Building a Risk Register for Your Company: A Step-by-Step Guide

A risk register is the core tool of risk management: a list of the risks that could stop the business achieving its goals, with owners and plans for each. It doesn't need special software. It needs honest input and regular use.

Step 1: Identify Risks

Run a workshop or interviews with leaders across the business. Ask what could seriously harm the business in the next one to three years. Prompt across categories:

• Strategic — competition, technology, market changes.
• Operational — suppliers, key people, systems, quality, safety.
• Financial — cash, credit, currency, interest rates.
• Compliance — tax, labour, sector regulation, data protection.
• Reputational — customer complaints, social media, incidents.

Step 2: Describe Each Risk Clearly

A good risk description has a cause, an event and a consequence. 'Supplier risk' is vague; 'Dependence on one API supplier means a disruption could halt production for weeks' is actionable.

Step 3: Rate Likelihood and Impact

Use a simple scale, such as 1 to 5 for each. Multiply them, or plot them on a heat map. Rate risks considering existing controls, and be consistent across the register.

Step 4: Assign Owners and Responses

• Reduce — add controls or change processes.
• Transfer — insure or contract the risk away.
• Avoid — stop the activity.
• Accept — within the board's risk appetite.

Each significant risk gets an owner, planned actions and target dates.

Step 5: Review Regularly

Review key risks with management monthly or quarterly, and with the board at least half-yearly. Add new risks as the business changes, and update ratings as actions complete.

A Simple Register Layout

• Risk ID and description.
• Category.
• Likelihood, impact and overall rating.
• Existing controls.
• Planned actions, owner and due date.
• Trend since the last review.

Getting Help

Think Filing facilitates risk assessments and builds risk registers and policies for boards.