Risk & Change
IT Risk Assessment
MyPMP
QMS Template
| Ref | Risk / event | Likelihood | Impact | Response | Owner | Status |
|---|---|---|---|---|---|---|
βοΈ
Free to try β your work auto-saves in this browser.
Saving to the cloud (sync across devices) is a paid feature. Unlock IT Risk Assessment for $1/mo, or get everything with membership ($9/mo or $99/yr).
β οΈ Risk & Change
Auto-saved in your browser Β· β members can white-label & sync across devices
About the IT Risk Assessment template
An IT Risk Assessment is a structured evaluation of threats to your information systems, data, and infrastructure, scoring each by likelihood and impact so you can prioritize mitigation. It underpins compliance frameworks like ISO 27001, NIST, and SOC 2, and gives stakeholders a defensible record of how technology risk is being managed.
It's part of My QMS, MyPMP's Quality Management System: fill it in online, personalize it with your name and logo, then export a clean, branded PDF. Your work auto-saves in your browser.
When to use a IT Risk Assessment
- βΈBefore deploying new systems, cloud migrations, or major infrastructure changes
- βΈDuring annual security reviews or ISO 27001 / SOC 2 audit preparation
- βΈAfter a security incident or discovered vulnerability to reassess exposure
- βΈWhen onboarding third-party vendors or evaluating supply-chain dependencies
What a good IT Risk Assessment includes
- βAsset or system inventory with owner and data classification
- βThreat and vulnerability description (e.g. ransomware, misconfiguration, insider access)
- βLikelihood and impact ratings with a calculated risk score or heat-map position
- βExisting controls and their assessed effectiveness
- βTreatment decision: accept, mitigate, transfer, or avoid, with residual risk
- βAction owner, remediation deadline, and review date
What's inside this template
The interactive form above gives you:
A table of Ref, Risk / event, Likelihood, Impact, Response, Owner, StatusNotes
Tips & common mistakes
- π‘Rate risk on the residual level after existing controls, not the raw inherent threat, or you'll over-prioritize already-mitigated items
- π‘Use a consistent scoring scale across all entries so the register stays comparable and defensible at audit
- π‘Assign a named owner and date to every treatment action; unowned risks are the ones that stall
How it works
- 1. Fill it in β type directly into the fields, tables and sections above.
- 2. Brand it β add your organization name and logo with the Branding button.
- 3. Export β print to PDF, or become a member to white-label and sync across devices.
FAQ
What's the difference between inherent and residual risk?οΌ
Inherent risk is the exposure before any controls are applied; residual risk is what remains after your existing safeguards. Treatment decisions should be based on residual risk against your appetite threshold.
How do I calculate an IT risk score?οΌ
Multiply the likelihood rating by the impact rating (commonly on 1-5 scales) to produce a score, then map it onto a heat-map or tiered band such as low, medium, high, or critical.
How often should an IT risk assessment be updated?οΌ
Review it at least annually and additionally after major changes such as new systems, incidents, vendor changes, or regulatory updates. Frameworks like ISO 27001 expect ongoing, documented reassessment rather than a one-off exercise.
Make it yours β $9/mo or $99/yr
Membership unlocks white-label export (remove the MyPMP footer), cloud sync across devices, plus all apps & ScheduleX.
See membershipRelated free apps