How to run a risk register in a small company

A risk register is a short list of what could go wrong in your business, with a score for each, an owner and a plan. A small company can run one in an afternoon and review it once a month. The trick is to keep it small, specific and alive: ten to twenty risks, each with a person's name next to it.

Download the risk register template to follow along, or use the risk assessment template for a single activity.

Step 1: Find the risks

Do not start from a blank page. Ask the team four questions and write down every answer:

1. What would stop us serving customers for a day, a week, a month?
2. What would cost us a lot of money suddenly?
3. What could hurt a person, a customer or our reputation?
4. What do we depend on that only one person or one supplier provides?

Typical small company risks: a key person leaves, a supplier fails, the main customer pays late or leaves, a laptop with customer data is lost, the system you sell from goes offline, a rule changes. Look also at past incidents, complaints and audit findings, which are real evidence of risks that already happened.

Step 2: Describe each risk clearly

A vague line cannot be managed. Write it as cause, event and effect:

• Weak: "Supplier risk."
• Better: "Our only packaging supplier is late or closes (cause and event), so orders ship late for weeks (effect)."

Step 3: Score it

Use a simple three by three scale, which is enough for a small company.

Multiply the two numbers. A score of 6 or 9 is high and needs action now, 3 or 4 needs a plan, 1 or 2 you watch.

Step 4: Decide what to do

For every risk choose one of four answers:

• Reduce it. Add a second supplier, back up the files, train a second person.
• Avoid it. Stop doing the risky thing.
• Transfer it. Insurance, a contract clause, an outside service.
• Accept it. Write down that you accept it and why, for low risks.

Write the action as a task with a date: "Find a second packaging supplier by 15 January." Track it in tasks and projects so it is not forgotten.

Step 5: Give each risk an owner

One name, not "the team". The owner watches the risk, does or assigns the action, and reports changes at the review. An owner without time or authority is not an owner, so check.

Step 6: Review on a rhythm

1. Monthly, 20 minutes. Go through the high risks and the actions due.
2. Every quarter. Re-score everything and add new ones.
3. After any incident. Did it show a missing risk or a wrong score?
4. Yearly. Feed the register into your management review.

A worked example

A six person design studio lists these risks:

Four rows, four owners, four dates. That is a working register.

Common mistakes

• Copying a generic list. The register must describe your business.
• Scoring everything high. Then nothing stands out.
• No review. An out of date register is worse than none, because it gives false comfort.
• Hiding it. The team that sees the risks every day knows them best. Share the register.

Where it connects to quality work

If you work toward ISO 9001 or 27001, the register is the document an auditor asks for first, and corrective actions often start as a risk that happened. See checks for running internal audits, and our guide on corrective actions that fix the cause.

Risk levels and what to do at each

A score only helps if it triggers action. Agree in advance what each level means:

This keeps meetings short, because you only talk about the top of the list. If more than a third of your risks are high, you are probably scoring too harshly, or the business really has a problem that needs a bigger plan than a register.

Types of risk to check

If you are stuck for ideas, walk through these groups and ask whether each applies to you:

• People. Key person leaves, illness, hiring takes too long, a safety hazard on site.
• Customers and money. One customer is most of your income, late payment, price pressure, refunds.
• Suppliers. Single supplier, price rise, delivery delays, quality problems.
• Operations. Equipment fails, stock runs out, a process depends on one spreadsheet.
• Information and technology. Lost devices, phishing, no backups, a service outage.
• Legal and rules. A new regulation, a missing licence, a contract clause you did not read.
• Reputation. A bad review, a public mistake, a complaint that spreads.
• Outside events. Weather, power cuts, transport strikes, a pandemic.

Pick the three or four that could really hurt you, not all of them.

Opportunities too

Some teams add a second column for opportunities, things that could go better than planned, such as a new market or a repeat order. It is optional, but the same scoring works, and it keeps the register from becoming a list of worries.

Records an auditor will ask for

For ISO 9001 or ISO 27001, keep evidence that risks were identified, scored, treated and reviewed. The register itself, the dates of the monthly reviews, the closed actions and the notes of the management review are the proof. You do not need a long procedure, only a register that is used. When you plan an internal audit, choose a few risks from the register and check that the action really happened. This is the simplest way to make audits useful, and it turns the register from a document into a habit.

Keep the register short enough to use

A register with 200 lines is read by nobody. For a company of 10 to 50 people, 15 to 30 live risks is normal. If you have more, group the small ones ("minor IT faults", "routine supplier delays") into one line and keep the separate lines for risks that could really hurt the business. Move closed risks to a second tab instead of deleting them, so you can show later that you looked at them.

Write each action so a stranger could tell whether it was done. "Improve backups" cannot be checked. "Test a restore of the accounts folder from last week's backup, by 15 December, Maria" can. Each action needs one named person and a date, and the next review should start with the overdue ones.

Watch for the same score everywhere. If every risk is a 3 for likelihood and a 3 for impact, the scale is not helping you decide. Ask which two risks you would fix first if you only had a week, and compare those two against each other. The order you end up with is usually more useful than the numbers.

Finally, record what you decided not to do. Accepting a risk is a legitimate choice, but write down who accepted it and why, for example "the cost of a second supplier is higher than a two week delay would cost us". That line is what you want to find when someone asks a year later.

The short version

List real risks as cause, event and effect, score each on a three by three scale, choose reduce, avoid, transfer or accept, give every risk an owner and a dated action, and review monthly. Ten good rows beat a hundred copied ones.