Risk Assessment Template: Free Downloads and a Scoring Guide for 2026
A risk assessment template is the worksheet you fill in before the work starts: you list what could go wrong, rate how likely it is and how badly it would hurt, turn the two numbers into a score, and write down what you will do about each risk. The output is a ranked list with a mitigation and a named owner on every row, which is what lets a shop owner, a project lead, or a safety officer decide where the next hour of prevention effort goes. This page is about that scoring exercise: the concentrated pass that produces the numbers.
It is not the risk register. The register is the living log: the running list you update week after week as risks change, close, or turn into incidents. The assessment is the exercise that feeds it. Score the risks here first, carry the significant ones into the register, and the register stays a decision tool instead of a graveyard of stale rows. If what you need is the ongoing log, the risk register template page is the sibling built for exactly that.
Four risk assessment templates, free to download
Each version below is a working spreadsheet, not a blank grid with a title row. The fields are pre-filled with realistic example content from a fictional woodworking shop and a fictional logistics company mid-migration on its order system, so you can see how a finished risk assessment reads, then overwrite it with your own risks. What you download is an everyday spreadsheet file, compatible with all the usual tools. No email address required.
5x5 Risk Assessment
The 5x5 risk assessment is the classic scoring grid: every risk gets a likelihood from 1 to 5, an impact from 1 to 5, and a score that is the product of the two, so a 15 always lands above a 6. Use it when a team needs one shared language for severity. The mitigation and owner columns turn a score into action: each high row names what reduces it and who is accountable for that reduction.
Job Hazard Assessment
The job hazard assessment, often called a JHA, works one task at a time: for each job step you write the hazard it exposes, the control that neutralizes it, and the residual risk that remains once the control is in place. Use it before non-routine or high-energy work. The residual risk column is the discipline, because it forces an honest answer about what is left after the control, and whether that leftover is acceptable today.
Project Risk Assessment
The project risk assessment is built for one initiative with a finish line, like the systems migration in the example rows: every risk carries a category, a probability, an impact, a computed score, a response strategy, and an owner. Use it during planning and refresh it at each milestone, because scores age as the work progresses. The response column names the strategy, mitigate, avoid, transfer, or accept, so the team debates the strategy once and records the decision.
Risk Assessment With Controls
The controls-register version flips the lens from risks to safeguards: each row is a preventive control, what it prevents, how often it is checked, who owns it, and the dates it was last verified and is next due. Use it after scoring, when the mitigations from your assessment harden into standing inspections like guard checks, filter cleanings, and extinguisher reviews. The last-checked and next-due columns are the whole point: a control nobody has verified recently is a hope, not a control.
How to run a risk assessment that actually reduces risk
Bring the people who actually do the work
A risk assessment written alone in an office misses the hazards that live in daily routine. Bring the operator who runs the saw, the administrator who knows which import script breaks every quarter, the person who opened the angriest customer email last month. Ten minutes of their specifics beats an hour of generic hazard lists, and the workshop effect matters too: people who helped score a risk accept its mitigation, while people who inherited a score from a clipboard argue about it later.
List risks before you rate anything
Brainstorm the full list with ratings switched off. The moment a score appears, the room quietly edits the list to avoid argument, and the awkward risk nobody wants to own never gets written. Name each risk as an event with a consequence: kickback throwing stock at the operator, not just saw safety. A test you can apply: the row should read like something you could point at on the floor, on a calendar, or in an error log, not a category of worry.
Rate likelihood and impact on a written scale
A 1 to 5 scale only works if every number means the same thing to every scorer. Write the anchors down before you start: likelihood 3 means it has happened here within the last year, impact 5 means someone goes to the hospital or the project misses its date by a month. Without anchors, the optimist scores a 2 and the pessimist scores a 4 on the same risk, and the ranking becomes a personality test instead of a decision tool the team can act on together.
Score, rank, and draw the action line before debating
Multiply likelihood by impact, sort descending, and the top of the sheet becomes your working list. Then decide the threshold before debate starts: many teams act on anything scoring 10 and above, monitor 5 to 9, and accept the rest with eyes open. Writing the threshold down first keeps the meeting about the risks near the line, which is where honest disagreement is useful, instead of re-scoring everything to move a favorite risk across it.
Write a mitigation and an owner on every risk above the line
A score without a mitigation is a worry with a number. For each risk you will act on, write the specific control, the person accountable for it, and a date. Specific means a stranger could check it: riving knife aligned at shift start, not be careful with the saw. When two mitigations compete for the same budget, the score column settles it: the 15 gets funded before the 6, and nobody has to defend that call in the meeting.
Reassess on a schedule and after every incident
The assessment decays the day you finish it. Controls drift, new equipment arrives, and the 2 you accepted last year may be a 4 this year with a new crew on the floor. Set a standing review, quarterly for most shops and projects, and add an unscheduled pass after every incident or near miss, because those are free lessons about which scores were wrong. Feed the significant rows into the risk register so the week-to-week log and the periodic scoring exercise stay connected instead of drifting apart.
What is a risk assessment matrix?
A risk assessment matrix is the grid the 5x5 version above is built on: likelihood runs along one axis, impact along the other, and each cell where they meet holds a score from 1 to 25, usually colored so the top-right corner reads as danger at a glance. It is the same arithmetic as the score column, presented as a map. Teams use the matrix in the room while scoring, then keep the row-per-risk sheet as the record, because rows carry owners and dates in a way a colored cell cannot.
The matrix earns its place when you present results, because a stakeholder who will never read twenty rows will look at one picture and ask the right question: why are three risks sitting in the red corner? Keep the written anchors for each number beside the matrix, since a color without a meaning invites debate about shade instead of debate about the risk itself, and the anchors are what keep the picture honest across reviewers.
Frequently asked questions
What is the difference between a risk assessment and a risk register?
A risk assessment is the upfront scoring exercise: you identify hazards or threats, rate likelihood and impact, and decide what to do about each one, usually in a concentrated session before work starts or a project kicks off. A risk register is the living log that comes after: the running list of scored risks with statuses, reviewed weekly or monthly as risks change, close, or turn into incidents. The assessment feeds the register. Score first, carry the significant rows into the log, and keep the register current between scoring rounds.
How do you score likelihood and impact in a 5x5 risk assessment?
Each risk gets two one-to-five ratings, and the score is their product, so the grid runs from 1 to 25. The ratings only stay honest if the numbers have written meanings: likelihood 3 might mean it has happened here within a year, impact 5 might mean an injury with lost time or the project missing its date by a month. Agree the anchors with the room before scoring anything, then multiply, sort, and act on the top rows first. Without anchors, the same risk gets a 2 from the optimist and a 4 from the pessimist, and the ranking stops meaning anything.
Who should be involved in a risk assessment?
The people who do the work being assessed, plus whoever owns the budget and the person accountable for follow-through. A manager working alone will miss the informal workarounds where real exposure lives, like the push stick that wanders off its hook or the import script that only one person understands. Ten minutes of specifics from an operator beats an hour of generic hazard lists, and involvement buys acceptance: people who helped score a risk tend to follow its mitigation without being chased, because the control is theirs as much as the score.
How often should a risk assessment be reviewed?
Score the full picture before the work starts, then reassess on a fixed rhythm, quarterly for most shops and projects, and after anything that changes the picture: new equipment, a new crew, a moved process, or an incident and near miss. Those events are free calibration, because they show which scores were wrong. Between full passes, the risk register carries the week-to-week tracking, so the register and the periodic assessment complement each other rather than compete for the same attention.
What is residual risk in a job hazard assessment?
Residual risk is what remains after your control is in place. A task like ripping long stock starts high; with a riving knife fitted, a sharp blade, and a push stick used past the blade, what is left is lower, and that remainder is the residual rating. The column matters because it forces honesty: some controls reduce a hazard without removing it, and the team should decide deliberately whether the leftover is acceptable today, needs another layer of control, or means the task should be done a different way entirely.
Is a risk assessment a legal requirement?
For many employers it is. Occupational safety regulators in most jurisdictions require employers to assess workplace risks and act on significant findings, and the specific duties vary by region and industry. Beyond the legal floor, clients and insurers increasingly ask for evidence of a scoring process before awarding contracts or coverage. The template does not replace a compliance professional for your jurisdiction, but it gives you the structured record any of those conversations starts from: hazards, scores, controls, owners, and dates.
Run it live instead of in a file.
The downloads above are yours either way. In Wisegrid the same template becomes a working sheet with owner contacts, status dropdowns, reminders, and dashboards. 7-day free trial, no credit card required.