Guides
How to build a risk register
A risk register is a table with one row per risk. The columns to use, a 1 to 5 scoring scale, a worked example and how to keep it current and tied to insurance.
A risk register is a table, usually a spreadsheet, with one row for each risk your business faces. Each row says what could happen, how likely it is, how bad it would be, what you are doing about it, who owns the response and when it is due. You build it by gathering what you know, writing each risk as a clear sentence, scoring it on a fixed scale, choosing a response and then reviewing it on a calendar.
The register is the working document behind your risk management program. The U.S. Office of Management and Budget's Circular A-11 defines it as "a repository of risk information including the data understood about risks over time," and says a register typically holds a description of the risk, the impact if it occurs, the probability, mitigation strategies, risk owners and a ranking to identify higher priority risks. NIST quotes that language in NIST IR 8286 (2020) and adds a point worth remembering: organizations starting out should not wait for the register to be finished before fixing obvious problems.
Step 1: gather the inputs
You write a better register from evidence than from a brainstorm alone. Collect:
- Five years of loss runs: what they are and how to request them from every carrier, plus your own list of incidents that never became claims.
- Your insurance policies and declarations pages, so you know what is covered today.
- Contracts that carry insurance or indemnity requirements: leases, customer agreements, subcontracts, loan documents.
- Workers' comp injury logs and any OSHA records, if you keep them.
- Your site's walk-through notes: where water, fire, theft or customer injury could start.
- Interviews with the people who run the work. The dispatcher, the shop foreman and the bookkeeper know what is fragile.
The What business insurance do I need? is a quick way to catch exposures you have not considered.
Step 2: write each risk as a sentence with a cause and a consequence
"Cyber risk" is a category, not a risk. Write it in three parts: a cause, an event and a consequence.
- Weak: "Fire."
- Better: "A fire in the paint booth stops production at the main plant for several months, and we lose contracts to a competitor."
- Weak: "Employees get hurt."
- Better: "A forklift strikes a pedestrian in the loading area, causing a serious injury and an OSHA investigation."
Clear statements are easier to score, and they point to the control that matters. In the fire example the control is the booth's suppression system and the cleaning schedule, and the insurance answer is business interruption insurance: how business income coverage works. Keep one risk per row. If a sentence needs "and" to join two different consequences, split it.
Step 3: use these columns
| Column | What goes in it |
|---|---|
| ID | A short number so the risk can be referenced in meetings and minutes |
| Category | People, property, income, liability, vehicles, technology, contract, strategic, legal |
| Risk statement | The cause, event and consequence sentence |
| Existing controls | What you already do, so you do not give credit twice |
| Likelihood (1-5) | Chance of occurrence in the next 12 months, using your scale |
| Severity (1-5) | Cost of the event in dollars and in days of lost operation |
| Score | Likelihood times severity |
| Response | Avoid, reduce, transfer or retain; see risk transfer vs retention: avoid, reduce, transfer or retain |
| Action | The specific next step, in a verb phrase |
| Owner | One named person, not a department |
| Due date | A calendar date |
| Insurance | The policy and limit that responds, or "retained by decision" |
| Status | Open, in progress, done, accepted |
| Last reviewed | Date |
You can add a "residual" score for the risk after the new action is done. Many small businesses skip it, and that is fine, but it makes the value of an action visible.
Step 4: score with anchors, not adjectives
Scores drift when "medium" means different things to different people. Anchor each number to something measurable and scaled to your company. The scale below is a hypothetical example for a business with about $4 million in revenue and a few hundred thousand dollars in cash. Rebuild it around your own numbers.
| Score | Likelihood in the next 12 months | Severity (cost or disruption) |
|---|---|---|
| 1 | Rare: less than once in 20 years | Under $5,000 |
| 2 | Unlikely: once in 10 to 20 years | $5,000 to $25,000 |
| 3 | Possible: once in 3 to 10 years | $25,000 to $100,000 |
| 4 | Likely: once in 1 to 3 years | $100,000 to $500,000, or operations down more than a week |
| 5 | Almost certain: more than once a year | Over $500,000, or operations down more than 30 days, or the business's survival at stake |
A common banding: 1 to 4 is low, 5 to 9 moderate, 10 to 16 high, 17 to 25 critical. Whatever bands you use, write the rule that goes with them. For example, any score of 10 or more needs a funded action plan, and any risk with a severity of 5 needs either a transfer or a written sign-off from the owner to retain it.
