Risk register template: free template for ISO 14971, ISO 27001 and NIS2
A risk register is read twice: once when you rate a risk, and again when an auditor asks how you decided it was acceptable. This free risk register template keeps both in one place: a 5 × 5 rating before and after treatment, acceptance criteria set in advance, the treatment actions and the date of the next review.
Risk register: [product, project or scope]
Framework: [ISO 14971 / ISO/IEC 27001 / NIS2 Article 21 / other] · Method: [risk management plan or procedure, version] · Owner of the register: [name] · Approved by: [name, date]
1. Rating scales (5 × 5)
| Score | Likelihood (L) | Severity (S) |
|---|---|---|
| 1 | Rare: [your definition, e.g. less than once in 10 years] | Negligible: [your definition] |
| 2 | Unlikely: [definition] | Minor: [definition] |
| 3 | Possible: [definition] | Moderate: [definition] |
| 4 | Likely: [definition] | Major: [definition] |
| 5 | Almost certain: [definition] | Critical: [definition] |
2. Acceptance criteria
Level = likelihood × severity. Decided before any rating, in [your plan or procedure], for example: [1–4 low: acceptable] · [5–9 medium: acceptable if reduced as far as possible] · [10–16 high: reduce before acceptance] · [20–25 critical: not acceptable]. A residual risk above the criteria is accepted only with a written reason, by [role].
3. Register
| ID | Risk | Owner | Before treatment | Decision | Treatment actions | After treatment | Accepted by | Next review |
|---|---|---|---|---|---|---|---|---|
| R-01 | [cause] → [event] → [consequence] | [name] | [L] × [S] = [level] | [reduce / accept / avoid / transfer] | [action, owner, due date] | [L] × [S] = [level] | [name, date, reason if above criteria] | [date] |
| R-02 | [cause] → [event] → [consequence] | [name] | [L] × [S] = [level] | [reduce / accept / avoid / transfer] | [action, owner, due date] | [L] × [S] = [level] | [name, date, reason if above criteria] | [date] |
4. Review
Reviewed every [n] months, and after [an incident, a complaint, a change or a new vulnerability]. Last review: [date, name]. Changes since then: [new risks, new ratings, closed risks]. Next review: [date].
How to use it in Confluence
- Click Copy the template, open a new Confluence page and paste: headings, lists and tables stay as they are.
- Replace the parts in [brackets] and delete what does not apply to you.
- To reuse it, save it as a space template: Space settings › Templates › Create template, then paste.
Adapting the risk register template to your framework
- ISO 14971 (medical devices). Write each risk as hazard → hazardous situation → harm, and rate the probability of occurrence of harm and its severity. Your criteria for risk acceptability come from your risk management plan; after the risk controls, evaluate each residual risk and, at the end, the overall residual risk. If a residual risk is not acceptable under your criteria and further risk control is not practicable, it can only be accepted if a benefit-risk analysis shows that the benefits outweigh it (clause 7.4). For ISO 14971, “transfer” is not a risk control.
- ISO/IEC 27001 (clauses 6.1.2 and 6.1.3). Rate the risks to the confidentiality, integrity and availability of information, each with a risk owner. The risk owners approve the treatment plan and accept the residual risks, and the assessment is repeated at planned intervals (clause 8.2).
- NIS2 Article 21. Note which of the ten measures of Article 21(2) each risk relates to, from risk analysis policies to multi-factor authentication. Article 20 asks the management body to approve these measures and oversee their implementation.
Three mistakes auditors often see
- Only one rating. Without a rating after treatment, nothing shows that the actions changed the risk.
- Criteria set after the ratings. Decide what is acceptable before you rate, or every risk ends up “acceptable”.
- A register nobody reviews. ISO/IEC 27001 expects assessments at planned intervals, and ISO 14971 expects production and post-production information to feed back into risk management.
This page helps you plan and document; it is not legal advice. Check the official text and your authority’s guidance. Related: how to run CAPA in Jira, for the actions that come out of a risk.