What it is
A written risk assessment is the foundation of a security plan under the FTC Safeguards Rule. It names the information at risk, the threats and weaknesses, rates each risk and says what the firm will do about it.
The workbook has 40 risk rows with likelihood and impact scoring before and after safeguards, a rating from your cutoffs, planned safeguard, owner, due date and status. Flags show high risks with no action and overdue actions, and a summary shows counts and average scores.
When to use it
- Annual assessment for the written plan.
- After a system or vendor change.
- After an incident.
What’s inside
- 40 risk rows with inherent and residual scores
- Planned safeguards with owner and due date
- Flags for no action, overdue and accepted without note
- Summary with ratings and averages
Standard cited
This template follows 16 CFR 314.4(b). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What does the rule ask for?
16 CFR 314.4(b) asks a covered institution to base its program on a written risk assessment that identifies reasonably foreseeable risks, sets criteria to evaluate them and describes how the risks will be mitigated.
Which risks should I list?
Write your own. Typical ones include stolen credentials, phishing, ransomware, lost devices, misdirected email, vendor breach and unpatched software.
How often should it be redone?
At least yearly and when systems, vendors or practices change.
Related templates
- Written Information Security Plan (WISP) for CPA Firms
- Firm Technology and Data Inventory Register (Excel)
- Security Incident Log and Notification Tracker (Excel)
- Risk Register
Last updated 11/05/2026. All free templates.