Severity deserves a second look. A score of 5 for likelihood and 1 for severity equals a 5, and so does 1 for likelihood and 5 for severity, yet the second is the one that ends a business. Sort by severity as well as by score. The business income (interruption) limit calculator helps put a dollar figure on the income side, and the deductible and retention break-even calculator helps with the frequent, smaller claims.
A hypothetical register excerpt
Say a 25-employee machine shop in Indiana. The rows below are illustrative.
| ID | Risk | L | S | Score | Response and action | Owner | Due |
|---|---|---|---|---|---|---|---|
| R1 | Fire in the finishing area stops the plant for months and we lose our largest customer | 1 | 5 | 5 | Transfer and reduce: confirm the business income limit covers a realistic rebuild time; service suppression system | Owner | Dec 15 |
| R2 | Ransomware locks the quoting system and shop-floor scheduling for a week | 3 | 4 | 12 | Reduce: multi-factor authentication, offline backup restore test. Transfer: review cyber limit | Office manager | Nov 30 |
| R3 | Hand or finger injury from an unguarded machine | 4 | 3 | 12 | Reduce: guarding audit and lockout/tagout refresher. Transfer: workers' comp | Shop foreman | Nov 15 |
| R4 | Sole supplier of castings fails, delaying deliveries for six weeks | 2 | 4 | 8 | Reduce: qualify a second source. Transfer: review contingent business income | Purchasing | Jan 31 |
| R5 | Customer contract requires $5 million in liability limits and the umbrella is $2 million | 3 | 3 | 9 | Transfer: price umbrella options; ask customer to confirm the requirement | Owner | Dec 1 |
| R6 | Delivery driver is at fault in a serious crash in a personal vehicle | 2 | 4 | 8 | Reduce: stop personal-vehicle deliveries. Transfer: hired and non-owned auto coverage | Operations | Dec 15 |
Look at the shape. R2 and R3 outrank the fire by score, and they do deserve attention soon, but R1 is the one the owner should never leave unsupported. Sorting both ways keeps the rare catastrophe visible. Also note R5 and R6: neither involves a loss yet, they are gaps between a contract or a practice and the policy. They are the cheapest to fix and most often found by this exercise. The related guides on contractual risk transfer: shifting liability by contract and insurance and employees driving their own cars for work: who is liable? go further.
Step 5: make the register useful at renewal
- Map each risk to coverage or a deliberate choice. The Insurance column should never be blank. "Retained by decision, owner signed" is acceptable. A blank is not.
- Show your broker the high scores. They can tell you which carriers' appetite and forms handle them.
- Track insurer recommendations here. A loss control visit generates recommendations with deadlines; list them as actions. insurance loss control inspections: what to expect explains what to expect.
- Show progress to underwriters. A submission that says the guarding audit was completed and shows the date lands better than a promise. See the the annual business insurance review: what to update for timing.
- Feed the cost figure. If you move from a $5,000 to a $25,000 deductible, the retained losses show up in the Total cost of risk (TCOR) calculator.
Keeping it alive
A register dies when it is reviewed once a year in a rush. A reasonable rhythm: a 15-minute check of the top five risks monthly, a full review each quarter and a refresh at renewal. Add a row whenever a trigger occurs: new location, new service, new hire in a critical role, a serious near miss, a new contract with indemnity terms, a new software system holding customer data. Close rows by date and keep them in an archive tab. Store the file where the owners can see it, not on one person's laptop.
Common failures: everything scored 3, risks with no owner, one row that bundles ten risks, scores without a dollar anchor, and no record of why a risk was accepted. For larger firms the same structure rolls up into an Enterprise risk management (ERM) explained report.
Key takeaways
- A risk register is a spreadsheet with one risk per row: description, likelihood, severity, response, owner, due date and status.
- Write each risk as cause, event and consequence, and anchor the 1 to 5 scales to your own dollars and days of downtime.
- Sort by severity as well as by score, so the rare catastrophe is not buried under frequent small items.
- Give every high risk either an insurance answer, a funded control or a written decision to retain it.
- Review the top risks monthly and refresh the whole register at renewal and after any trigger event.