How to Create a Practical Business Risk Register

A risk register only helps if it leads to decisions. This guide explains what to include, how to score risks simply, who should own them and how to keep the register up to date without turning it into paperwork for its own sake.

By James Carter · Published 8 October 2026 · Updated 8 October 2026 · 9 min read

Editorial vector-style illustration of a business risk register with a spreadsheet, shield icon, checklist and abstract warning symbols on an off-white background. — Editorial illustration

A risk register is most useful when it helps you decide what to do next. For a small or medium-sized business, the point is not to produce a perfect document. It is to spot the risks that could disrupt sales, cash flow, delivery or compliance, then decide which ones need action now and which ones can be watched.

If the register is too vague, it becomes a list of worries. If it is too detailed, no one keeps it current. The practical middle ground is a short, clear record of the main risks, the controls you already have in place, the action needed, who owns it and when you will review it.

Why a risk register matters for a practical business

A business risk register helps you make better choices about priorities. It gives you one place to capture the risks that matter, compare them, and decide whether you need to reduce them, transfer them, accept them or keep watching them.

That matters because risks are often managed badly when they are handled informally. A manager may know a supplier is unreliable, or that a key process depends on one person, but if that concern is never written down it is easy to forget, especially when trading is busy.

A good register should help you decide:

which risks need immediate action
which controls are already working
where you are over-reliant on one person, system or supplier
what needs monitoring at the next review

It is also useful alongside your wider planning. If you have a business plan, the risk register should support it by showing what could stop the plan from working and what you will do about it. See also How to write a practical business plan.

What a business risk register is, and what it is not

A risk register is a working document. It lists the risks that could affect the business, usually with a short explanation of the cause, impact, likelihood, controls and follow-up actions.

It is not:

a crisis plan
a complaint log
a health and safety file on its own
a place to record every possible issue

You can keep separate documents for incident logs, insurance claims, continuity plans or compliance records. The register should be the summary that helps you manage risk day to day.

For the business structure you choose, responsibilities and liability also matter. GOV.UK explains that sole traders are personally responsible for business debts, while limited companies are legally separate and have limited liability for owners up to the value of their financial investment. That is not a reason to ignore risk; it is a reminder that structure affects how risks are carried and managed. GOV.UK guidance: https://www.gov.uk/set-up-business and https://www.gov.uk/limited-company-formation.

Which risks belong in the register

Start with the risks that could genuinely interrupt performance or create cost, delay or legal trouble. A practical register usually covers:

Strategic risks

These are risks to the business model or plan. For example, demand may weaken, a product range may become less relevant, or a new competitor may undercut you.

Financial risks

These affect cash flow, margins and funding. Examples include late customer payment, rising costs, poor credit control or interest rate changes.

Operational risks

These affect how work gets done. Examples include equipment failure, stock shortages, poor scheduling or a weak handover process.

Legal risks

These include contract disputes, regulatory breaches, data protection issues, licensing problems and employment disputes.

People risks

These arise when the business depends too heavily on one person, has weak training, or cannot cover absences and turnover.

Supplier risks

These cover third-party dependence, such as a single manufacturer, courier, software provider or outsourced service.

Cyber risks

These include phishing, ransomware, account theft, data loss and system outages. For most small businesses, this is not an abstract IT issue; it is a continuity and customer trust issue.

A useful test is simple: if the risk would make you change a decision, spend money, delay work or alert customers or advisers, it probably belongs in the register.

How to gather the right inputs

Do not build the register from memory alone. Pull in evidence from the business itself. Useful inputs include:

past incidents and near misses
customer complaints and refund patterns
missed deadlines and bottlenecks
contracts with suppliers, landlords and customers
cash flow pressures and overdue invoices
key dependencies, such as one person, one system or one site

Talk to the people who actually do the work. Sales may know where deals stall. Operations may know which process breaks down most often. Finance may see cash risks earlier than everyone else. If you have advisers, such as an accountant or solicitor, ask them where they see recurring issues.

A practical way to start is a short review meeting with three questions:

What has gone wrong in the last 12 months?
What would hurt if it failed next month?
What are we relying on too heavily?

A simple structure for the register

Keep the format consistent. A spreadsheet is usually enough. Each row should include:

Field	What to record
Risk	A clear statement of the risk
Cause	Why the risk could happen
Impact	What would happen if it did
Likelihood	How likely it is
Severity	How serious the effect would be
Owner	The named person responsible for monitoring it
Controls	What is already in place
Actions	What still needs to be done
Review date	When you will revisit it

Do not add fields unless they are useful. A register with too many columns often becomes hard to update and easy to ignore.

How to score risks without overcomplicating it

You do not need a complex scoring system. A basic scale for likelihood and impact is often enough.

Likelihood: low, medium or high
Impact: low, medium or high

You can then judge the combined risk. For example, a high-likelihood, high-impact issue deserves action quickly, while a low-likelihood, low-impact issue may only need monitoring.

For many small businesses, the score is not the main point. The main point is the discussion behind it. A score helps you compare risks, but it should not hide judgment. If a risk is rare but catastrophic, it may still need attention even if the number looks modest.

Keep the scale simple enough that your team can use it consistently. If different people score the same risk very differently, the system is too complicated for the business.

How to write risks clearly

Write each risk as a specific sentence, not a heading. Avoid vague entries such as “supplier issues” or “business continuity”. Those labels do not tell you what could fail, why or what would happen.

