How to Conduct Risk Assessment & Create a Risk Register

When you hear about a “risk assessment,” you might picture a giant boardroom table and stacks of paperwork at some multi-billion-dollar corporation. After all, the whole name “enterprise risk assessment” is definitely something for big consulting firms and MBAs.  Truth is, this tool isn’t just for the big guys. Small businesses can also greatly benefit from having a risk assessment process. 

Most small business owners are moving fast, selling their products, and trying to keep the lights on. Stopping to jot down potential risks might feel like a waste of time. 

The challenge is that very little time is spent thinking about what could go wrong, and more importantly, reducing the risk and impact of these events.  

It’s worth the time and effort. Consider what happened with COVID, or the supply chain nightmare afterwards, or the not-quite recession, or our current labour challenges.  

It doesn’t have to be complicated, and once you do it a couple of times, you’ll wonder how you ever managed without it.

What is a Risk Assessment Process?

A risk assessment process looks at the potential risks a company has, their potential impact, and how to remediate the risks.  

At the center of the process is the risk register.  A risk register is a repository for the company’s risks, their assessment and how they’re being mitigated.  . 

Where Most Companies Go Wrong

Here’s the ugly truth: a lot of businesses treat the risk register like a high school assignment they’ll never use in real life. They stick it in a folder or a shared drive and only peek at it when something goes wrong. That’s not what it’s for. 

The whole point is to help you take action before a risk becomes a problem. But too often, owners are too busy selling, shipping, or servicing customers to check back in. It’s understandable, but it’s a huge missed opportunity. If you just create it and forget it, your risk register won’t be any more useful than that gym membership you never use.

That’s why we recommend including a risk assessment and review process as part of your quarterly planning sessions.  After all, the actions that come from reducing risk are definitely working “on the business”.  

How to Create a Risk Register

Okay, so how do you actually do this? Don’t worry—it’s not rocket science. The key is to break it down step by step and keep things at the right level.

Break Down All Areas of Your Business

Start broad. Look at the major  parts of your operation: sales, marketing, IT, finance, customer service, production—whatever departments you have. You want to brainstorm what could go wrong in each area. 

Nail Down “Elevation” (Think 20–50K Feet)

One reason risk registers fail is that people get stuck at the wrong level of detail. For example, if you’re flying at 50,000 feet, you’ll be able to spot the big cities and metro areas. At 20,000 feet you actually start seeing some detail. Or you can be at ground level where you can barely see past the cars and buses you’re stuck next to during rush hour.  

You need to be between 20,000–50,000 feet. You’re high enough to spot big issues—like potential supplier problems or major regulatory changes—without obsessing over every minor glitch. It’s about seeing the forest, not just the trees.

Brainstorm Risks with the Team

You don’t have to do this alone. In fact, you shouldn’t. Talk to your staff. Ask your IT guy: “What could go wrong here?” Ask the production team: “What if the price of raw materials doubled tomorrow?” Your people know their areas inside out. Their input is gold. By involving everyone, you get a richer list of risks and a sense of ownership when it comes to addressing them.

Consider External Factors (PESTEL Analysis)

Remember, your business doesn’t exist in a bubble. External factors—political shifts, economic downturns, social changes, tech disruptions, environmental issues, and legal requirements—all influence your risk landscape. This is where a PESTEL analysis comes in. Think of it as looking at that 50,000-foot view: what if your biggest market passes a new law that affects your product? Or if environmental changes make shipping routes longer and more expensive? Being aware of these external influences can help you head off surprises.

Create Your Risk Register 

Now it’s time to get these risks on paper. Or, more realistically, a spreadsheet. While you may be tempted to make the perfect system, I strongly recommend you keep it simple.  

I personally like using an Excel doc for a risk register. It’s simple and easy to edit as external factors change. You can sort everything (which becomes very important when reviewing) quickly.  

A simple register will include the following columns:

• Department (area)
• Risk Name
• Risk Description
• Owner
• Probability (very low, low, medium, high, very high)
• Impact (very low, low, medium, high, very high)
• Overall Risk Level (Matrix of probability and impact)
• Mitigation
• Acceptance (Accepted, Needs Mitigation, Future Review, Transferred …)
• Action Plan
• Review Date
• Notes

Simply separate the tabs by department (sales, marketing, IT, etc.) , place the risk item in the rows and have two columns; one for probability of the risk coming to fruition and one for the impact if it comes true. 

What Mitigations Do You Have in Place Now?

Risk registers aren’t just about doom and gloom. They’re about solutions. For each risk, note what you’re already doing to reduce it. Maybe you’ve got a backup supplier on speed dial. Maybe your IT team has just installed a cybersecurity shield. Understanding your existing safety nets helps you figure out where you still need to shore things up.

Have a “Date Reviewed”

This step often gets overlooked. A risk register isn’t a static, one-and-done document. It’s more like a snapshot that needs updating as conditions change. Schedule regular check-ins. For higher-level risks, maybe you review them quarterly. For lower-level risks, once a year might be enough. Each time, update the “date reviewed” so you know how current your info is. This also gives you a chance to see if any new risks have popped up or if old ones have faded away.

Drive Action

For risks that are rated higher than your tolerance, the owner should develop an action plan to reduce the risk.  This is great material for rocks (if you use one of the business operating systems like EOS or Scaling Up).

Conclusion

One thing you should always keep in mind: risks are never fully “solved.” They’re only managed. A risk register helps you acknowledge what could go wrong and plan ahead. Instead of living in fear or pretending bad things can’t happen, you face reality head-on. By breaking down your business areas, choosing the right elevation, brainstorming with your team, and keeping track of both internal and external factors, you’ll be way ahead of the curve.

No, this isn’t just for big corporations. Small businesses, local shops, and one-person consultancies can all benefit. By using a risk register, you give yourself a fighting chance to adapt, pivot, and survive—no matter what’s waiting around the corner. You can’t control everything, but you can prepare for anything.

Book a consultation call with Incrementa and we’ll help you get started!