Generate a risk register template with scores and priorities
Turn an unstructured risk list into a consistent, review-ready register. Provide each identified risk with likelihood and impact ratings from 1 to 5, plus an optional owner and mitigation.
Run — free
The generator validates every rating, multiplies likelihood by impact, assigns a clear priority band, and sorts the register from greatest exposure to least. The result includes ranked rows and a compact priority summary, making it suitable for project reviews, governance packs, planning workshops, and repeatable reporting workflows.
Prepare risks that reviewers can understand
Begin with one concise statement for each uncertain event or condition. A useful statement explains what might happen and, when practical, hints at the consequence. For example, “Key supplier misses the launch date” is easier to assess than a vague label such as “supplier issue.” Give every row an integer likelihood rating and impact rating from 1 to 5. Use one shared interpretation of those scales across the entire register: likelihood might run from rare to almost certain, while impact might run from insignificant to severe. The generator deliberately rejects decimals, text labels, zero, negative values, and numbers above 5 because mixing scales makes rankings misleading. You may also add an owner and mitigation. The owner should be the person or team accountable for watching and treating the risk, while the mitigation should describe a concrete response. Blank optional fields are omitted from the result, so unfinished entries remain clean rather than being padded with null values. Agreeing on the scales before scoring is the most important preparation step. It makes the resulting comparison defensible and keeps a workshop from turning into an argument about what each number means.
Understand the score, priority, and sorting rules
Each risk score is likelihood multiplied by impact, producing a value from 1 to 25. The register maps scores of 20 to 25 to critical, 12 to 19 to high, 6 to 11 to medium, and 1 to 5 to low. These bands provide a practical first view, but they do not replace organizational policy or specialist judgment. Rows are sorted by score from highest to lowest. When two scores match, the risk with greater impact comes first; if impact also matches, greater likelihood comes first. A final tie preserves the original input order, which makes repeated runs deterministic and prevents equally rated rows from moving around unexpectedly. Every output row receives a rank after sorting. The summary counts how many risks fall into each priority band, allowing a reviewer to see the portfolio shape without manually tallying rows. Because multiplication can give the same score to different combinations, reviewers should still inspect likelihood and impact separately. A rare catastrophic event and a frequent moderate event may share a numerical score while demanding very different controls, escalation paths, monitoring intervals, or contingency plans.
Use the register as a living management document
Treat the generated register as a structured baseline for decisions, not as a one-time calculation. Review the highest-ranked rows first and confirm that each has a credible owner, a specific mitigation, and an agreed review date in your wider governance process. The output intentionally focuses on identification, scoring, prioritization, ownership, and mitigation; it does not invent residual scores, deadlines, budgets, or status values that were not supplied. This restraint makes the result easy to place into a project document, spreadsheet, ticketing workflow, or audit record without confusing assumptions with facts. Re-run the same input whenever ratings change, then compare the resulting order and summary with the previous review. A reduced score can show that a control is working, while a rising score can trigger escalation or contingency planning. Keep evidence behind each rating, especially for critical and high risks, and record who approved material changes outside this generated template. The deterministic rules mean identical input always produces identical output, which supports repeatable reporting. At $0.002 per request through the API, the same calculation can be incorporated into routine portfolio reporting as well as used interactively for individual registers.
What you can do with it
Prioritize a project risk workshop
Score risks collected from stakeholders and start discussion with the highest combined likelihood and impact.
Standardize portfolio reporting
Apply the same scoring and tie-breaking rules across projects before combining their risk summaries.
Prepare a governance review
Produce ranked, owned, and mitigation-ready rows for a steering committee or audit evidence pack.
FAQ
How is the risk score calculated?
The score is likelihood multiplied by impact. With both ratings limited to integers from 1 to 5, the score ranges from 1 to 25.
What happens when two risks have the same score?
The risk with greater impact ranks first, followed by greater likelihood. If both ratings match, the original input order is preserved.
Which priority bands are used?
Scores from 20 to 25 are critical, 12 to 19 are high, 6 to 11 are medium, and 1 to 5 are low.
Are owner and mitigation required?
No. They are optional. Empty optional values are omitted from the generated rows instead of appearing as null fields.
What if a rating is outside the scale?
The request fails with an invalid input error if likelihood or impact is not an integer from 1 to 5.
How much does a request cost?
The API price is $0.002 per request. The calculation can also run in the browser for the free interactive experience.
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/doc/risk-register-template \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"risks":[{"risk":"Key supplier misses the launch date","likelihood":4,"impact":5,"owner":"Procurement","mitigation":"Qualify a backup supplier before final approval."},{"risk":"Training attendance is lower than planned","likelihood":3,"impact":2,"owner":"Change team"},{"risk":"A reporting defect delays weekly metrics","likelihood":2,"impact":3}]}'const res = await fetch("https://api.kit.forhosting.com/doc/risk-register-template", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"risks": [
{
"risk": "Key supplier misses the launch date",
"likelihood": 4,
"impact": 5,
"owner": "Procurement",
"mitigation": "Qualify a backup supplier before final approval."
},
{
"risk": "Training attendance is lower than planned",
"likelihood": 3,
"impact": 2,
"owner": "Change team"
},
{
"risk": "A reporting defect delays weekly metrics",
"likelihood": 2,
"impact": 3
}
]
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/doc/risk-register-template",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"risks": [
{
"risk": "Key supplier misses the launch date",
"likelihood": 4,
"impact": 5,
"owner": "Procurement",
"mitigation": "Qualify a backup supplier before final approval."
},
{
"risk": "Training attendance is lower than planned",
"likelihood": 3,
"impact": 2,
"owner": "Change team"
},
{
"risk": "A reporting defect delays weekly metrics",
"likelihood": 2,
"impact": 3
}
]
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/doc/risk-register-template", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"risks":[{"risk":"Key supplier misses the launch date","likelihood":4,"impact":5,"owner":"Procurement","mitigation":"Qualify a backup supplier before final approval."},{"risk":"Training attendance is lower than planned","likelihood":3,"impact":2,"owner":"Change team"},{"risk":"A reporting defect delays weekly metrics","likelihood":2,"impact":3}]}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"risks":[{"risk":"Key supplier misses the launch date","likelihood":4,"impact":5,"owner":"Procurement","mitigation":"Qualify a backup supplier before final approval."},{"risk":"Training attendance is lower than planned","likelihood":3,"impact":2,"owner":"Change team"},{"risk":"A reporting defect delays weekly metrics","likelihood":2,"impact":3}]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/doc/risk-register-template", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"risks": [
{
"risk": "Key supplier misses the launch date",
"likelihood": 4,
"impact": 5,
"owner": "Procurement",
"mitigation": "Qualify a backup supplier before final approval."
},
{
"risk": "Training attendance is lower than planned",
"likelihood": 3,
"impact": 2,
"owner": "Change team"
},
{
"risk": "A reporting defect delays weekly metrics",
"likelihood": 2,
"impact": 3
}
]
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "doc.risk_register_template",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 25 |
max_pages | 200 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |