Risk, Issue & Change Log (Excel)
Three registers every project needs, in one workbook. Risks are things that might happen: each gets a probability and impact from 1 to 5, a score and a heat colour, a response and an owner, and appears on a 5×5 heat map. Issues are things that have already happened: each has a priority, an owner, a target date and a days-open counter. Change requests record what was asked to change, its effect on cost and time, and who approved it.
Free · no sign-up · opens in Microsoft Excel, Google Sheets, LibreOffice and WPS Office. Files contain no macros.
Preview
Real view of the file with its sample data (yellow cells are where you type).
| ID | Raised on | Risk (cause → event → effect) | Category | Owner | Probability (1-5) | Impact (1-5) | Score | Rating | Response | Action to take | Action due | Status |
| R-01 | Oct-26 | Because the sponsor is travelling in the design phase, design approval may be delayed, which would push back the build. | Stakeholders | Priya | 3 | 4 | 12 | High | Reduce | Book two review slots now; agree a deputy who can approve. | Nov-26 | Open |
| R-02 | Oct-26 | Because only one developer knows the hosting set-up, illness or leave may stop the build, which would delay go-live by weeks. | People and skills | Vikram | 2 | 5 | 10 | High | Reduce | Write a set-up note; pair a second developer for one day a week. | Oct-26 | Open |
| R-03 | Oct-26 | Because content comes from five departments, pages may arrive late or incomplete, which would delay testing. | Schedule | Sana | 4 | 3 | 12 | High | Reduce | Weekly content deadline per department; send a page template with word limits. | Nov-26 | Monitoring |
| R-04 | Oct-26 | Because the hosting price is in a foreign currency, a currency change may raise the yearly cost, which would exceed the budget line. | Cost | Finance | 2 | 2 | 4 | Low | Accept | Keep 5% contingency on the hosting line. | Dec-26 | Open |
| R-05 | Oct-26 | Because the old site has no redirects planned, search engines may drop old pages, which would lose enquiries after launch. | Technical | Vikram | 3 | 4 | 12 | High | Avoid | List every old address and map it to a new page before launch. | Nov-26 | Open |
What's inside
- Risks sheet: ID, date raised, description, category, owner, probability, impact, score, rating (Low, Medium, High, Critical), response, action, due date, status, and the score after the action
- Heat Map sheet: a 5×5 grid that counts open risks by probability and impact, coloured green to red
- Issues sheet: priority, owner, action, target date, status, days open and an Overdue flag
- Changes sheet: change request number, requester, what and why, type, cost and schedule impact, decision, decided by and date
- Dashboard: open risks by rating, open and overdue issues by priority, pending changes and the total cost and days of approved changes
- Settings for currency, the score limits for each rating and the lists of categories
How to use it
- On the Settings sheet type your currency (for example USD, €, ₹ or AED). Change the rating limits only if your organisation uses different ones.
- Delete the sample rows on the Risks, Issues and Changes sheets.
- For each risk, write it as "Because of [cause], [event] may happen, which would [effect]". Pick its probability and impact from 1 (very low) to 5 (very high).
- Choose a response (Avoid, Reduce, Transfer or Accept), write the action, give it an owner and a due date.
- When a risk happens, set its status to "Became an issue" and add it to the Issues sheet.
- Log every change request as it arrives, fill in its cost and time impact, and record the decision once the sponsor or change board has decided.
- Review the Heat Map and the Dashboard in every weekly meeting.
Tips
- A risk without an owner and a date is just a worry. Make sure every open risk has both.
- Fill in the "after action" probability and impact to show how much the action is expected to reduce the risk.
- Close a risk when the period it could happen in is over; keep it in the list with status Closed for the record.
- Approved changes should update the plan and the budget: copy the cost into the budget workbook and move the dates in the Gantt chart.
Questions and answers
How is the risk score calculated?
Score = probability × impact, so it runs from 1 to 25. By default 1–4 is Low, 5–9 Medium, 10–16 High and 20–25 Critical. You can change the limits on the Settings sheet.
What is the difference between a risk and an issue?
A risk is uncertain and in the future: it may or may not happen. An issue is happening now and needs action. When a risk happens it becomes an issue.
Which risks does the heat map count?
Only risks whose status is Open or Monitoring. Closed risks and those that became issues are left out.
Is this a formal risk assessment?
No. It is a working register to help the team think and act. For safety, legal or financial risks, follow your organisation's policies and ask a qualified professional.

