Risk register

A written list of what could go wrong, how likely it is, how bad it would be, and who is doing something about it.

What it means

A risk register records identified risks with an assessment of likelihood and impact, the controls already in place, the residual risk, and a named owner and action.

It is a live document, reviewed on a schedule.

Why it matters

It moves risk from anxiety to management. Most owners carry a mental list; writing it down is what allows it to be prioritised, delegated and actually addressed.

In regulated sectors it is a requirement and inspectors ask to see it. In unregulated ones, larger customers increasingly do too.

What it looks like in practice

Score likelihood and impact simply — low, medium, high is enough — and sort by the combination.

Name an owner for each. A risk owned by "the business" is owned by nobody.

Review quarterly and after any incident. The register that never changes is not being used.

What to watch out for

Registers listing only the risks you already control. The useful entries are the uncomfortable ones: customer concentration, key person dependency, a single unbacked system.

Treating it as a compliance artefact. A register produced for an audit and never opened otherwise is a cost with no benefit.

Where to get proper advice

Your regulator, in regulated sectors, will specify the format. Otherwise a simple spreadsheet is sufficient and better than a system nobody updates.