Risk Register Builder
Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
A risk register is how security work gets funded. It records what could go wrong, how likely and how damaging that is, and — the part people skip — what you have decided to do about it and who owns that decision.
How to use it
- Describe the risk.
- Score likelihood and impact from 1 to 5.
- Choose a treatment: Mitigate, Accept, Transfer or Avoid.
- Add to the register and export as Markdown.
What to take away
Score is likelihood times impact
A 5×5 grid gives 1 to 25. The number is only there to sort the list — do not defend it to two decimal places.
Accept is a real answer
Not every risk should be fixed. Accepting one explicitly, with a named owner and a review date, is a legitimate and auditable decision. Ignoring one is not.
Transfer does not move the consequences
Insurance and outsourcing move financial exposure. Your customers and your regulator still hold you responsible for the breach.
Frequently asked questions
What are the four risk treatment options?
Mitigate (reduce it), Accept (live with it knowingly), Transfer (share the financial impact), and Avoid (stop doing the risky thing). Every risk gets exactly one, chosen deliberately.
How often should a register be reviewed?
Quarterly for most organisations, and immediately after any significant change or incident. A register nobody revisits is documentation, not management.
What is residual risk?
What remains after your controls are in place. It is the number that should be accepted or escalated — the pre-control score is only useful for showing the controls are worth their cost.
Where this fits in the course
This security tool pairs with Path 23 — GRC & Compliance — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Incident Severity & SLA Calculator — Impact × urgency in, a priority tier and realistic remediation SLA out.
- Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.
- CVSS 4.0 + 3.1 Calculator — Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
- Vendor Risk Tiering Simulator — Six vendors, six very different data-access levels. Tier them correctly and decide who needs a full security review.