How to create a risk register your team will actually use

In short: How to create a risk register, in six steps: decide what it covers and who keeps it; list what could go wrong; describe and score each risk; decide what to do, with an owner and a date for each; check the action worked; and review it every month. It catches what could go wrong while it is still cheap to fix. Our free risk register worksheet walks you through your first five, and our Risk Register Template has it ready-made.

A risk register is a simple list of the things that could go wrong in a business or project, how likely and how harmful each one is, who owns it, and what is being done about it.

Written by Mike Armstrong, a company director of over 30 years. Last reviewed: 20 October 2026.

When I wrote the management system for a maritime security company, the guards on the ships knew far more about what could go wrong than anyone in the office. The rule that made the risk process work was one line: nobody would ever be criticised for raising a risk. Once the guards believed it, they started telling us what could go wrong, and the useful risks came in. Every business has people like those guards. The trick is making it safe for them to speak up.

Let’s leave the ships behind and look at something closer to home: a typical Monday in a small business.

It’s Monday morning, the van won’t start, and the day’s three deliveries are sitting in the yard. Someone rings round for a hire van, someone else rings the customers to apologise, and by lunchtime the owner is wondering how a perfectly good week went wrong before nine o’clock.

Dave knew. Let me introduce you to Dave. Dave’s been here for years, knows absolutely everything and could load that van with his eyes shut. He’s friendly, very practical and never has a bad word to say about the place. He mentioned a fortnight ago that the battery was on its last legs. He said it at the coffee machine, nobody wrote it down, and it went the way of every coffee machine conversation.

That’s what a risk register is for: catching what Dave knows before it costs you a morning, a customer or worse. On this Learn page you’ll find out why a risk register is worth ten minutes a month, how it differs from a risk assessment, a six-step method for creating one, a worked example you can copy, the mistakes that tend to kill registers off, and where it fits if you ever go for ISO 9001. And stick around to the end, because Dave gets the last word.

Why a risk register is worth ten minutes a month

Much of what goes wrong in a small business is not a bolt from the blue. Somebody usually saw it coming: the supplier who has been late three times, the laptop nobody has backed up, the one person who knows how the invoicing works. A risk register simply makes sure those warnings are written down, owned and acted on, instead of left at the coffee machine.

The gap between knowing and acting can be wide. The UK government’s Cyber Security Breaches Survey 2025 found that 43% of businesses had suffered a cyber security breach or attack in the previous 12 months, yet only 29% had carried out a risk assessment covering cyber security. That is just one kind of risk, but the pattern tends to hold for the others too.

A risk register does not stop every problem. What it does is give you a fighting chance of dealing with the likely ones while they are still cheap to fix. A late supplier you planned for is an inconvenience. One you did not plan for can cost you a customer.

Before you start, it helps to be clear about one thing people often mix up.

Risk register or risk assessment: what’s the difference?

They sound alike and they work together, but they do different jobs.

In the UK, for example, employers must assess the health and safety risks of their work, and the Health and Safety Executive says that if you employ five or more people you must record your significant findings. A risk register does not replace that. It sits above it, so the biggest safety risks sit on the same list as the late supplier and the missed invoice, and get the same attention.

So that’s what you’re building. Here’s how to build it.

The method: how to create a risk register in six steps

The first two steps set it up, the middle two score and decide, and the last two keep it alive. The free worksheet follows exactly the same six steps.

1. Decide what it covers, and who keeps it

Agree whether the register covers the whole business, one site or one project. A small business usually needs one register; a business running several big jobs may want one per project. Then name one person to keep it up to date. Not a committee, one person. Everybody can add to it, but somebody has to own the list.

And say the most important thing out loud, to everyone: nobody will ever be criticised for raising a risk. If people think a risk will be held against them, they keep it to themselves, and your register only ever shows you the risks that are safe to mention.

2. Find what could go wrong

Sit down with the people who do the work, Dave included, and ask three questions:

• What could stop us getting paid this year?
• Which supplier, piece of equipment or person would hurt most if we lost them tomorrow?
• Where in the work, from first enquiry to final handover, do things already go wrong now and then?

Jot down every answer, however small. Then pick the ten or so that matter most. Losing your biggest customer, a key supplier letting you down and the one person who knows how something works going off sick are the risks that tend to hurt small businesses hardest, and they are often not the first ones people mention.

3. Describe and score each risk

For each risk, write one line that says what could go wrong, why, and what it would do to the business. “Supplier problems” is too vague to act on. “Our only steel supplier goes bust, so jobs stop and deliveries are missed” tells everyone exactly what you are worried about.

Note what you already do to control it, then score it as things stand. Pick a number from 1 to 5 for how likely it is, and a number from 1 to 5 for how much harm it would do, and multiply the two. The answer, from 1 to 25, is the risk score.

Risk score: 1 to 4 Low, keep an eye on it. 5 to 9 Medium, plan an action. 10 to 25 High, act now.

Don’t agonise over the numbers. The point is not precision; it’s putting the risks in a sensible order, so you spend your time on the ones that matter.

4. Decide what to do about each one

For every risk, choose one of four responses:

• Reduce it: take an action that makes it less likely or less harmful, such as approving a second supplier.
• Accept it: decide, on purpose, to live with it, because it is small or the fix costs more than the risk.
• Transfer it: pass some of the cost to someone else, for example by insurance or a clause in a contract.
• Avoid it: stop doing the thing that creates the risk.

