How to Create a ChatGPT Risk Assessment in 20 Minutes

What a good ChatGPT risk assessment contains

A defensible register has seven columns, and the model will cheerfully give you three of them unless you ask for the rest. The columns exist so somebody who was not in the room can read one row and understand what could go wrong, how bad it would be, who is watching it, and what happens next.

Two of those columns do most of the work. Early trigger turns a vague worry into something a person can actually watch for, which is the difference between a register that gets reviewed and one that gets filed. Owner is the column that makes the document real; a risk with no name against it is a note, not a control. Most of the time a ChatGPT risk assessment arrives missing both, which is why it reads well and changes nothing.

None of this is exotic. ISO 31000:2018, the international risk management guidelines, describes the same underlying loop of identify, analyse, evaluate and treat. What it deliberately does not do is hand you a scoring scale, because it is generic guidance rather than a certifiable standard. You build the scale yourself, and that is precisely the step almost everyone skips.

The Rubric-First Register Method

The Rubric-First Register Method is a four-stage sequence — Scope, Rubric, Extract, Challenge — in which you define your own scoring thresholds before requesting a single risk, so the model measures against your standards instead of inventing its own. It is the approach we teach at PromptPeakAI for any task that ends in a scored table.

Stages two and four are where the value sits. Almost every guide on this topic gives you one clever prompt covering stage three alone, which is why their sample output looks confident and scores nothing consistently. A ChatGPT risk assessment built that way is a list of hazards wearing a table’s clothes.

Underneath, each stage is an ordinary application of the Logic System — Role, Goal, Context, Format. Nothing here needs prompt engineering skill. It needs the discipline to spend four minutes on scoring rules before spending six on risks.

Set your data rules before pasting

Before a single project detail goes into a chat box, decide what is allowed to leave your building. This is the part risk professionals care about most and the part almost every tutorial skips entirely.

Here is what most people get backwards. Paying for a plan does not protect your data. According to OpenAI’s own policy on how your data is used to train its models, updated in March 2026, content from the individual plans may be used for training, with an opt-out you have to switch on yourself. That is equally true whether you pay nothing or two hundred dollars a month. Only the business tiers are no-training by default.

To switch training off on a personal account: click your profile icon, open Settings, go to Data Controls, and turn off “Improve the model for everyone”. The setting applies to your whole account across web and mobile, and you can change it back at any time.

The plan question comes up constantly, so here is the short version for this specific task.

For a fuller treatment of workplace privacy across tools, our guide to whether ChatGPT is safe for work goes deeper than this section can. For a ChatGPT risk assessment specifically the rule is short: if you cannot anonymise it, do not paste it. Use a business workspace, or leave that detail out of the register and add it by hand afterwards.

Build the register in four stages

Twenty minutes, four prompts, one conversation. Keep it all in a single chat so each stage can see what came before it — a ChatGPT risk assessment split across separate chats loses the rubric between stages and you end up scoring twice.

Scope is where most registers quietly go wrong. “We are launching a new CRM” produces risks about launching a new CRM in the abstract. Add the timeline, the team size and the constraint you are genuinely worried about, and the output changes completely.

You are an operations risk consultant helping me build a project risk register.

Project: [what is being delivered]
Timeline: [start and end dates]
Team: [size, roles, who is already stretched]
Budget position: [tight, comfortable, or unconfirmed]
Known constraints: [dependencies, approvals, seasonal timing]
Regulatory context: [any rules that apply to this work]

Do not list any risks yet. Reply with a numbered list of anything material you would need to know that I have not told you. Ask at most six questions.

Answering those six questions takes two minutes and does more for the final register than any other two minutes you will spend. The three layers that matter — background, constraints, specifics — are broken down in our guide to giving AI context that makes output specific.

Now the rubric, before a single risk exists. You are telling the model what “likely” means as a probability and what “severe” means in your currency, your days, your escalation chain.

Using the project above, draft a 1 to 5 scoring rubric with two scales.

Likelihood: express each level as a probability band across the project's lifetime.
Impact: express each level in three units — days of delay, financial cost, and stakeholder consequence.

Rules:
- Every level must be clearly distinguishable from the one next to it.
- Use my project's real scale, not generic corporate language.
- Output as a table with columns: Score, Likelihood means, Impact means.
- Do not list any risks yet.

