How to Build a Risk Register for Your Company

A risk register is a list of things that could hurt your business, how likely and how bad they are, and what you're doing about them. It doesn't need to be complicated to be useful.

Step 1: Identify risks by area

Go through each area and ask "what could stop us or cost us a lot?":

• Commercial: one customer is 40% of revenue; raw material prices jump
• Operations: a critical machine with no backup; a single supplier
• People: one person knows a key process; high attrition in a team
• IT and cyber: ransomware, email fraud, data loss
• Financial: slow customer payments; foreign exchange
• Safety and compliance: fire, accidents, missed filings

Write each as "event because of cause": "Production stops because machine 4 has no backup."

Step 2: Score likelihood and impact

Use 1 to 5 for each:

• Likelihood: 1 rare, 3 possible, 5 almost certain
• Impact: 1 minor, 3 serious, 5 could stop the business

Score = likelihood × impact. 16 to 25 Critical, 10 to 15 High, 5 to 9 Medium, 1 to 4 Low.

Step 3: Plan actions for High and Critical risks

For each: an owner, specific actions and a date. Options are to reduce the likelihood (backups, training), reduce the impact (insurance, spare parts, second supplier), or accept the risk knowingly.

Step 4: Score the residual risk

After actions, score again. If ransomware was 3 × 5 = 15 and you add offline backups and multi-factor login, it might drop to 2 × 4 = 8.

Step 5: Read the heat map

A 5 × 5 grid with likelihood on one side and impact on the other shows where risks cluster. The goal is to move risks from the top-right (red) toward the bottom-left (green).

Business continuity basics

For your critical risks, write down: how you'd keep delivering for a week if it happened. For example: who would run the machine at another unit, where backups are restored from, which supplier ships in an emergency.

Review every quarter

New risks appear and old ones fade. A 30-minute quarterly review with the leadership team keeps the register real.

Our Business Continuity & Risk Register scores every risk, tracks owners and actions, and shows heat maps before and after actions.