A key supplier is late for the third time. The person who knows the passwords for the accounting system is on a long leave. A customer who accounts for a third of revenue has not answered an email for two weeks. Each of these was foreseeable, and in most small companies each was known to somebody. What was missing was a place where the knowledge was written down, with a name next to it.
That place is a risk register. The word sounds heavy, but for a company of ten to a few hundred people it can be a single page.
What a risk register is, and what it is not
A risk register is a list of things that could go wrong, with enough information to decide what to do about each. It is not a compliance exercise and it does not predict the future. Its job is smaller: to make sure that the risks the management team already worries about are visible, have an owner, and get looked at on a regular schedule.
It also is not a list of every conceivable problem. A register with eighty entries gets read once and then ignored. Aim for ten.
Five columns
Resist adding columns. Each extra column is something people must fill in and nobody will. These five are enough:
| Column | What goes in it |
|---|---|
| Risk | One sentence, written as something that could happen: "Our only developer leaves and nobody can deploy the website." |
| Impact | What it would cost if it happened: High, Medium or Low. Add a few words, such as "orders stop for a week". |
| Likelihood | How likely it is in the next twelve months: High, Medium or Low. |
| Owner | One named person, not a department. |
| Next action | The next concrete step and its date, or "accept" with a reason. |
Use three levels instead of a scale from one to ten. Nobody can say whether a risk is a six or a seven, and a numeric score suggests a precision that does not exist. High, Medium and Low are enough to sort the list.
Writing the risk so that it can be acted on
The most common weakness is a vague entry such as "IT security" or "staff turnover". These are topics, not risks. Nobody can own a topic or give it a next step.
A usable entry names the event and, if possible, the cause:
- Weak: "Data loss."
- Better: "Backups of the file server have not been restored in over a year, so we do not know whether they work."
The second version points directly to an action: do a test restore. If you cannot think of a next action, the entry is probably still too vague.
Finding the first ten
You do not need a workshop with consultants. One hour with three or four people who know the business is usually enough. A simple way to run it:
- Ask each person for their top five worries, on paper, without discussing them first. Questions that help: What would stop us from delivering for a week? What would be expensive to explain to a customer? What depends on one person?
- Put the answers on one list and merge duplicates.
- Mark Impact and Likelihood together, quickly. If people disagree, take the higher value and move on; the point is to sort, not to argue.
- Keep the top ten. The others are not forgotten; move them to a short "watch" list below the table.
- Assign an owner to each, preferably the person who can actually do something about it, not the most senior person in the room.
Typical entries for a small company include dependence on one key person, one customer or supplier making up a large share of the business, no tested backup, unclear access to systems after someone leaves, a single point of failure in a critical tool, and cash flow gaps. Your list will differ; use these only as prompts.
What to do with each risk
For every entry, the owner picks one of four responses and writes it in the Next action column:
- Reduce: do something that makes it less likely or less costly, such as a second person trained on the task or a restore test.
- Transfer: pass part of it on, for example through insurance or a contract clause.
- Accept: decide consciously to live with it, and write down why. This is a legitimate answer for low-impact risks.
- Avoid: stop the activity that creates the risk.
Most entries end up as "reduce" with a small step. Make the step small enough to finish within a quarter, otherwise it will not happen.
A quarterly review in 30 minutes
The register only has value if somebody looks at it again. Put a fixed 30-minute slot in the calendar every three months, with the same people who built it. A short agenda:
- For each risk, did the owner complete the next action? If yes, set the next one or lower the rating.
- Did anything change in the business that makes a risk bigger or smaller, such as a new customer, a new system or a departure?
- Is there a new risk that belongs in the top ten? If so, what drops off?
- Remove entries that are closed. A register that only grows becomes the eighty-line list again.
Record the date of the review at the top of the page. If one review is skipped, do the next one anyway; do not wait for a perfect time.
Where the register lives
Keep it somewhere the management team already works, such as a shared document or a page in the intranet, with a named owner and a review date like any other page. A spreadsheet is fine. A special tool is not needed at this size.
Decisions that come out of the review, such as accepting a risk or spending money to reduce it, are worth keeping in a one-page decision record, so that the reasoning is still available a year later. Risks that depend on a single person are often reduced by a good handover sheet, and unclear data ownership is covered in the one-page register of who owns the data in each system.
Common mistakes
- Too many entries, so nobody reads the list.
- Topics instead of events ("cybersecurity" instead of "we cannot restore from backup").
- A department or the whole management team as owner.
- No next action, so the register describes problems without moving them.
- A scoring scale that invites arguments about numbers.
- Building the register once and never reviewing it.
- Treating it as a document for auditors rather than a tool for the people running the business.
Summary
A small company's risk register can fit on one page: five columns, ten risks written as events, a named owner and a next action for each, and a 30-minute review every quarter. Start with an hour of honest conversation, keep the scoring to three levels, and let the review remove as much as it adds.
Sources
- Our related articles linked above.
- The column set, three-level scoring and review rhythm are working practices for small and mid-sized companies, not a formal standard; adjust them to your size. No client results or market figures are claimed in this article.