For consultants keeping a project on track
RAID Log Template With Scales and Examples
A RAID log that tracks a project's risks, assumptions, issues, dependencies and decisions in five sheets, with worked examples, scoring scales and a weekly review.
The scoring scales
How to score a risk from 1 to 5
Score each open risk from 1 to 5 for likelihood and for impact, then multiply the two for a score out of 25. In a 2008 Risk Analysis paper, Louis Anthony Cox Jr. showed that risk matrix ratings rest on judgment, and different users may rate the same risk in opposite ways5. So write down what each number means, and agree on the scales with your sponsor before anyone scores.
| Score | Likelihood | Schedule impact | Cost impact | Scope and quality impact |
|---|---|---|---|---|
| 1 | Rare: under 10% | Under a week, no milestone moves | Under 1% of budget | No visible effect |
| 2 | Unlikely: 10 to 30% | 1 to 2 weeks, no milestone moves | 1 to 3% of budget | A small change the team absorbs |
| 3 | Possible: 30 to 50% | A milestone moves up to 2 weeks | 3 to 5% of budget | A deliverable needs a workaround or is reduced |
| 4 | Likely: 50 to 80% | A key milestone or go-live moves 2 to 6 weeks | 5 to 10% of budget | A deliverable fails acceptance the first time |
| 5 | Almost certain: over 80% | Go-live or the end date moves more than 6 weeks | Over 10% of budget | A core objective or the business case is at risk |
Score impact by the worst column that applies. The score out of 25 sets the rating: 20 to 25 is Critical, 10 to 16 High, 5 to 9 Medium and 1 to 4 Low. These are starting scales, not a standard: the UK government's risk management guidance2 says "the risk matrix needs to be tailored to suit the work." So resize the cost bands to your budget: 5% is $2,500 on a $50,000 project and $250,000 on a $5 million one.
How it works
What is a RAID log, and what goes in it?
A RAID log is one record of a project's risks, assumptions, issues and dependencies, each with an owner and a date. A risk might happen, while an issue already has and needs action now. An assumption is something you plan on without proof, and a dependency is something you need from someone else by a date. The UK government's Gate 2 review workbook1 puts decisions and constraints registers in the log too, and says each register should reference the others.
Write each risk as cause, event and impact, as the UK government's risk management guidance2 recommends. For example: "Because the test environment arrived late, the migration test may slip, which would delay go-live." Give every entry one named owner, never a team, and two dates: the day it was raised and the next one that matters. The Association for Project Management defines assumptions3 as statements "taken for granted as fact," so give each one a date to confirm it by.
Review the log before each weekly status report goes out: re-score open risks, check overdue assumptions and chase dependencies due within four weeks. Then report every Critical or High risk and issue, any dependency at risk or late, and decisions due within two weeks. The status report generator can draft that update from the log. Close entries instead of deleting them, and at the end, hand each open one to a named client owner in your project closure report.
How it works
From scattered notes to a RAID log
Download it or open it in River
Get the guide and five sheets free as Word and CSV files, or click Edit with AI to work on them in River.
River sorts your notes
If you pasted a status update, meeting notes or a risk list, River sorts every point onto the right sheet, replacing the examples.
Check the first pass
Confirm or change each score marked proposed, then fill in the owners and dates left in brackets, using the To confirm list.
Review it every week
Run the 30-minute review in the guide, then ask River to draft your status update from the log in a new doc.
| Entry | Owner | Rating or date | Next step |
|---|---|---|---|
| R-02 · Depot 3 go-live lands in peak season | Operations director | 4 × 5 = 20 · Critical | Steering committee decides on 26 Aug |
| A-01 · Two super-users per depot from 1 Sep | Operations director | Validate by 15 Aug | Confirm with the three depot managers |
| I-01 · Test environment arrived 9 days late | Project manager | High | Two weekend build days; escalated |
| DEP-01 · Carrier label connection (external) | Client IT lead | Needed by 29 Aug | At risk: sponsor to call the carrier |
| DEC-03 · Move Depot 3 go-live to January? | Steering committee | Needed by 26 Aug | Recommended: move to 12 Jan |
Example entries from an invented warehouse system rollout.
