Project Risk Assessment Questionnaire Template: 46 Questions That Actually Surface Risk

The Project Management Institute reported in its 2026 Pulse of the Profession that 80 percent of complex projects suffer distinct negative fallout when complexity is badly managed, and that the average affected project carries 2.1 separate problems at the same time.

Figure 1. Problems arrive in clusters, which is why single-question checklists miss them.

Most of those problems were visible to somebody on the team before they landed. A project risk assessment questionnaire is the instrument that gets them said out loud early, while a response still costs a meeting rather than a milestone.

Project Risk Assessment Questionnaire: Key Takeaways
The Project Management Institute’s 2026 Pulse of the Profession found that 80 percent of complex projects suffer distinct negative fallout when complexity is poorly managed, with an average of 2.1 separate issues hitting at once.
A risk assessment questionnaire earns its place only if every question produces a scoreable answer. Asking whether the schedule is realistic yields reassurance; asking which critical-path task has the least float yields a number.
This template runs 46 questions across eight domains: scope, schedule, cost, resources, technical, vendors, stakeholders and compliance. Each maps to a register field so answers become entries rather than meeting notes. The compliance block deserves particular care; the role of the project manager in compliance risk management explains why those questions carry enterprise-level stakes.
Interview individually before workshopping collectively. Group settings suppress the bad news that a project risk assessment questionnaire exists to surface, particularly from junior staff.
Score answers on anchored bands, not a bare one-to-ten scale. Likelihood as a percentage range and impact in dollars and days makes two people’s ratings comparable.
A questionnaire that stops at the answer is a survey. The output has to reach a named owner, a trigger condition and a funded response, or the exercise changes nothing.

We run these risk assessment questionnaire interviews for delivery organizations every month, and the failure mode is remarkably consistent. The questionnaire asks comfortable questions, everyone answers reassuringly, and the finished document becomes evidence that nobody could possibly have seen it coming.

What Separates a Working Risk Assessment Questionnaire From a Survey

The distinction is whether an answer can be scored. A question that invites yes or no gives you a sentiment; a question that demands a name, a count or a date gives you something you can rate, rank and put in front of a sponsor.

Figure 2. Same underlying risk, two very different yields.

Notice exactly what changes in the right-hand column of the comparison above. Each rewrite forces the respondent either to look something up or admit they cannot, and that inability is itself a finding, as our guide to what a risk assessment is and the complete assessment guide both set out.

Question property	Why it matters	Test to apply
Demands specificity	Vague answers cannot be scored or challenged later	Could two people give contradictory answers and both be right? Rewrite it
Names a thing	Risks attach to named tasks, roles, suppliers and systems	Does the answer contain a proper noun or a number?
Bounded in time	Unbounded risk questions collect anxiety rather than exposure	Is the window stated: this sprint, this quarter, before go-live?
Maps to a register field	Answers that fit nowhere get lost between the interview and the plan	Which column does this populate: likelihood, impact, owner, trigger?
Survives a follow-up	The second question is where the real answer usually lives	Is there an obvious how do you know that follow-up?

The Eight Domains Every Project Risk Assessment Questionnaire Should Cover

Coverage beats depth on the first pass of any risk assessment questionnaire. Eight domains catch almost everything that damages delivery, and the point of fixing the list in advance is that a team cannot quietly skip whichever section it finds awkward.

Figure 3. Forty-six questions, distributed so no domain gets skipped.

Domain weighting inside the risk assessment questionnaire should shift with the project rather than staying fixed. A regulated implementation loads compliance and vendors heavily, while an internal tooling build loads technical and resources, and ISO 31000’s context-setting step is where that judgement belongs, with a scoring matrix template and the three lines model settling how it gets challenged.

Scope, Schedule and Cost Questions for the Risk Assessment Questionnaire

These first three domains carry the classic delivery risks, and the ones sponsors tend to ask about first in almost any review. Note how each risk assessment questionnaire item below produces a figure or a name rather than a general impression.

Domain	Questions
Scope	1. How many requirements changed in the last 30 days? 2. Which deliverable has no written acceptance criteria? 3. Who can approve a scope change without escalation? 4. Which assumption, if wrong, invalidates the current plan? 5. What is explicitly out of scope, in writing? 6. Which stakeholder has not signed the current scope baseline?
Schedule	7. Which critical-path task has the least float, in days? 8. Which estimate came from one person with no challenge? 9. What is the longest lead-time item and when was it ordered? 10. Which dependency sits outside this project’s control? 11. How many days of contingency remain in the schedule? 12. Which milestone has slipped already, and by how much?
Cost	13. What percentage of budget is committed but not yet spent? 14. Which cost line is based on a single quote? 15. How much contingency reserve remains, in dollars? 16. Which exchange rate, rate card or index could move against us? 17. What triggers a request for management reserve?

