A practical guide to setting up a risk register that people actually use
Most risk registers die in a spreadsheet nobody opens. This guide walks through a proportionate approach: fewer risks, clear owners, simple scales and a review rhythm that sticks.
A risk register is only valuable if it changes decisions. Below is the approach we use with small and mid-sized organisations to build a register that management keeps using after the consultant has left.
Step 1: Start from objectives, not from a template
Download a generic list of 200 risks and you will spend the first workshop deleting 180 of them. Instead, write down the organisation's five to eight most important objectives for the next 12 to 24 months and ask one question of each: what could stop us achieving this?
This keeps the register short and relevant, and it immediately connects risk to strategy.
Step 2: Describe risks as events, with cause and consequence
A good risk statement has three parts:
| Part | Example |
|---|---|
| Cause | Because key supplier contracts have no service levels... |
| Event | ...a critical delivery could be delayed... |
| Consequence | ...resulting in production stoppage and penalty claims. |
"Supplier risk" on its own is not a risk; it is a category. Nobody can own or treat a category.
Step 3: Use simple, agreed scales
A five-by-five matrix is more than enough. Define each level of likelihood and impact in words that make sense for your organisation (for example, impact level 4 might be "loss above MUR 2 million or regulatory sanction"). Agree the scales once, write them down and stop debating them.
Step 4: Assign one owner per risk
Not a department. Not "management". One named person who is accountable for monitoring the risk and reporting on its treatment. Ownership is the single biggest predictor of whether a register stays alive.
Step 5: Decide the treatment and the indicator
For each risk above your appetite line, record:
- the treatment (accept, reduce, transfer, avoid) and the specific actions,
- the key risk indicator that would show the risk is increasing, and
- the review date.
Step 6: Build the review rhythm
- Monthly: owners update their risks and indicators (ten minutes each).
- Quarterly: the management team reviews the top risks and treatment progress.
- Annually: the board or owners revisit appetite and the full register.
Common mistakes to avoid
- Scoring risks to look green rather than to inform decisions.
- Mixing risks, issues and audit findings in one list.
- Producing a heat map nobody discusses.
- Letting the register become a compliance exercise rather than a management tool.
A proportionate outcome
For most organisations the result is a register of 15 to 30 risks, a one-page heat map and a quarterly discussion that genuinely shapes priorities. That is risk management working as intended.