How to build a risk register for a small business.

A risk register is a list of the things that could go wrong in your business, how likely each one is, how bad it would be and what you are doing about it. Done properly it takes an afternoon, and it is one of the more useful pages a small business owner can own.

Step 1: start from your activities

Most people start with a generic list of scary words and get nowhere. Start instead with what your business does to earn money: take orders, make the thing, deliver it, get paid. For each one, ask what it depends on. Those dependencies are where the real risks sit.

Step 2: score likelihood and consequence honestly

• Likelihood: how often could this realistically happen? Yearly, every few years, once a decade?
• Consequence: what would a day of it cost in money, customers, safety and reputation?
• Multiply the two. That is your inherent risk, before you do anything about it.

Step 3: record the controls you already have

Most businesses are better protected than they assume. A backup generator, a second supplier, an off-site backup, a second person who can run payroll. Write them down and re-score. What is left after controls is your residual risk, and that short list deserves your money and attention.

Step 4: give every remaining risk an owner and a date

A risk with no name against it tends not to get done. Owner, action, date. Three columns.

Step 5: review it quarterly

Fifteen minutes each quarter. Anything changed? New supplier, new system, new key person, new site? Registers that get reviewed stay true. Registers that don't become fiction inside a year.

"A risk register is a list of the things most likely to cost you money, in order."

Worked example: a 20-person Sunshine Coast joinery workshop

The owner and his production manager listed five activities: quoting, sourcing timber, machining, installation and invoicing. Against machining they found three dependencies: one CNC machine, one operator trained to run it, and a single electrical supply point. Scored honestly, a CNC breakdown was rated as likely every two to three years and would cost roughly $4,000 a day in idle wages and delayed jobs, giving it the highest score on the register. The fix cost nothing: they trained a second staff member on the machine over three shifts and negotiated a 48-hour loan agreement with the machine's original supplier for breakdown cover. The residual risk score dropped from the top of the register to the middle within a month, for the cost of some overtime.

Common mistakes that cost money

• Scoring risks by gut feeling under time pressure rather than against real numbers. A rushed score of "low" on a genuine risk means it never gets budget.
• Building a register with forty rows nobody will ever action. Twelve to fifteen genuine risks, ranked, is more useful than an exhaustive list nobody reads past row six.
• Leaving the owner column blank or filling it with a department instead of a name. Departments do not action risks. People do.
• Never re-scoring after a control is added. If you spend money reducing a risk and never update the register, you cannot show the improvement to an insurer or a bank.
• Building the register once for an audit and shelving it. A register that only appears during compliance season is a liability disguised as a document.

What good looks like

A good risk register has a named owner for every open item, gets reviewed on a set date every quarter, and the top three risks on it match what the leadership team would say if you asked them what keeps them up at night. If the top of your register doesn't match what worries you in reality, the scoring needs another look.

Once you have the register, the next step is turning the top risks into actions. See the one-page continuity plan for the format, and our business continuity plan template for how the register feeds into a wider plan.

How many risks should be on a small business risk register?

Somewhere between ten and twenty is typical for a business of five to fifty people. Fewer than that and you have probably missed genuine dependencies; more than that and the register becomes too long to review properly each quarter, which defeats its purpose.

Who should own a small business risk register?

The owner or a senior operations person should hold overall accountability for keeping it current, but individual risks should be owned by whoever is closest to that part of the business, such as a workshop supervisor for equipment risk or a bookkeeper for financial system risk. Spreading ownership makes the register more accurate and more likely to get updated.

Is a risk register the same as insurance?

No. A risk register identifies and manages exposures, some of which you choose to insure, some of which you control through operational changes, and some of which you knowingly accept. Insurers increasingly ask to see a risk register at renewal because it demonstrates active management, which can influence both price and terms. See why insurers are asking harder questions for more detail.