Question seven does more work than any other item on the whole list. Float measured in days converts a vague argument about whether the schedule feels tight into a measurable exposure that a project risk management plan can price and track.

Resource, Technical and Vendor Questions for the Risk Assessment Questionnaire

This middle block of the risk assessment questionnaire surfaces the dependencies that teams have quietly normalized over time. People rarely volunteer that a single contractor holds the only working knowledge of a system, but they will answer a direct question about it.

Domain	Questions
Resources	18. Which named role has no identified backup? 19. What notice period would that person serve? 20. Which skill exists in only one head? 21. How many team members are shared with another project, and at what allocation? 22. Which approval depends on one individual’s availability? 23. What is the team’s current attrition rate?
Technical	24. Which component has never been tested at production volume? 25. What is the rollback procedure, and when was it last exercised? 26. Which third-party library or model is unsupported or end-of-life? 27. How much of the codebase was AI-generated and reviewed at what depth? 28. Which environment differs materially from production? 29. What is the current test coverage on the critical path?
Vendors	30. Which supplier could we not replace within one sprint? 31. What are the contractual remedies if they miss a date? 32. When does the contract expire relative to go-live? 33. Which vendor holds our data, and under what terms? 34. Has this supplier’s financial position been checked this year? 35. Which two suppliers share a single upstream dependency?

Question 27 is new to this risk assessment questionnaire template, and increasingly the decisive one. Teams shipping code pair it with the controls in our guide to software development risk and the practices in NIST’s Secure Software Development Framework, mapping cyber exposure to NIST CSF 2.0 and model exposure to the NIST AI Risk Management Framework.

Stakeholder and Compliance Questions for the Risk Assessment Questionnaire

The final block of the risk assessment questionnaire catches risks arriving from outside the delivery team entirely. They tend to be the ones with the longest lead time to fix, which is exactly why they belong in an early assessment.

Domain	Questions
Stakeholders	36. Which stakeholder has not engaged in the last month? 37. Who could veto this project, and what would trigger that? 38. Which business unit absorbs the change at go-live, and are they ready? 39. What has this sponsor cancelled before? 40. Which decision is currently waiting on someone outside the team?
Compliance	41. Which regulation applies, and who confirmed that? 42. What personal or regulated data does this project touch? 43. Which control will an auditor test first? 44. What disclosure obligation could this project trigger? 45. Which approval must precede go-live, and how long does it take? 46. When was legal last shown the current scope?

Question 44 has grown real teeth for public companies over the past two years. The SEC cybersecurity disclosure rule compresses a materiality judgment into four business days, so a project touching customer data carries a reporting consequence its plan should already name.

Scoring the Risk Assessment Questionnaire Responses

Risk assessment questionnaire answers without an agreed scoring rule become a long document that nobody ever prioritizes. The rule needs anchors, because a bare one-to-ten scale means something quite different to the architect than it does to the finance partner.

Score band	What the answers looked like	What happens next
15 to 25	A named single point of failure with no backup and a live dependency	Sponsor sees it this week; response funded from contingency
8 to 12	A real exposure with a workaround that has not been tested	Owner assigned, trigger written, tracked at sprint review
4 to 6	A known weakness inside one workstream’s control	Monitored, response drafted, not yet funded
1 to 3	Theoretical unless conditions change materially	Logged, reviewed monthly, no action

Use the same anchors your plan already uses, or the two artifacts will quietly disagree with each other. Our comparison of 5×5 against 4×4 scoring covers the grid choice, and a ready risk matrix template settles the arithmetic before the first interview. PMI’s 2025 research and COSO’s enterprise guidance both reward that consistency.

Figure 4. The questionnaire is the first step of four, not the deliverable.

The handoff at step three is where most risk assessment questionnaire exercises die quietly. An answer that never becomes a register row with an owner and a trigger has cost the team an hour and changed nothing about the project.

Running the Risk Assessment Questionnaire Without Getting Polite Answers

How you choose to administer the risk assessment questionnaire matters every bit as much as the content itself. The same 46 questions produce very different answers depending on who is in the room and whether the respondent believes candour is safe.

Method	Best for	What it costs you
One-to-one interview	Surfacing what people will not say in front of the sponsor	Time: 45 minutes per person, and it is worth every minute
Written pre-fill then interview	Technical domains where respondents need to look things up	Some candour; written answers get self-edited
Facilitated workshop	Building shared understanding after individual interviews	Suppresses minority views and junior voices
Anonymous survey	Large teams and culturally sensitive contexts	No follow-up questions, which is where the real answer lives
Delphi rounds	Expert estimation where opinion is genuinely split	Slow; usually reserved for high-value uncertainty

Our settled position on this is that individual interviews come first, always, and without exception. Workshops are excellent for building consensus and terrible for discovering that the integration nobody wants to discuss has never once been tested end to end.

