gives a visual picture of where the worst risks sit. Because there are 25 cells, scores run from 1 to 25, and the cells are colour banded so attention goes to the top right of the grid first.
How is a risk score calculated?
The risk score is likelihood multiplied by impact, so a risk rated 4 for likelihood and 3 for impact scores 12. In this tool scores of 1 to 4 are Low, 5 to 9 are Medium, 10 to 14 are High and 15 to 25 are Extreme. The score is a way of ranking risks against each other for attention, not a prediction of cost.
What is the difference between likelihood and impact?
Likelihood is how probable it is that the risk event occurs, and impact is how severe the consequence would be if it did. They are rated separately because the two are independent: a near certain problem with trivial consequences and a very unlikely catastrophe can both score moderately, but they call for completely different responses.
What are typical risks on a road or infrastructure project?
During design they tend to be incomplete survey or geotechnical data, late client decisions, utility diversions discovered late, changes in scope and delays to statutory approvals. During construction they tend to be ground conditions differing from expectation, weather, material price escalation and availability, land acquisition and access, subcontractor performance, and health and safety incidents.
Who should own a risk on the register?
The owner should be the single named person with the authority and information to act on that risk, not a department and not the project manager by default. Ownership without authority is the most common reason mitigation actions stall, so if the named owner cannot actually implement the response, the risk is assigned to the wrong person.
How often should a risk register be reviewed?
Typically at every project progress meeting, commonly monthly, and always at major stage gates or whenever the scope changes. Reviews should confirm whether scores have moved, whether mitigation actions have actually been carried out, and whether new risks have emerged. A register that is not revisited quickly stops reflecting the real position.
Related Project Management Tools
Controlling the same project: