IT Risk Assessment template for Google Docs and Word

The first pages of the IT Risk Assessment template

Every page (7)

Overview

Project risks written as vague topics are hard to manage, and sponsors cannot tell which ones matter. This template sets out the method in order: the scope, the assets, the threats, the controls, the ratings and the treatment plan. Each risk is written as a cause, an event and an effect, scored on a five by five scale, and given an owner, a response and a review date.

The sample covers a move of Lowmoor Group's payroll system to a vendor cloud service. It shows five scored risks, two of them red before controls, a register with residual ratings, a status page against the 5% escalation line, and a treatment plan to June. Every name, figure and date is fictional. Replace the scope and risks with your own workshop results, and keep the scale the same across the project.

Useful for

A project manager running a risk workshop before the first sponsor review of a system move
A sponsor checking which risks sit above the escalation line before approving spend
A security lead tracing each control back to the asset and threat it protects

What's included

Scope and assets: what is in the review, with the owners and the data tips
Threats: a heat map of five scored risks, with owners and responses
Controls: the register with residual ratings and the control for each risk
Risk ratings: a status page with KPIs, a short risk list and open checks
Treatment plan: a Gantt by workstream and the escalation gates with dates
Make it yours: numbered steps for setting the scale and writing each risk

How to use it

1
Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.
2
Set the impact thresholds for budget and schedule, then keep the scale unchanged for the whole project.
3
Replace the sample risks with your workshop results, each written as a cause, an event and an effect.
4
Name an owner and a response for every risk above amber, and set the review cycle to fortnightly.
5
Delete the guide page, then share the register with the sponsor and the risk owners.

What you need

Requirements

A Google account with access to Google Drive

Works with

Google Docs
Microsoft Word (download the .docx)

Questions

Are the organization, people and figures fictional?

Yes. Lowmoor Group, its people, the payroll system, the vendor and every risk score and figure in this sample are fictional. Replace them with your own project details before you share the register.

When should a risk be escalated?

Escalate when the score reaches 15 or more, or when the exposure goes above 5% of the project budget. The sponsor then decides whether the project continues, changes scope or accepts the risk.

What is the difference between inherent and residual scores?

The inherent score rates a risk before any control. The residual score rates it after the controls are in place. A control that does not lower the score is not a real treatment, so re-score each risk at every review.

#risk-assessment
#risk-register
#risk-management-plan
#it-risk
#project-risk
#escalation
#google-docs

More Google Docs templates More project management templates

Risk Management Plan
Docs + Word7 pages
Free
Construction Risk Assessment
Docs + Word7 pages
Free
Project Proposal
Docs + Word5 pages
Free

Also in Project management

All project management templates

Get this template