How to Build a Simple Risk Register for a Small Business

Gather the risks by asking simple questions

Sit with two or three of your managers and ask: what could stop us delivering to customers, what could cost us a lot of money, what could damage our reputation, and what could get us into trouble with regulators or the law? Let each person speak freely and write everything down before judging it.

Walk through the business process by process, from enquiry to delivery to payment, and ask at each step what could fail. Add risks from outside: price changes, new competitors, policy changes, weather, supply disruptions. Aim for a list of fifteen to thirty items; more than that becomes unmanageable.

• Customers: dependence on a few buyers, late payment, disputes
• Operations: breakdowns, supplier delays, quality failures
• People: key-person dependence, attrition, safety
• Finance: cash shortage, rising costs, credit exposure
• Compliance and reputation: licences, data, complaints

Describe each risk clearly

Write each risk as a short sentence with cause and effect: 'If our largest customer reduces orders, monthly cash inflow may fall sharply and we may struggle to pay salaries'. This is clearer than 'customer risk'. Include a few words on what currently protects you, such as a second supplier or an insurance policy.

Avoid mixing several risks in one line. If two different events need different responses, they deserve separate rows.

Score likelihood and impact simply

Use a three-point or five-point scale for each. For example, likelihood could be low, medium or high, and impact could be minor, serious or severe. You are making a judgement, not calculating a precise probability, so do not chase false accuracy. Multiply or combine the two to get a rough rating and sort the list.

Discuss scores as a group. Where people disagree strongly, that is useful information: someone knows something the others do not. Focus your attention on the risks that are both fairly likely and highly damaging, usually only five or six items.

Decide a response and give each risk an owner

For each priority risk, choose whether to reduce it, transfer it, accept it or avoid the activity. Reducing might mean finding a second supplier. Transfer might mean insurance, which an authorised adviser can help you evaluate. Accepting is reasonable for small risks if you do so deliberately.

Name one person who is responsible for watching each risk and carrying out the response, and set a date. Without an owner, the register becomes a list of worries. Record any early warning sign too, such as a customer's payment days creeping up.

Review it every quarter

Put a thirty-minute risk review in the calendar every quarter. Ask what has changed, which risks have grown, which have faded, what new ones have appeared and whether the responses were completed. Update scores and close items that are resolved.

Use the register in decisions too. Before you take a loan, enter a new market or hire for a key role, look at which risks it affects. Over time, the register becomes a short memory of what your business has learned about itself.