An Excel register for the risks and opportunities your quality management system has to address. Score each line by likelihood and impact, let the formulas rate it, plan the action, and track the residual score once the action is done.
Quality managers building or maintaining an ISO 9001 or IATF 16949 system, and process owners who own individual risks. It is meant for business- and process-level risks, not part-level failure modes, which belong in a PFMEA.
When you first set up the QMS, after each review of internal and external issues, before every management review, and whenever a major change (new customer, supplier, product line or site) creates new risks or opportunities.
Tip: The thresholds are cells, not constants in the formulas. Change them once at the top of the sheet and every rating updates.
Header
Company, register owner, last review date, and the High and Medium score thresholds
Identification
ID, type (risk or opportunity), description and the process or source it comes from
Assessment
Likelihood and impact on a 1–5 scale, with the score and rating calculated
Treatment
Planned action, owner and due date
Residual
Re-scored likelihood and impact after the action, with the residual score calculated
Summary
Counts of High, Medium and Low lines, open actions and the highest score
Example Register for Example Precision Co., a fictional machine shop. Thresholds: High at a score of 15 or more, Medium at 8 or more. The lines and scores are invented for illustration.
| ID | Type | Description | L | I | Score | Rating | Action / owner | Residual | Status |
|---|---|---|---|---|---|---|---|---|---|
| R-01 | Risk | Single source for 4140 bar stock; a supplier delay stops two lines | 3 | 5 | 15 | High | Qualify a second supplier / Purchasing, 2026-09-30 | 2 × 5 = 10 | Open |
| R-02 | Risk | Only one operator qualified on CNC cell 3 | 4 | 3 | 12 | Medium | Cross-train a second operator / Operations, 2026-08-31 | 2 × 3 = 6 | Open |
| R-03 | Risk | Overdue gauge calibration goes unnoticed | 2 | 4 | 8 | Medium | Monthly calibration due-date report / Quality, 2026-07-31 | 1 × 4 = 4 | Closed |
| O-01 | Opportunity | A customer wants suppliers to offer anodizing | 2 | 4 | 8 | Medium | Compare in-house and outsourced cost / Sales, 2026-10-31 | — | Open |
| R-04 | Risk | Paper travelers lost between operations | 2 | 2 | 4 | Low | Accepted; monitor through NCR trend / Quality | 2 × 2 = 4 | Accepted |
| High | 1 |
|---|---|
| Medium | 3 |
| Low | 1 |
| Open actions | 3 |
| Highest score | 15 |
| Field | What to enter | Example |
|---|---|---|
| Type | Risk (a possible negative effect) or Opportunity (a possible benefit). Both belong in the same register. | Opportunity |
| Description | Cause and effect in one sentence, so the action can target the cause. | Single source for bar stock; a delay stops two lines |
| Process / source | The process or the context issue it comes from. This links the register to your process map. | Purchasing |
| Likelihood (1–5) | How likely the event is in the review period on your agreed scale, 1 being rare and 5 almost certain. | 3 |
| Impact (1–5) | For risks, the severity of the effect on customers, product or compliance. For opportunities, the size of the benefit. | 5 |
| Score / Rating | Calculated: likelihood × impact, rated against the thresholds in the header. Do not type over these cells. | 15 / High |
| Planned action | What will be done, sized to the rating. "Accept and monitor" is a valid action for Low lines if you say how. | Qualify a second supplier |
| Owner / Due date | A named role and a real date. | Purchasing, 2026-09-30 |
| Residual L / I | Re-scored after the action is complete. A residual score that does not drop shows the action did not work. | 2 / 5 |
| Status | Open, Closed or Accepted. Only "Open" lines count as open actions in the summary. | Open |
No. ISO 9001:2015 requires you to determine and address risks and opportunities, but does not require a specific document or method. A register is the most common way to show an auditor you have done it.
A PFMEA analyzes how a specific process step can fail to make a good part. The risk register covers business and QMS-level risks such as supplier dependence, staffing and compliance. They can reference each other.
It is a simple, widely used way to rank lines on one scale. It is not required; some organizations use a matrix lookup or a weighted score. Whatever you choose, define it and apply it consistently.
With the same scale, reading impact as the size of the benefit. A high score means the opportunity deserves a decision, not that it is dangerous.
At least before each management review, and whenever a significant change, corrective action or audit finding points to a new or changed risk.
COPLAIN AI PLATFORM
Coplain’s Auditor Review checks your QMS procedures against ISO 9001, including how they address risks and opportunities, and lists the gaps to add to this register.
Generate yours automatically with Coplain →Related Tools & Templates