Risk Register Explained
A risk register explained for small businesses: what it is, how to structure it, and a simple template you can maintain in under 30 minutes per month.
Advertisement
Key takeaways
- A risk register is a living list of risks with owners, controls, and next actions.
- It prevents “silent accumulation” of risk by forcing visibility and accountability.
- Keep it small: focus on the top 10–25 risks, not hundreds.
- Review cadence matters more than fancy software.
On this page
Overview
A risk register is a structured list of risks that you track over time. It helps you see what could hurt the business, what you’re doing about it, and who is responsible.
Fields that matter
You can keep this simple. The highest-value fields are:
- Risk statement: what could happen (clear and specific).
- Category: strategic, financial, operational, legal/liability, reputational, external.
- Owner: one person accountable.
- Likelihood / Impact: simple scoring (1–5).
- Current controls: what exists today.
- Next action: one practical improvement.
- Status: open/in progress/managed.
- Review date: when it was last reviewed.
Scoring risks
Most small businesses do well with impact × likelihood. Add speed if you want (how fast it hits). The point is prioritization, not mathematical perfection.
Rule: If you can’t explain the score in one sentence, the scoring is too complex.
Example entries
- Vendor outage: Payment processor outage stops sales for 24 hours (Operational) — owner: Ops/Owner — control: backup processor not configured — next action: set up backup account and test.
- Contract exposure: Customer contract includes unlimited liability (Legal) — owner: Sales/Owner — control: contract checklist exists — next action: enforce liability cap requirement.
- Cash concentration: One customer is 55% of revenue (Financial) — owner: Owner — control: none — next action: build diversification plan and pipeline targets.
How to maintain it
- Monthly: update top items, close resolved ones, add new risks.
- Quarterly: re-score and confirm controls still exist.
- After incidents: add lessons learned and update controls/runbooks.
Simple template
Copy/paste template (one row per risk)
- Risk: …
- Category: …
- Owner: …
- Likelihood (1–5): …
- Impact (1–5): …
- Current controls: …
- Next action: …
- Status: …
- Last reviewed: …
FAQ
Do I need special software?
No. A spreadsheet is enough for most small businesses.
How many risks should I track?
Start with 10–15. Add only when it improves decisions.
Who should own the register?
Usually the owner/operations lead, but each risk should have a named owner.