How are the 141 risks organized?
By the same 21 categories and risk IDs as our free Risk Register (PR-001, FR-003 and so on), so the two line up row for row. Each risk has a mapped control, linked KRIs where the KRI Library has them (all 152 KRIs, across 100 risks), inherent and residual scores, design and operating ratings, and a written rationale.
What scale does it use?
One 4×4 scale everywhere: likelihood 1–4 times impact 1–4. Critical is 12–16, High 8–9, Medium 3–6, Low 1–2. Design and operating effectiveness are rated separately and combined into Effective, Adequate or Weak. The Risk Rating Methodology tab has the definitions and five guardrails that the Rating Check column applies automatically.
Can business owners without a risk background fill it in?
That is what the questionnaire is for. Each of the 97 questions says what good looks like and which evidence to ask for, and the answer scale is plain: Yes, Partial, No or N/A. Every Partial or No needs a risk level, action, owner and date, and the sheet flags any that are missing.
Do I need existing controls documentation?
No. The guide has a chapter on starting from nothing: using the RCSA interviews to document controls as you find them, using KRIs, incidents and audit findings as indirect evidence, and a two- to three-day documentation sprint.
What does the Board see?
The Board Summary tab: risks assessed, Critical and High residual risks, Weak controls, percent tested, overdue actions, the top 5 residual risks with owners and dates, a residual heat map, your commentary and the decisions you need. Every number is a formula; it prints on one landscape page.
How long does the first cycle take?
The guide lays out a 30-day plan: set-up and scoping, business-owner self-assessment, second-line challenge and testing, then finalizing and reporting. Actual timing depends on your scope, owner availability and how much evidence already exists.
Can I share completed outputs externally?
Yes. You can use completed outputs with auditors, customers, bank partners, regulators, and internal stakeholders. Customize the template for internal business use — just don't resell or redistribute the source template files.
How do I receive the files?
Checkout is handled through Stripe. After payment, download every file immediately from the confirmation page. RiskTemplates also emails a secure access link, and Stripe sends the payment receipt separately. No account is required.
What if it's not a fit?
Email within 30 days for a full refund, no questions asked. The guarantee is meant to remove purchase risk while you evaluate whether the template fits your use case.
