Risk Register Template for Small Businesses (With an Example)
By the SystemaFlow team · Updated November 2026 · Share this
Someone asks at a team meeting what would happen if your biggest client left. The answers come from three directions at once, there's a note about it in a spreadsheet from last year, and nobody's sure who was meant to be looking after it.
A risk register is one list of the things that could hurt your business, with each risk's likelihood, impact, score, owner, action and review date. It turns worries into decisions: what you'll do, who'll do it and when you'll check again.
Here's a template to copy, a simple way to score risks, a filled-in example and a sensible review routine for a small business.
Risk register template (copy this)
Copy these columns into Word, Excel or Google Sheets. Keep one row per risk.
| Column | What to write |
|---|---|
| ID | A number, so you can refer to it (R1, R2…) |
| Risk | What could happen and what it would cause, in one sentence: "If X happens, then Y" |
| Likelihood (1 to 5) | How likely it is in the next year, using the scale below |
| Impact (1 to 5) | How bad it would be if it happened, using the scale below |
| Score | Likelihood × impact, from 1 to 25 |
| Owner | One named person who keeps an eye on it and makes sure the action happens |
| Action | What you're doing to make it less likely or less damaging, or "accept and watch" |
| Due | When the action will be done |
| Status | Open, in progress, done, or accepted |
| Review date | When you'll look at this risk again |
And the blank table, ready to fill in:
| ID | Risk (if… then…) | Likelihood | Impact | Score | Owner | Action | Due | Status | Review date |
|---|---|---|---|---|---|---|---|---|---|
| R1 | |||||||||
| R2 | |||||||||
| R3 |
Two habits make a register useful. Write every risk the same way ("If… then…"), so you're describing a cause and an effect and not just a worry. And give each one a single owner: a risk owned by "the team" is owned by nobody.
How to score a risk
Scoring only works if everyone means the same thing by a 4. Write the scales down and keep them at the top of the register. These are a typical starting point; change the wording to suit your business.
| Score | Likelihood (in the next year) | Impact (if it happens) |
|---|---|---|
| 1 | Very unlikely: hard to imagine it happening | Minor: a few hours lost, no client notices |
| 2 | Unlikely: could happen, but you'd be surprised | Noticeable: a day or two of disruption, or a small unplanned cost |
| 3 | Possible: it's happened to firms like yours | Significant: a client is affected, or a cost you'd have to plan around |
| 4 | Likely: you'd expect it to happen at some point this year | Serious: a client lost, a deadline missed, or a cost that hurts cash flow |
| 5 | Almost certain: it's already happening, or about to | Severe: the business would struggle to carry on as it is |
Then multiply. A risk that's likely (4) and serious (4) scores 16. Decide what each band means before you score anything, so the result tells you what to do:
| Score | Band | What it means |
|---|---|---|
| 15 to 25 | High | Act now. It needs an action with a date, and a check each month |
| 8 to 12 | Medium | Plan an action, and review it every quarter |
| 1 to 6 | Low | Accept and watch. Look at it again at the yearly review |
Multiplying is the usual method, and it does a useful thing: a risk only scores high when it's both fairly likely and fairly damaging. Some firms add the two numbers instead. Either is fine if you stick with one.
Try scoring these
Here are six typical risks for a small service business, with a likelihood and an impact already given. Multiply, then pick the band.
High, medium or low?
Multiply likelihood by impact, then pick the band: High is 15 to 25, Medium 8 to 12, Low 1 to 6.
If our biggest client leaves, then we can't cover salaries for long. Likelihood 3, impact 5
3 × 5 = 15. Even at a middling likelihood, an impact this severe puts it at the top. The action is usually to win more work from other clients.
If a staff member clicks a phishing email, then client data could be exposed. Likelihood 4, impact 4
4 × 4 = 16. Likely and serious. Actions might be two-step sign-in on email and a short session on spotting scams.
If our main project tool is down for a day, then work slows while we use email. Likelihood 3, impact 2
3 × 2 = 6. Annoying, but there's an easy workaround. Accept and watch, and note the workaround in your continuity plan.
If the only person who runs payroll is away on pay day, then staff are paid late. Likelihood 2, impact 4
2 × 4 = 8. Not likely in any given month, but bad when it happens. Train a backup and write the steps down.
If a freelancer's work has no written agreement on who owns it, then a client's rights could be disputed. Likelihood 2, impact 3
2 × 3 = 6. Low today, but cheap to fix: a standard agreement for every freelancer from now on.
If clients keep paying late, then we run short of cash before the month ends. Likelihood 4, impact 3
4 × 3 = 12. It's already happening, so act on it this quarter: clearer payment terms and a fixed chasing routine.
0 of 6 answered.
