How to create a business risk register that gets used

Use the register to prepare for a decision

A business risk register records uncertainties that could affect important objectives, the controls already in place and the response required. Its value is practical: it helps owners decide what to prevent, monitor, prepare for or escalate. A colourful list of risks that is never discussed can create the appearance of control without changing how the business operates.

Start with the business objectives and essential services. Consider what could disrupt delivery, damage customer trust, weaken cash collection or prevent a strategic project succeeding. The register should be proportionate to the business. A small service company does not need to document every imaginable event before addressing its most significant dependencies.

ISO 31000 provides general risk-management guidance across organisations, but this article and worksheet are an original management aid, not a reproduction of the standard or a claim of compliance. Specialist legal, technical, financial or safety risks may need qualified assessment. The management role is to make ownership, evidence and action visible so those assessments can inform real decisions.

Describe a risk as a cause, event and consequence

Avoid one-word entries such as “staff”, “cyber” or “competition”. They are too broad to support a response. A clearer risk statement explains the condition, what might happen and the effect on the business. For example: dependence on one authorised technical reviewer could delay customer approvals if that person is unavailable, affecting delivery commitments and invoicing.

Separate a risk from an issue. A risk concerns an uncertain event or outcome. An issue is already happening and needs management. If the technical reviewer is currently absent and work is blocked, that belongs in the action or incident process as well as informing the longer-term risk review.

State the objective affected and the time horizon. A risk to next week's service delivery may require a different response from an uncertainty about a new market next year. This context helps the team prioritise and prevents the register becoming a collection of concerns with no clear relationship to the decisions the business must make.

Assess likelihood and impact with clear definitions

A simple likelihood-impact scale can help compare risks, provided the categories have agreed meanings. Define the relevant time period and what minor, material or severe impact means for your business. Consider service, financial, customer and other relevant consequences rather than assuming every effect can be reduced to a single currency figure.

Use evidence where available and label judgement where it is not. A repeated supplier delay provides a different basis from a hypothetical event with little direct experience. Do not let a numerical score imply more certainty than the information supports. Two risks with the same score may need very different responses because one develops slowly and the other gives little warning.

Consider the effect of existing controls separately from the risk before those controls. This helps identify whether the business depends heavily on a control that is not being tested. If a backup process exists only in a document and nobody has tried it, the residual risk may be higher than the register suggests.

Examine the controls that already exist

List the controls intended to reduce likelihood or impact. These might include approval boundaries, access restrictions, quality checks, supplier alternatives, backups or cross-training. Explain what each control does and who maintains it. “Management oversight” is too vague unless the oversight has a defined activity and evidence.

Check whether the control works in ordinary conditions and during the event it is meant to address. A backup copy stored in the same unavailable system may not help when access fails. A substitute reviewer without current knowledge or authority may not remove the dependency. Ask for a recent test or example rather than accepting the existence of a policy as sufficient proof.

For the technical-review risk, controls could include documented review criteria, a trained deputy and a process for prioritising urgent cases. The SOP guide and delegation matrix guide help turn those controls into usable working arrangements. The appropriate design depends on the actual technical and authorisation requirements of the business.

Assign an owner and choose a proportionate response

Every material risk needs an accountable owner who can monitor it and coordinate the response. The owner may need help from several functions, but responsibility should not disappear into a committee. Confirm that the person has access to the information and authority needed for the assigned role.

Possible responses include avoiding an activity, reducing the likelihood or consequence, arranging an appropriate transfer such as insurance, or consciously accepting the remaining exposure. These choices require judgement and, where relevant, specialist advice. Insurance does not remove the need to understand exclusions, operational recovery or customer commitments, and it should not be assumed to cover a particular event without checking the actual terms.

Record the action, owner, due date and expected effect. For the illustrative reviewer dependency, the response might be qualifying a deputy and testing the handover on representative cases. “Reduce key-person risk” is an intention; a completed capability and authority test is evidence that the response has changed the business's preparedness.

Define warning signs and escalation triggers

Identify signals that the risk is increasing or the response should activate. These could include a growing approval queue, repeated supplier failures, an approaching renewal date or a control test that fails. A trigger should be specific enough that the owner knows when to act, while allowing judgement where the situation is uncertain.

State who receives an escalation and what information is required. Include the likely effect, current controls, options and time available. For fast-developing events, agree immediate actions within the person's authority so the business does not wait for a meeting while the situation worsens.

Connect the register to the business continuity plan where a risk could disrupt essential service. The register describes the exposure and planned treatment; the continuity plan explains how the business will respond and recover if disruption occurs. Keeping the documents connected helps avoid a situation where risks are scored carefully but nobody knows what to do when one materialises.

Review the register through actual business events

Keep the action status separate from the risk rating. Completing a training session may close an action while leaving a significant dependency in place. Conversely, a change in the service model may reduce an exposure before every planned task is finished. Review the remaining business consequence rather than assuming that a completed checklist means the risk is resolved.

Set a review cadence proportionate to the risks and use significant changes as additional triggers. New services, systems, suppliers, locations or customer commitments can alter the exposure. Incidents and near misses should also inform the review, because they reveal how the controls behave under real conditions.

At the review, ask what changed, which actions are overdue and whether the controls have been tested. Remove obsolete entries or close them with a recorded reason. Do not allow the register to grow indefinitely while the same unresolved items remain at the top. Focus leadership attention on the decisions that matter now.

Use the downloadable worksheet below to start with a manageable set of material risks. Record clear statements, evidence, controls, owners and response triggers. Activ-8 management consultancy can help integrate this into the management rhythm and connect it with operational planning. The useful result is a business that understands its important dependencies and has taken practical steps before pressure turns uncertainty into an urgent problem.

Test one entry by asking its owner to explain the next action without reading a lengthy policy. If they cannot identify the trigger, authority and response, the register needs more practical detail. If they can, check whether the necessary resources and information would still be available during the event itself.