What you'll get
Five RAID sheets with scoring scales and worked example entries
- A sheet each for risks, assumptions, issues, dependencies and decisions
- Likelihood and impact scales from 1 to 5, with what each score means
- Worked example entries, or a first pass sorted from your own notes
Before and after
Your notes in. A sorted RAID log out.
Vendor's test environment came 9 days late, so sprint 2 started late. Depot 3 go-live is 20 Oct and peak starts 1 Nov, worried. Still no label connection details from the carrier after three emails. Planning on two super-users per depot from September.
Risks R-01 · Because peak starts on 1 Nov, any slip in Depot 3's 20 Oct go-live would put go-live support in peak, which could delay deliveries. Owner: [owner]. 4 × 5 = 20, Critical (proposed). Assumptions A-01 · Two super-users per depot from September. Validate by: [date]. Issues I-01 · The vendor's test environment arrived nine days late, so sprint 2 started late. High (proposed). Dependencies DEP-01 · Carrier label connection details. External, we need. Needed by: [date]. At risk.
Scores are marked proposed, and owners and dates your notes don't give stay in brackets.
What lands in your doc
What's inside the RAID log template
- RAID Log Guide
The scoring scales and bands, rules for every entry, issue priorities, a 30-minute weekly review and a worked example. - Risks sheet
Each risk as cause, event and effect, scored 1 to 25, with a trigger, a mitigation and a contingency. - Assumptions sheet
Each assumption with a validate-by date, who confirms it and what changes if it proves false. - Issues sheet
Priority from Critical to Low, the action and target date, who it was escalated to and linked entries. - Dependencies sheet
Internal or external, which way it runs, who provides it, the date you need it and the plan if late. - Decisions sheet
What was decided, by whom and when, the options and why. A changed decision is superseded, never edited.
Questions consultants ask
Common questions
What is a RAID log, and what does RAID stand for?
RAID stands for risks, assumptions, issues and dependencies. A RAID log keeps all four in one place, so you can see how they affect each other. A late dependency can become an issue, and a false assumption a risk. Some teams read the A as actions or the D as decisions. This template gives decisions a sheet of their own.
What's the difference between a risk and an issue?
A risk hasn't happened yet, and an issue has. The UK government's issue management guidance4 defines an issue as "a relevant event that has happened, was not planned and requires management action." When a risk happens, close it as "Happened, see I-03" and open the issue, so the history stays linked and nobody tracks one problem twice.
How do you score likelihood and impact?
Score each from 1 to 5 against written definitions and multiply them. In this template, 20 to 25 is Critical and goes to the steering committee; 10 to 16 is High. Treat the score as a rough guide, not a precise ranking. In 2008, Louis Anthony Cox Jr. showed that risk matrices can give a smaller risk a higher rating than a bigger one5.
How often should a RAID log be updated, and who keeps it?
Review it every week, before the status report goes out. One person, usually the project manager, keeps the log current. Each entry still has its own owner, often on the client side, since only the client can supply its data, people and decisions. Share the log with the client, and keep notes about your own firm's staffing or margin somewhere else.
Is a RAID log the same as a risk register?
No. A risk register holds only risks, while a RAID log keeps them beside the assumptions, issues and dependencies that feed them. The UK government's risk management guidance2 says "significant assumptions should be treated as risks," so log those as both assumptions and risks. On a small project, the RAID log can replace a separate risk register.
Is this RAID log template free?
Yes. Download the RAID Log Guide as a Word document and the five sheets as CSV files, with no signup. The sheets come filled with example entries from an invented warehouse rollout, so you can see a working log before clearing them. Edit with AI opens the same template in a free River workspace, and paid plans add more AI use.
What does Edit with AI do?
It opens the guide and five sheets in a free River workspace. If you paste project notes, River swaps the examples for your own entries, each on the right sheet, with scores marked proposed. Owners and dates your notes don't give stay in brackets, listed under To confirm in the guide. With no notes, River changes nothing and offers to clear the examples.
Your next step