Risk Register Calculator
Roll a risk register up into one health score: severity mix, treatment backlog, accepted risks and how much sits above appetite.
About Risk Register Calculator
A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix. Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
Formulas
Risk Register
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20).
- 25 / 16 / 9 / 4
- Representative 5×5 scores for critical, high, medium and low
- aboveAppetitePct
- Critical plus high as a share of banded risks
- appetiteDelta
- Average risk score minus the appetite threshold
Severity mix
Average weighted severity = Σ(count × representative score) ÷ banded risks, on the 25-point 5×5 scale.
- weighted
- Sum of counts times their representative severity
- denom
- Number of risks that carry a band
Worked example
With the default values below, Risk Register Calculator returns Register Health Score of 75.7%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Risks on the registeraccepts 0–5,000 risks
- 42 risks
- Critical risksaccepts 0–5,000 risks
- 4 risks
- High risksaccepts 0–5,000 risks
- 9 risks
- Medium risksaccepts 0–5,000 risks
- 17 risks
- Low risksaccepts 0–5,000 risks
- 12 risks
- Treatment actions past their due dateaccepts 0–5,000 actions
- 6 actions
- Risks formally accepted above appetiteaccepts 0–5,000 risks
- 3 risks
- Average likelihoodone of 1 — Rare, 2 — Unlikely, 3 — Possible, 4 — Likely, 5 — Almost certain
- 3 — Possible
- Average impactone of 1 — Insignificant, 2 — Minor, 3 — Moderate, 4 — Major, 5 — Severe
- 3 — Moderate
- Appetite threshold on the 25-point scaleaccepts 1–25 points
- 12 points
Results
- Register Health Score
- 75.7%
- Average Weighted Severity
- 10.6 of 25
- Register Above Appetite
- 31.0%
- Treatment Actions Overdue
- 14.3%
- Average Risk Score
- 9 of 25
- Grade
- B — Good
- Reconciliation Check
- Register reconciles — every risk carries a severity band
- Top Action
- Escalate the 4 critical risk(s) with a named owner and a dated treatment plan each
Step by step
- 1Values used
- 2Risk Register
- 3Severity mix
- 4Register Health Score= 75.7
- 5Average Weighted Severity= 10.6 of 25
- 6Register Above Appetite= 31.0
- 7Treatment Actions Overdue= 14.3
- 8Average Risk Score= 9 of 25
- 9Grade= B — Good
Assumptions and limits
- The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Risk Register calculated?
Health score = 100 − 0.5 × share above appetite − 0.3 × overdue treatment share − 1.5 per formally accepted risk (max 15) − 2 per point the average risk exceeds appetite (max 20). A register is judged on flow, not on size: how much of it sits above appetite, whether treatments are moving, and how many risks have quietly been accepted instead of fixed. Accepted risks are penalised deliberately, because acceptance is legitimate once and a habit thereafter, and the reconciliation check exists because unbanded rows are the most common reason a register total does not match its own severity mix.
Why does Risk Register matter?
Boards are shown risk counts, but the useful signals are the overdue backlog and the drift of accepted risks — both invisible in a heatmap. This produces a management estimate for steering the process, not an assurance opinion.
What values do I need to enter?
This calculator takes 10 inputs: Risks on the register, Critical risks, High risks, Medium risks, Low risks, Treatment actions past their due date, Risks formally accepted above appetite, Average likelihood, Average impact, Appetite threshold on the 25-point scale. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why penalise formally accepted risks?
Because acceptance moves a risk off the treatment plan without changing the exposure. One or two conscious acceptances with executive sign-off are healthy; a dozen means the register has become a filing system for decisions nobody wants to fund.
What is a good register size?
There is no target. A register of twenty well-owned risks beats one of four hundred copied from a template, and the tell is whether every entry has an owner, a treatment and a review date. Growth without closures is the pattern to worry about.