Structured technique selection is a long-solved problem rather than a matter of individual personal taste. IEC 31010 catalogues the assessment methods and their limits, sitting alongside ISO 31000:2018 and PMI’s risk management standard when someone insists a single workshop is enough.

Red Flags to Watch in Risk Assessment Questionnaire Results

A completed risk assessment questionnaire tells you about the project and, quite separately, about the team’s willingness to discuss it honestly. Both readings matter, and the patterns below usually mean the second reading is the more urgent of the two.

Red flag	What it usually means	What to do
Everything scored medium	Respondents avoiding escalation, not a balanced project	Force-rank the top five; the list cannot be flat
No risks from the delivery team	People do not believe raising risk is safe	Interview individually and anonymise the first pass
Every answer is a sentence, none a number	Questions were too soft, or respondents deflected	Rewrite the questions and re-ask the specific ones
Compliance section left blank	Nobody owns it, which is itself the finding	Log the ownership gap as a risk and escalate it
Identical answers across respondents	Pre-briefed, or a workshop ran before the interviews	Re-run one-to-one with the two most junior participants
No answer mentions a named supplier	Vendor risk is being treated as procurement’s problem	Re-ask domain six with the contract in front of you

The first row is the one we encounter most often by far. A register where nothing scores high is not a low-risk project, it is one where scoring something high carries social consequences, and buyer expectations set by CISA’s Secure by Design initiative now make that silence expensive.

Risk Assessment Questionnaire: Your Questions Answered

What is a project risk assessment questionnaire?

It is a structured set of questions used to surface, score and record risks on a specific project. Unlike a generic checklist, a working questionnaire is written so that every answer produces something scoreable and traceable into the risk register.

How many questions should a risk assessment questionnaire have?

Enough to cover every domain and few enough that people still answer carefully, which in practice means 40 to 60 items. This risk assessment questionnaire template uses 46 across eight domains, sized for a 45-minute interview without rushing the technical sections.

Who should complete the project risk assessment questionnaire?

Interview the delivery team, the technical leads, the business owner absorbing the change, and at least one person outside the project who has watched something similar fail elsewhere. Sponsors answer a shorter version of the risk assessment questionnaire focused on appetite and escalation.

When should you run a risk assessment questionnaire?

Run the risk assessment questionnaire before architecture and scope baselines lock, then at each major phase boundary, and immediately after any material change to team, supplier or scope. Running it once at kickoff produces a snapshot that ages very badly.

How do you score risk assessment questionnaire answers?

Multiply an anchored likelihood band by an anchored impact band, using percentage ranges for likelihood and dollars or days for impact. Score bands then dictate the resulting action: sponsor visibility above 15, and a tracked response from 8 to 12.

What is the difference between a risk assessment questionnaire and a risk register?

The risk assessment questionnaire is the collection instrument; the risk management plan is the method, and the register is the living record it feeds. Answers become rows with owners, triggers and responses, and the register outlives the questionnaire by the whole project.

Can a risk assessment questionnaire template be reused across projects?

The eight domains transfer directly between projects, but the weighting and several of the individual questions should change every single time. Reusing an unmodified risk assessment questionnaire is how teams end up assessing the last project’s risks rather than this one’s.

Where the Risk Assessment Questionnaire Is Heading Next

Technical questions are absorbing the space that generic ones used to occupy. Question 27 on AI-generated code did not belong on a project questionnaire three years ago, and any template that has not added something like it is already dated.

Expect assurance functions to start reading the risk assessment questionnaire output directly rather than summaries. The IIA’s Three Lines Model puts challenge outside the delivery team, and a questionnaire with traceable answers is easier to audit than flipchart photographs. Credentials such as PMI’s Risk Management Professional and the ISO 31000 family are becoming the baseline expectation.

Federal delivery shows clearly where this ends up without real discipline behind it. GAO’s reviews of IT modernization repeatedly find programs years late where assessment happened but produced no decisions, and its 2026 duplication report puts addressable waste above $100 billion, a pattern its assessments of NASA’s major projects repeat almost line for line.

 

Put the Risk Assessment Questionnaire to Work This Week

Take the eight risk assessment questionnaire domains above and interview three people individually before your next steering meeting: one delivery lead, one technical lead, and the business owner. If the answers come back containing no numbers at all, the questions still need sharpening.

We build these risk assessment questionnaire cycles for delivery organizations, set the appetite thresholds behind the scoring, and define the indicators that keep answers current. Look through our advisory services or get in touch about the project whose risk picture you trust least.

Teams working alone should route the risk assessment questionnaire output somewhere durable rather than a slide. Feed the answers into a risk register with the fields a register needs, and settle the register versus log distinction before anyone starts typing.

Then connect the risk assessment questionnaire to the wider method that surrounds it. The eight-step project risk assessment, risk mitigation in project management, the risk management process and risk response options cover what happens after the questionnaire closes, while complex projects and portfolio-level risk cover scale.