Then edit it. The model’s first pass at your thresholds will be close but not yours. Change the numbers until a 4 genuinely means what a 4 means to your finance director.

Only now do you ask for risks, and you ask category by category. A flat “list all the risks” request reliably produces eight technical risks and nothing at all about people, vendors or compliance.

Using the rubric above, build the risk register.

Cover these categories separately, with at least three risks in each: technical, data, people and adoption, vendor and supply, legal and compliance, financial.

For every risk, output a row with these columns:
Category | Risk description | Early trigger | Likelihood 1-5 | Impact 1-5 | Severity L x I | Mitigation | Suggested owner role

Rules:
- Score strictly against the rubric above and state which rubric level you applied.
- Each risk is one specific failure, not a broad theme.
- Each mitigation is an action someone could start this week.
- Output only the table. No introduction, no closing summary.

That last line matters far more than it looks. Without it you get three paragraphs of preamble wrapped around the table, and the preamble is exactly what breaks the paste into Excel. Specifying output shape explicitly is covered properly in our guide to formatting AI output so it is immediately usable.

You now have roughly twenty rows, and some of them are fiction. This stage is not optional. An unchallenged register is worse than no register at all, because it carries the same authority without the same evidence.

Review the register you just produced as a sceptical internal auditor.

For each row, answer these four questions:
1. Is this risk specific to my project, or would it appear on any project of this type?
2. Is the early trigger something a person could actually observe?
3. Does the score follow the rubric, or was it assigned by feel?
4. Could the mitigation start without an approval I have not mentioned?

Flag every row that fails any check, then rewrite it or recommend deleting it. Finally, tell me which risk category is under-covered and why.

Score likelihood and impact consistently

Scoring is where a ChatGPT risk assessment either earns trust or loses it in front of a steering group. The model is genuinely good at applying a scale you hand it, and genuinely bad at inventing one.

Below is an example rubric. Do not use these numbers. Replace every threshold with yours, because an overrun that is trivial in one department is a crisis in another, and that judgement is the part only you can supply.

Severity is likelihood multiplied by impact, giving a range of 1 to 25. The band boundaries are yours to set, but three bands is the useful number: monitor, mitigate, escalate.

Move your risk table into Excel

A ChatGPT risk assessment is only useful once it lives somewhere you can sort and filter it. Paste a markdown table straight into Excel, though, and it lands in a single column with pipe characters scattered through it — two minutes of manual cleanup, every single time, unless you ask for a different format on the way out.

Output the final register again as tab-separated values.

- One line per risk, with columns separated by a single tab character.
- The first line is the header row.
- No markdown pipes, no bold, no code fences, no commentary before or after.
- Replace any tab or line break inside a cell with a single space.

Copy that block, click cell A1, paste, and the columns land where they belong. Google Sheets behaves the same way. If a cell splits in the wrong place, you almost certainly asked for comma-separated values instead of tab-separated — a risk description with a comma in it will break every time.

From there it is an ordinary spreadsheet. Sort by severity, filter by owner, conditional-format your escalation band so the red rows are visible from across a meeting room. Our guide to analysing a spreadsheet using ChatGPT picks up from there if you want the model working on the finished register.

Fixing the four common output failures

Four things go wrong with a ChatGPT risk assessment, and each one has a fix you can apply in a single line.

That last row deserves its own attention. Invented risks are the same failure mode as invented citations: the model produces something plausible where it has no actual information, and a risk register is a document where plausible-but-false gets expensive fast. Our explainer on why ChatGPT hallucinates covers the mechanism.

The gate is deliberately blunt. If you cannot name the trigger and the owner, the row is not ready, no matter how reasonable it sounds when you read it.

Where AI risk mapping falls short

There are things this workflow cannot do, and pretending otherwise is how people get caught out in a review. A ChatGPT risk assessment is a first draft written by something that has never met your organisation.

One more limit is worth naming for anyone working under regulation. This produces a working draft, not a compliance artefact. If your register feeds a formal audit, a safety case or a regulatory submission, it needs review by somebody qualified to sign it — the generated draft is where that review starts, never where it ends.

Used honestly, the trade is a good one: you are not outsourcing judgement, you are outsourcing the blank page. Run this once on something live this week. The rubric you write in stage two is the piece that compounds — every register after this one starts four minutes ahead. And when somebody asks for the two-paragraph version for the steering group, our guide to writing an executive summary using ChatGPT is the natural next stop.