Risk Register Explained
A risk register is a living list of important business risks, with each risk assigned an owner, a score, current controls, next actions, status, and review date.
For small businesses, a risk register does not need to be complicated. It can be a spreadsheet, a shared document, or a simple table. The point is visibility: what could hurt the business, how serious it is, what controls already exist, what action is next, and who is responsible.
This guide explains how a small business can use a practical risk register without turning risk management into bureaucracy. It connects directly with Risk Assessment for Small Businesses, Business Risk Management Framework, and Business Risk Checklist for Small Businesses.
Key takeaways
- A risk register is a living list of important risks, not a one-time worksheet.
- Each risk should have an owner, category, likelihood score, impact score, current controls, next action, status, and review date.
- For most small businesses, tracking the top 10 to 25 risks is more useful than trying to track every possible problem.
- Review cadence matters more than fancy software. A simple spreadsheet can work well.
- The best risk register leads to action: better contracts, stronger controls, vendor backups, insurance review, safer operations, or clearer documentation.
What a risk register is
A risk register is a structured list of business risks that are worth tracking over time. It records what the risk is, why it matters, who owns it, how likely it is, how serious it could be, what the business already does to control it, and what should happen next.
A risk register helps turn vague worry into organized action. Instead of saying, “We have vendor risk,” the register says: “Our payment processor is a single point of failure. If it goes down, sales may stop. The owner is responsible. The next action is to configure and test a backup payment process.”
A register works best when it is connected to real decisions. It should support insurance reviews, contract reviews, vendor decisions, continuity planning, safety controls, compliance calendars, cash-flow planning, and operational improvements.
Why small businesses use one
Small businesses often carry risk informally. The owner remembers the insurance renewal. One employee knows how payroll works. A vendor relationship is buried in email. Contract obligations are remembered only when a problem occurs. A risk register reduces that dependence on memory.
A risk register can help a small business:
- see which risks deserve attention first;
- assign ownership instead of leaving risks vague;
- track whether controls actually exist;
- record lessons learned after incidents;
- prepare better questions for insurance, legal, tax, cybersecurity, or accounting professionals;
- avoid repeated mistakes in operations, vendor management, contracts, and customer service;
- make risk review part of ordinary business management.
Fields that matter
A small-business risk register should be simple enough to maintain. The following fields are usually enough.
| Field | What it means | Example |
|---|---|---|
| Risk statement | A clear sentence describing what could happen and why it matters. | Payment processor outage could stop online sales for 24 hours. |
| Category | The type of risk. | Operational, financial, vendor, contract, compliance, cyber, reputation, insurance. |
| Owner | The person responsible for tracking the risk and next action. | Owner, operations lead, bookkeeper, manager, IT provider. |
| Likelihood | How likely the risk is to happen. | Low, medium, high — or 1 to 5. |
| Impact | How serious the effect could be if it happens. | Low, medium, high — or 1 to 5. |
| Current controls | What the business already does to reduce the risk. | Backup vendor, written checklist, insurance, contract wording, access controls. |
| Next action | The next practical improvement. | Test backup process, review contract, update certificate, document procedure. |
| Status | Where the risk stands. | Open, in progress, monitored, managed, closed. |
| Review date | When the risk was last reviewed or should be reviewed again. | Monthly, quarterly, renewal date, after incident, after contract change. |
Additional fields can be useful, but only if they improve decisions. A small business does not need a complex enterprise system to get value from a register.
How to score risks
Risk scoring should help with prioritization. It should not become a math exercise that nobody trusts. Many small businesses can use a simple 1-to-5 scale for likelihood and impact.
| Score | Likelihood example | Impact example |
|---|---|---|
| 1 | Rare or unlikely. | Minor inconvenience or small cost. |
| 2 | Possible but not common. | Manageable disruption. |
| 3 | Realistic and worth tracking. | Noticeable customer, cash-flow, operational, or legal impact. |
| 4 | Likely or already appearing as a pattern. | Major disruption, serious cost, or important customer impact. |
| 5 | Very likely, active, or already happening. | Severe loss, survival issue, legal exposure, regulatory issue, or major trust damage. |
A common approach is to multiply likelihood by impact. A risk scored 4 for likelihood and 5 for impact receives a score of 20. The higher the score, the more attention it deserves.
Example risk register entries
These examples show how a simple register can turn broad risk topics into specific action items.
| Risk statement | Category | Owner | Score | Current control | Next action |
|---|---|---|---|---|---|
| Payment processor outage stops sales for 24 hours. | Operational / vendor | Owner | 16 | Main processor only. | Set up and test backup payment process. |
| Customer contract includes unlimited liability language. | Contract / legal | Owner | 20 | Informal review only. | Create contract checklist and seek professional review for high-value deals. |
| One customer represents more than half of revenue. | Financial | Owner | 20 | No formal diversification plan. | Build pipeline targets and review payment terms. |
| Website or email compromise disrupts customer communication. | Cyber / operational | Owner / IT provider | 15 | Passwords used, backups uncertain. | Enable MFA, confirm backups, and document incident contacts. |
| Key vendor fails during a busy period. | Vendor / supply chain | Operations lead | 12 | One supplier used for critical input. | Identify backup supplier and test ordering process. |
| License, permit, or filing deadline is missed. | Compliance | Owner / admin | 12 | Dates tracked manually. | Create recurring compliance calendar and document renewal responsibilities. |
Related pages include Vendor Risk Explained, Contract Risk Explained, Cash Flow Risk Explained, Cyber Liability Insurance Explained, and Regulatory Compliance Risk Explained.
How to maintain the register
A risk register only works if it is reviewed. A spreadsheet that is created once and ignored is not a control. The review process should be light enough that the business actually follows it.
| Review timing | What to do | Why it matters |
|---|---|---|
| Monthly | Update the top risks, close resolved items, add new urgent risks. | Keeps the register useful without requiring a major meeting. |
| Quarterly | Re-score risks and confirm controls still exist. | Risks change as vendors, customers, contracts, and operations change. |
| At insurance renewal | Compare top risks with current coverage, limits, exclusions, and certificates. | Helps the business ask better insurance questions. |
| Before signing major contracts | Add or update contract, indemnity, insurance, payment, and service-level risks. | Prevents the business from accepting obligations it has not reviewed. |
| After incidents | Add lessons learned, update controls, and assign next actions. | Turns mistakes and surprises into improvements. |
A practical review does not need to be long. For many small businesses, 20 to 30 minutes per month is enough if the register is kept focused.
Simple copy/paste template
The simplest version can be used in a spreadsheet, note-taking app, or document.
A slightly fuller spreadsheet could use these columns:
- Risk ID
- Risk statement
- Category
- Owner
- Likelihood
- Impact
- Score
- Current controls
- Gaps
- Next action
- Due date
- Status
- Last reviewed
- Notes
Risk categories to consider
A small business can begin by scanning the main categories below.
| Category | Examples | Helpful related page |
|---|---|---|
| Operational | Process failure, staffing gaps, system outages, poor documentation. | Operational Risk Explained |
| Financial | Cash-flow pressure, customer concentration, slow receivables, rising costs. | Cash Flow Risk Explained |
| Vendor / supply chain | Supplier failure, platform outage, shipping delay, outsourced service problems. | Supply Chain Risk Explained |
| Contract | Indemnification, insurance requirements, payment terms, liability limits. | Risk Transfer Explained |
| Insurance | Missing coverage, low limits, exclusions, deductible exposure, claim reporting. | Small Business Insurance Guide |
| Compliance | Licenses, permits, payroll, tax filings, privacy, safety, advertising rules. | Regulatory Compliance Risk Explained |
| Reputation | Customer complaints, review patterns, poor communication, service failures. | Reputational Risk Explained |
Common mistakes
- Tracking too many risks: A long list nobody uses is worse than a short list that drives action.
- Not assigning owners: If no one owns the risk, it usually will not be managed.
- Using vague risk statements: “Cyber risk” is too broad. “Email compromise redirects customer payments” is better.
- Scoring without action: A high score should lead to a next step, not just a red box.
- Failing to update after incidents: Incidents should improve controls, documentation, and review timing.
- Letting the register become stale: New vendors, contracts, services, employees, and tools change the risk picture.
- Confusing a register with full risk management: The register is a tool. Real risk management requires decisions and follow-through.
FAQ
Do I need special software?
No. A spreadsheet is enough for most small businesses. The discipline matters more than the tool: clear risk statements, owners, scores, controls, next actions, and review dates.
How many risks should I track?
Start with 10 to 15 important risks. Add more only when the register remains useful. Many small businesses get better results from a focused top-25 list than from a huge list that never gets reviewed.
Who should own the register?
Usually the owner, operations lead, or manager should own the register itself. Each individual risk should also have a named owner responsible for the next action.
How often should it be reviewed?
Monthly review works well for many small businesses. Some risks should also be reviewed after incidents, before major contracts, at insurance renewal, after vendor changes, or when the business enters a new line of work.