Risk Register Calculator
Roll a risk register up into one health score: severity mix, treatment backlog, accepted risks and how much sits above appetite.
Inputs
Register Health Score
75.7%
Average Weighted Severity
10.6of 25
Register Above Appetite
31.0%
Treatment Actions Overdue
14.3%
Average Risk Score
9of 25
Grade
B — Good
Reconciliation Check
Register reconciles — every risk carries a severity band
Top Action
Escalate the 4 critical risk(s) with a named owner and a dated treatment plan each
Step by step
Values used
Risks on the register = 42 risks; Critical risks = 4 risks; High risks = 9 risks; Medium risks = 17 risks; Low risks = 12 risks; Treatment actions past their due date = 6 actions; Risks formally accepted above appetite = 3 risks; Average likelihood = 3 — Possible; Average impact = 3 — Moderate; Appetite threshold on the 25-point scale = 12 points
Risk Register
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20).
Severity mix
Average weighted severity = Σ(count × representative score) ÷ banded risks, on the 25-point 5×5 scale.
Register Health Score
= 75.7
Average Weighted Severity
= 10.6 of 25
Register Above Appetite
= 31.0
Treatment Actions Overdue
= 14.3
Average Risk Score
= 9 of 25
Grade
= B — Good
How it works
A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix. Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
Formulas
Risk Register
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20).
- 25 / 16 / 9 / 4
- Representative 5×5 scores for critical, high, medium and low
- aboveAppetitePct
- Critical plus high as a share of banded risks
- appetiteDelta
- Average risk score minus the appetite threshold
Severity mix
Average weighted severity = Σ(count × representative score) ÷ banded risks, on the 25-point 5×5 scale.
- weighted
- Sum of counts times their representative severity
- denom
- Number of risks that carry a band
Frequently Asked Questions
How is Risk Register calculated?
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20). A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix.
Why does Risk Register matter?
Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
What values do I need to enter?
This calculator takes 10 inputs: Risks on the register, Critical risks, High risks, Medium risks, Low risks, Treatment actions past their due date, Risks formally accepted above appetite, Average likelihood, Average impact, Appetite threshold on the 25-point scale. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why penalise formally accepted risks?
Because acceptance moves a risk off the treatment plan without changing the exposure. One or two conscious acceptances with executive sign-off are healthy; a dozen means the register has become a filing system for decisions nobody wants to fund.
What is a good register size?
There is no target. A register of twenty well-owned risks beats one of four hundred copied from a template, and the tell is whether every entry has an owner, a treatment and a review date. Growth without closures is the pattern to worry about.