Creating a Simple Risk Register for Operations

Why a Simple Risk Register Earns Its Keep

Most small businesses carry their risks in their heads. The owner knows the one supplier who could let them down, the single member of staff who understands the payroll system, and the laptop that has been making a strange noise since March. The trouble is that knowing something and managing it are different things — and when three problems land in the same week, the ones in your head are the first to be forgotten.

A risk register is simply a list. It records what could go wrong, how likely it is, how much damage it would do, and what you are doing about it. Done properly, it takes an hour to set up and about twenty minutes a month to maintain. Done badly, it becomes a heavyweight document that nobody opens. This article is about the first version.

You do not need specialist software. A spreadsheet with six columns will do, and so will a sheet of A4 pinned near the desk.

Step One: List What Could Actually Go Wrong

Start with your operations rather than abstract categories. Walk through a typical week and ask what would stop you delivering. Useful prompts include:

• People: illness, resignation, a key person on holiday when something breaks, skills held by only one person.
• Suppliers: a single-source supplier, long lead times, price rises, a courier who fails at Christmas.
• Systems and data: broadband outages, a failed backup, a phishing email, older equipment, software that stops being supported.
• Premises: flood, fire, theft, a landlord who sells up, access blocked by roadworks.
• Money: a large customer paying late, a card processor holding funds, an unexpected tax bill.
• Compliance: insurance lapsing, licences, health and safety, data protection, sector-specific rules.
• Demand: a sudden spike you cannot service, or a quiet month that leaves you overstaffed.

Aim for fifteen to twenty entries. Write each one as a plain sentence: "Our only trained forklift driver is off sick for two weeks." Specific beats vague every time — "staffing issues" tells you nothing, but the sentence above tells you exactly what to fix.

Rating Likelihood and Impact Without Overthinking It

Give each risk two scores from 1 to 5. Likelihood runs from 1 (very unlikely in the next twelve months) to 5 (almost certain). Impact runs from 1 (a minor inconvenience) to 5 (the business cannot trade, or faces a serious financial or legal hit).

Multiply the two numbers for a risk score between 1 and 25. Then apply a simple banding:

• 1–6: low. Note it, review annually, get on with your day.
• 8–12: medium. Needs a named owner and a planned action.
• 15–25: high. Act now, or accept in writing that you are carrying the risk deliberately.

Two warnings. First, resist the temptation to score everything as a 4 — if everything is urgent, nothing is. Second, score impact in terms of your business, not the world in general. A two-day broadband outage is a mild irritation for a joiner and a catastrophe for a call centre.

Turning Scores into Actions You Will Actually Take

For every medium or high risk, write one concrete action with a name and a date against it. Good actions are cheap and specific. Examples:

• Train a second person on the payroll and invoicing process, with a handover session booked for next month.
• Hold two weeks of critical stock rather than relying on next-day delivery.
• Test the backup by restoring a single file, once a quarter, and recording the date it was done.
• Add a named deputy to every key task, so no process depends on one person.
• Set a credit limit for new customers and review aged debt weekly.

You will not eliminate risk, and you should not try. The goal is to move the severe, likely problems down to a level you can live with. Where an action is too expensive or impractical, write that down too: "Accepted — cost of mitigation exceeds likely loss." An accepted risk is a managed risk, as long as the decision is deliberate and reviewed.

Keeping It Alive With a Monthly Twenty Minutes

A register that is written once and filed away is worse than useless, because it creates false confidence. Fold it into a routine you already have. At your monthly operations meeting, work through four questions:

• Has anything on the list happened, or come close?
• Have any actions slipped past their date?
• Has anything changed — a new customer, a new supplier, a new contract — that adds a risk?
• Can anything be closed off and removed?

Keep the whole thing to a single page. If it grows beyond that, you are probably recording tasks rather than risks. Give every risk one named owner, even if that person is you, and put the next review date at the top of the sheet where you cannot miss it.

A Quick Note on Getting Started

Block out an hour, make a cup of tea, and write your list on paper first. Do not worry about tidy wording or perfect scores. Pick the three highest risks and give each one action, a name and a date. That is a working risk register — modest, unglamorous, and the reason a bad week stays a bad week rather than becoming a crisis.