Give every risk one owner, by name, and give every action a due date. A risk with nobody’s name against it tends to stay a risk. For the risks that could stop you trading altogether, such as a fire, a flood or losing your IT, a business continuity plan sets out how you keep serving customers until things are back to normal.

5. Check the action worked

Writing down an action is not the same as dealing with the risk. Once an action is done, check whether it worked, then score the risk again. If the score has come down, you have the proof. If it hasn’t, the action wasn’t the right one, and it’s better to find that out on a quiet Tuesday than on the day it goes wrong.

6. Review it every month

Put ten minutes in the diary every month, even if it feels as if nothing has changed. Add new risks, close the ones that have gone away, and rescore the rest. Risks move: the supplier who was rock solid last year may be struggling now, and a register that is out of date can be worse than none, because it tells you that you are safe.

That’s the method. Here’s what it looks like filled in.

A risk register example

Here’s a register for a building contractor with fifteen staff, fitting out a client’s new office over eight weeks. It’s a project register, but a whole-business register looks exactly the same.

In week five the first electrician fell ill. The second started the next day and the handover date held, so R01 was rescored at 6, Medium. That is the whole point: the register earned its keep the day the risk turned up.

Getting the first version written is the easy part. Keeping it useful is where registers tend to fail.

Five mistakes that kill a risk register

• Making it too long. Fifty risks feels thorough, but nobody reads it. Ten real ones, owned and acted on, will do far more good.
• Nobody owns the risks. “Management” is not an owner. If a risk has no name against it, assume nothing is happening.
• Scoring it once and filing it. A register written for a tender or an audit and never opened again is a snapshot, not a tool.
• Making everything High. If every risk is red, nothing stands out. Score honestly and let the order do its job.
• Shooting the messenger. The first time someone is told off for raising a risk is often the last time anyone raises one.

If you’re working towards ISO 9001, there’s one more thing worth knowing.

Where a risk register fits in ISO 9001

ISO 9001 doesn’t actually say you must keep a risk register. What it does ask, in clause 6.1, is that a business works out its risks and opportunities, judges how much each one matters, plans actions in proportion, and checks afterwards that the actions worked. The 2026 edition now treats risks and opportunities separately, and notes that risks can include keeping customers served during and after a disruption. A risk register, with a small section for opportunities, is simply the most practical way to show you’ve done all of that.

You don’t need to learn ISO 9001 to keep one. If you do go for certification, our ISO 9001:2026 Certification-Ready System includes its own Risk and Opportunity Register, already laid out the way an assessor expects to see it.

Free printable: the risk register worksheet

The worksheet takes you through the six steps on paper: what the register covers, the three questions to ask your team, the scoring guide, and room to describe, score and act on your first five risks. Print it, sit down with the people who do the work, and fill it in together. No sign-up needed.

Get the free worksheet

Frequently asked questions

What is a risk register?

A risk register is a list of the things that could go wrong in a business or project, with a score for how likely and how harmful each one is, the person who owns it and what is being done about it. It’s a working tool, reviewed regularly, not a one-off report.

What is a risk register in project management?

In project management, a risk register lists the risks to one project, such as late deliveries, a key supplier pulling out or changes from the client, with an owner and an action for each. It’s usually reviewed at every project meeting and closed when the project ends.

What should a risk register include?

At minimum: a description of each risk and its effect, the controls already in place, a likelihood and impact score, an owner, the response you have chosen, the action and due date, whether the action worked, and whether the risk is still open. Anything more is optional.

How often should a risk register be reviewed?

Monthly suits many small businesses, with an extra look whenever something big changes, such as a new contract, a key person leaving or a near miss. Project registers are often reviewed at every project meeting.

Is a risk register the same as a risk assessment?

No. A risk assessment looks at the hazards of one task or place and the controls that keep people safe. A risk register is a wider list of every kind of risk to the business, which can include the biggest safety risks alongside money, suppliers, people and customers.

Who should own the risk register?

One named person should keep the register up to date, often the owner or a manager. Each risk on it should have its own owner too: the person best placed to make sure its action gets done.

Can I see a risk register example?

Yes, there’s a worked example on this page: a building contractor fitting out an office, with five risks scored, owned and acted on. The free worksheet and the Risk Register Template both include room to build your own.

The short version

Here’s what you’ve learned:

• A risk register is a short list of what could go wrong, how much it matters, who owns it and what’s being done.
• Decide what it covers, name one person to keep it, and make it safe for anyone to raise a risk.
• Score each risk for likelihood and harm, choose a response, and give every action an owner and a date.
• Check the actions worked, and review the whole thing every month.

And Dave? Dave now has his own line on the register. He spotted the van battery, the flaky laptop and the supplier who’d started paying their own bills late, all before Christmas. The owner says it’s the cheapest ten minutes of the month. Dave says he’s been saying that for years.

What next?

• Get the free risk register worksheet and fill in your first five risks this week.
• Want it ready-made? See the Risk Register Template.
• When an action is a missing or unclear way of working, write it into an SOP: How to write a standard operating procedure.
• Going for ISO 9001? The ISO 9001:2026 Certification-Ready System has every document you need.

About the author

Written by Mike Armstrong, senior ISO consultant, former company director, and founder of Plain Standards. In over 30 years running companies at director level, Mike built his own management systems to drive profit long before he adopted ISO 9001, so he comes at this from the owner’s side, not the auditor’s. Plain Standards helps small and medium sized businesses get ISO certified without a consultant.