I used the CAA guidelines and plagiarised a load from a friend. Important to use colour in them when you are doing stuff like Risk Assessment, tolerability and Mitigation. You will also need to define how you manage risk once identified. We chose to use a risk register in addition to the main SMS.