A risk register example (typical, made up)
Here's the start of a register for a typical 15-person design and marketing agency. The firm, its risks and the scores are invented to show the format.
| ID | Risk (if… then…) | L | I | Score | Owner | Action | Due | Status | Review |
|---|---|---|---|---|---|---|---|---|---|
| R1 | If our largest client leaves, then income falls faster than we can cut costs | 3 | 5 | 15 High | Owner | Win two new accounts this year; keep three months of costs in reserve | End of Q2 | In progress | Monthly |
| R2 | If someone falls for a phishing email, then client files could be exposed | 4 | 4 | 16 High | Operations lead | Two-step sign-in on all accounts; short scam-spotting session for the team | Next month | In progress | Monthly |
| R3 | If our account manager for two key clients leaves, then those relationships go with her | 2 | 4 | 8 Medium | Owner | A second named contact at each client; meeting notes kept in the shared folder | End of Q1 | Open | Quarterly |
| R4 | If the main file storage fails, then live work stops | 2 | 4 | 8 Medium | Operations lead | Check backups restore; fallback written into the continuity plan | Next month | Open | Quarterly |
| R5 | If clients pay late, then cash runs short at month end | 4 | 3 | 12 Medium | Finance lead | Payment terms on every proposal; chase on a fixed day each week | Now | Done | Quarterly |
| R6 | If our office lease isn't renewed, then we'd need somewhere new at short notice | 1 | 3 | 3 Low | Owner | Accept and watch; note the renewal date | n/a | Accepted | Yearly |
A few things to notice. Every risk has one owner, and it's often the owner of the business, which is normal in a small firm. The actions are specific enough to tick off. R4 points to the business continuity plan, because the register says how likely something is and the plan says what you'll do when it happens anyway. And R3 is a key-person risk, which a succession plan deals with properly.
Where to find your risks
You don't need a workshop. Spend half an hour on these prompts and you'll have more than enough for a first register:
- Money: a big client leaving, late payment, a cost that could jump, one bank account or payment provider for everything.
- People: one person who's the only one who can do something, someone key leaving, too much work on too few people. Invisible workflows helps you spot the jobs only one person knows.
- Systems and data: a key tool going down, losing data, a scam email, a supplier with access to your systems. A disaster recovery plan sets out how you'd get them back.
- Clients and contracts: promises in contracts you'd struggle to keep, work with no written agreement, unclear ownership of what you produce.
- Suppliers: a supplier you can't easily replace, a freelancer you depend on.
- Premises: losing access to the office, a lease ending.
Keep to the risks that could hurt the whole business, usually 10 to 20 of them. Risks that belong to one project can stay on that project's own list.
How often to review a risk register
A register that nobody opens is worse than none, because it makes you feel covered. A routine that works for a small business:
- Monthly: the owner of each High risk checks their action is moving. This can be five minutes in an existing meeting, such as your weekly operating rhythm.
- Quarterly: go through the whole register in one sitting, about an hour. Rescore each risk, close what's done, add what's new, and leave with no more than three actions.
- Yearly: look at the Low risks and the scales themselves. Has the business changed enough that a 3 means something different now?
- Straight away: whenever something changes, such as a new big client, someone resigning or a new key system. Add or rescore the risk then, without waiting for the review.
If you'd like a reference point, the UK government's Orange Book sets out the principles it uses for managing risk, and ISO 31000 is the international guideline standard for risk management. Both are written for larger organisations. The habits above are the small-business version of the same idea: name it, score it, own it, act and review.
Common mistakes
Too many risks. A register of 60 rows never gets reviewed. Merge similar ones and keep it to what could hurt the whole business.
Vague risks. "IT problems" can't be scored or owned. "If our file storage fails, then live work stops" can.
Scores without scales. Without written definitions, one person's 3 is another's 5, and the scores mean nothing.
Actions with no date. "Look into it" isn't an action. Give it an owner and a due date, like any other piece of work.
Filed and forgotten. Book the quarterly review into the calendar before you finish the first version.
Want the full version?
The Operational Risk Register in the Risk and Compliance pack keeps the 10 to 20 risks that could hurt the whole business in one place, scored the same way and linked to the lists that already look after them. The Risk Appetite Statement sets the line that triggers action, and the Quarterly Risk and Compliance Review turns it all into an hour a quarter. They're in the Communication, Governance and Visibility Core Vault, as done-for-you templates in Word and PDF.
See what's in the Communication, Governance and Visibility Vault →Or get all 352 systems, and every one we add later, with Masterworks: $999, paid once.
Was this helpful?
Frequently asked questions
- What is a risk register?
- A single list of the things that could go wrong for your business, each with how likely it is, how bad it would be, a score, one owner, what you're doing about it and when you'll look at it again.
- What should a risk register include?
- At least: a short description of the risk, its likelihood, its impact, a score, one owner, the action or control, the status and a review date. Some registers add a score after the action, the date the risk was added and a link to any related plan.
- How do you score a risk?
- Rate likelihood and impact from 1 to 5 each, using written definitions so everyone scores the same way, then multiply them. That gives a score from 1 to 25. Decide in advance which scores need action now and which you just keep an eye on.
- How often should a risk register be reviewed?
- For a small business, a full review once a quarter works well, with high-scoring risks checked monthly. Add or rescore a risk whenever something changes, rather than waiting for the next review.
- Is a risk register the same as a risk assessment?
- Not quite. A risk assessment is the act of finding and judging risks, often for one activity or place. A risk register is the ongoing list where the results are kept, owned and reviewed. This post covers risks to the business as a whole.
- Can I keep a risk register in Excel or Word?
- Yes. A table in Word, Excel or Google Sheets is enough for a small business. What matters is that it's in one place, everyone knows where, and someone looks at it on a fixed date.
