Risk Burn-down Chart Template

A risk burn-down chart does for risk what a sprint burn-down does for remaining work: one line, tracked over time, that should trend down as mitigations land — and whose failure to trend down is itself the signal worth noticing. It turns the Risk Register's Score column from a static snapshot into a story about whether the project's risk exposure is actually shrinking.

What to plot

At the end of each sprint (or each week, for a shorter project), sum the Score column across every open row in the risk register — closed and accepted risks drop out of the total, since they're no longer active exposure. That single number is your project's total risk exposure for that point in time. Plot it against sprint number or date; nothing more sophisticated is needed for this to be useful.

Copyable CSV template

Copy this into a spreadsheet the same way as the register template — header row included, comma-delimited.

Sprint,Date,Total Open Exposure,Risks Closed This Sprint,Notes
1,2026-08-04,23,0,Baseline: five risks identified at kickoff
2,2026-08-11,23,0,No mitigation work started yet
3,2026-08-18,20,0,R-05 downgraded after re-scoring likelihood
4,2026-08-28,15,1,R-03 mitigated: rollback script written and tested
5,2026-09-01,11,1,R-02 mitigated: runbook written, second engineer trained
6,2026-09-08,11,0,No change; R-01 still open, queue implementation in progress

Building the chart

  1. Select the Sprint (or Date) and Total Open Exposure columns.
  2. Insert a line chart (Excel: Insert → Charts → Line; Google Sheets: Insert → Chart, then set chart type to Line).
  3. Label the y-axis "Total Risk Exposure (sum of open L×I scores)" so a reader doesn't mistake it for a count of risks — five small risks and one huge one can produce the same total, and that distinction matters when someone asks why the line didn't move.
  4. Optionally add a second series for Risks Closed This Sprint as bars on a secondary axis, so a flat exposure line and zero closures in the same sprint are visible together — that combination is the clearest sign a register has stopped being acted on.

Reading it honestly

  • A flat or rising line is real information, not a failure to hide. It usually means new risks are being identified faster than existing ones are mitigated — which is often correct behaviour early in a project, when discovery dominates, and a problem later, when it should be converging.
  • A smoothly falling line with no new risks ever added is suspicious, not reassuring. It's more consistent with a register nobody is actively hunting for new risks in than with a project that has genuinely run out of things to worry about — the same discipline this site's material on Risk Management: Lessons from Testing Real Systems argues for elsewhere: a suspiciously clean result deserves the same scrutiny as a bad one, not less.
  • A single large risk can dominate the whole chart. If one row has a much higher score than the rest, the total-exposure line will mostly track that one row's status — worth calling out separately in project reporting rather than letting it hide inside an aggregate number.

See Risk Management for the full scoring model and mitigation-strategy framework this chart's numbers are drawn from.