Better wording follows a simple pattern:

If [cause] happens, [event] could lead to [impact].

For example:

“If our main packaging supplier is delayed, we may miss dispatch dates and trigger customer complaints.”
“If one senior technician is absent for more than a week, project work will slow and deadlines may slip.”
“If customer invoices are not chased within seven days, cash flow may tighten in the next quarter.”

Specific wording makes it easier to decide on controls and actions. It also makes ownership clearer, because someone can see exactly what they are being asked to manage.

How to decide on controls and actions

Once a risk is listed, decide what to do about it. Most responses fall into four categories:

Reduce

You introduce controls to lower the likelihood or impact. This could mean extra checks, backup suppliers, cyber training, segregation of duties or better cash collection. The trade-off is cost and time, but the benefit is less exposure.

Transfer

You shift part of the risk to another party, usually through insurance, contractual terms or outsourcing. This can help, but it does not remove the need to manage the risk yourself. If a customer or supplier fails, you may still carry the operational burden.

Accept

You decide the risk is tolerable as it stands. This is sensible when the cost of further control is greater than the likely harm. Acceptance should still be deliberate, not passive.

Monitor

You keep an eye on the risk and review it later. This is useful when the risk is uncertain or not urgent, but it should have a named review date.

For each risk, write down the action that would make the biggest practical difference first. If you need several actions, rank them. That keeps the register usable when resources are tight.

Who should own each risk

Every risk needs one named owner. That person is responsible for keeping an eye on it, driving actions and reporting progress. Ownership should be realistic: if a person has no control over the risk, they should not own it.

Do not confuse responsibility with accountability. The owner may be responsible for managing the risk day to day, but senior management or the business owner may still be accountable for the overall outcome.

A useful rule is this: assign ownership to the person closest to the risk who can influence the controls. For example, finance may own credit control risk, operations may own delivery risk, and an IT lead or external provider may own certain cyber controls.

If the business is very small, one person may own several risks. That is fine, as long as the list stays manageable and the actions are tracked.

How often to review the register

Review the register when something changes, not only on a calendar. Triggers for an update include:

a customer complaint or incident
a missed target or repeated delay
a new supplier, contract or product
a staffing change
a cyber or system problem
a change in law, regulation or insurance requirement

For many small businesses, a monthly review is enough if the business is stable. Use it in a team meeting or management meeting so the register is discussed, not just filed away. If the business is changing quickly, weekly or fortnightly checks may be more sensible for the highest risks.

The aim is to keep it alive. A register that is only looked at once a year is usually too late to be useful.

Common mistakes that make a risk register useless

Too many risks: if everything is listed, nothing stands out.
No owners: risks without names do not get managed.
Copied wording: generic text does not reflect how your business actually works.
No follow-through: a register with no actions is just a note list.
No review date: if you do not revisit it, it goes stale.

The simplest way to avoid these mistakes is to keep the register short and review it with the same discipline you would apply to cash flow or sales numbers.

A practical starter template

Here is one example of a useful entry:

Risk	Cause	Impact	Likelihood	Severity	Owner	Controls	Actions	Review date
Main courier misses collections	Single daily pickup and no backup carrier	Orders leave late and customers complain	Medium	High	Operations manager	Service-level agreement in place	Agree a backup courier, update dispatch process, test escalation route	End of month

Turning that into an action list might look like this:

Get a quote and service contact from a second courier.
Set a dispatch cut-off time for same-day handover.
Record who escalates if the pickup is late.
Review complaints after the change and confirm whether the risk has reduced.

The point is not elegant wording. It is a register that leads to better decisions and fewer surprises.

What to do next

Build the first version quickly, then improve it.

List the five to ten risks that matter most to your business.
Give each one a clear owner.
Keep the scoring simple.
Write one or two practical actions for the highest risks.
Set the next review date now, not later.

If you want the register to stay useful, attach it to a real meeting and a real decision. Otherwise it will become another file no one opens.

What records should a small business keep in the UK?

UK small businesses often keep too little, or far too much. The sensible answer is to keep the records that prove sales, costs, payroll, tax positions, contracts and compliance, then store them in a system you can actually use.

16 October 2026 · 16 min read

How to manage business cash flow during slow months

Slow months can expose weak cash flow even in healthy businesses. The answer is usually not blunt cuts, but better timing: forecast early, collect money faster, protect essential spending and use finance only when you know the size of the gap.

15 October 2026 · 11 min read

How to measure whether a small business is profitable

A business can look busy, generate sales and still fail to make real money. Here is a practical way to judge profitability using profit and loss, gross margin, overheads, cash flow and owner time without being misled by the bank balance.

13 October 2026 · 12 min read

How to choose KPIs for a small business

Too many small businesses track numbers that fill a dashboard but do not change decisions. The better approach is to choose a small set of KPIs that link to your goals, can be reviewed regularly and tell you whether day-to-day actions are working.

13 October 2026 · 14 min read

How to reduce operating costs without cutting staff

If costs are rising but your team is already stretched, the answer is usually not a blunt headcount cut. A better approach is to map spend, remove waste, renegotiate recurring costs, improve processes and use capacity more efficiently while protecting service and morale.

13 October 2026 · 13 min read

How to create standard operating procedures that staff use

Standard operating procedures only help if people can use them in real work. This guide shows how to choose the right processes, map the actual steps, write clear instructions, test them with staff and keep them current without creating bureaucracy.