What a risk register is for

A risk register turns vague worry into a ranked, owned, trackable list, so attention and budget go to the exposures that matter most — and so you can show how the picture changed over time. The score isn't the goal; the decision it drives is.

A risk you can't state as a likelihood and an impact is a worry, not a risk. Forcing both onto a scale is what makes risks comparable — and comparison is the whole point of a register.

Likelihood × Impact (5×5)

Each risk carries an inherent score — the exposure before any treatment is applied — and an optional residual score reflecting what's left after the treatment plan is in place. Both are simple likelihood (1–5) × impact (1–5) products.

Most risk-management references (NIST SP 800-30 Rev 1, ISO 31000, COSO ERM) start with this 5×5 form. It's coarse but defensible and fits on a heatmap.

Severity tiers

The score (1–25) maps to four tiers: low (1–3), moderate (4–9), high (10–15), critical (16–25). The colored pills in the list and the heatmap cells reflect those bands.

Score consistently, and mind the false precision

A 5×5 only helps if a "3" means the same thing every time and to everyone — write down what each level means and rate against it, not against today's mood. And don't over-read the math: the matrix ranks and groups risks, it doesn't measure them. When a decision needs real numbers, move to a quantitative method — loss frequency × loss magnitude, estimated in ranges — instead of pretending the grid is precise.

Treat, then track the residual

Every risk ends in one of five dispositions. Set the residual score once controls are in place, so you can see what the treatment actually bought you.

• Open — under analysis, no treatment yet
• Mitigated — controls in place; residual score should be set
• Accepted — risk owner has formally accepted the exposure
• Transferred — insured / contractually shifted to a third party
• Avoided — activity discontinued; risk no longer applies

Going deeper

The 5×5 lineage runs through NIST SP 800-30 Rev 1, ISO 31000, and COSO ERM. When qualitative scoring stops being enough, the quantitative path is FAIR (Factor Analysis of Information Risk) — see Hubbard & Seiersen, How to Measure Anything in Cybersecurity Risk. Feed compliance findings in from PumaGRC2 via .pumapack.

Where your risks live

PumaRisk stores everything in your browser's sessionStorage under the pumarisk.* prefix — on this device, in this browser, and nowhere else. There is no server, no account, and nothing you type ever leaves your machine.

Backing up

The topbar Export button writes a full backup of every workspace as .pumapack JSON. ⌘S / Ctrl+S writes the same full backup as a .json file. To restore, drag either file onto the window or use the topbar Import button.

Rule of thumb: export weekly. Drop the JSON in iCloud Drive, Dropbox, your Git repo — it's just a file.

Clear all local data

About PumaRisk

PumaRisk is a lightweight, portable, offline quantitative risk register that runs entirely in your browser. Build a register, score and rank risks, and model treatment options, all from a single file.

This tool is provided as-is, with no warranties or guarantees. It is not professional advice. By using it you accept full responsibility for any outcomes that result from your use.

About PumaWorx

PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.