Risk Management for Small Businesses: A Risk Register That Is Maintained

Why do risk registers end up in a drawer?

Small companies are more vulnerable than large ones because a single event hits a larger part of the whole. Losing a key customer, a fire in the workshop, an encrypted server, or the resignation of the only master craftsman can be enough. Almost every owner knows these risks. What is usually missing is a format in which they come up regularly before they happen.

If there is a risk analysis, it was often created for a specific occasion: a bank meeting, a tender, an audit. After that it sits in a folder. This leads to the guiding question of this guide: How does a small company build a risk register that is actually maintained and changes decisions?

To answer it, we first clarify the terms, then introduce the risk matrix as a widespread thinking model and review what research knows about its limits. After that we weigh how much formality a small company needs and describe a seven-column risk register and a maintenance rhythm that fits into daily work.

A risk register that nobody reads protects as little as a fire extinguisher in the basement that no one knows about.

What are risk, risk management, and risk owner?

The international standard ISO 31000 defines risk briefly as the effect of uncertainty on objectives. For daily operations, this can be translated: a risk is an event that can happen and would then cost money, customers, deadlines, or the company’s ability to act. Risk management is the recurring process in which such events are identified, assessed, treated, and monitored. A risk owner is the person who keeps an eye on a specific risk and is responsible for the agreed measure.

Risk management is thus part of running a company with proper control. In the article on corporate governance for small businesses, naming the risks is therefore the first step of the governance page. It is also a precondition for resilience. According to Duchek (2020), organizational resilience begins with the ability to anticipate threats before coping and adaptation come into play, as the analysis of business resilience describes.

A good wording separates cause, event, and consequence. “Supply chain” is not a risk but a topic. “Because we source the control board from only one manufacturer, a delivery stop could mean we ship no systems for six weeks” is a risk. Only this form shows where a measure can take effect.

The thinking model: the likelihood and impact matrix

The best-known tool is the risk matrix. Each risk is rated on two attributes, likelihood and impact, usually in three or five levels. The cells of the table are colored: green means monitor, yellow means act, red means act immediately. Behind it lies the calculation that a risk can be expressed as the product of likelihood and damage.

The matrix is popular because it needs no statistics, can be explained quickly, and lets everyone have a say. Like a weather map, it shows at a glance where things get uncomfortable. However, it is fair to ask whether it actually leads to better decisions.

What research shows about the limits of the risk matrix

The risk researcher Louis Anthony Cox examined the mathematical properties of risk matrices (Cox 2008). His starting point: the matrix is widespread, recommended in standards, and standard practice in many organizations, but hardly anyone has checked whether it improves decisions. His results are sobering and important for practice.

• Poor resolution: Typical matrices can rank only a small share of randomly chosen pairs of risks unambiguously and correctly, by his calculation often less than 10 percent. Very different risks land in the same cell.
• Errors: A matrix can give a smaller risk a higher rating than a larger one. If likelihood and damage are inversely related, that is, rare events with large damage and frequent ones with small damage, it can be worse than a random choice.
• Weak basis for allocating resources: How much money should go into which measure cannot be derived from the colored cells.
• Ambiguous ratings: Everyone interprets “possible” or “noticeable” differently. Different people can rate the same risk in opposite ways.

In his simplest example, a matrix with only two levels per axis, two random risks can be ranked without error in only 12.5 percent of cases. In 37.5 percent both land in the same cell, and the matrix helps no more than a coin toss. Cox does not conclude that matrices must be abandoned but that they should be used with caution and only with their assumptions made explicit.

For a small company, a clear rule follows. The matrix is good for sorting a long list into more and less important. For the five most important risks, you should go one step further and estimate the possible damage in euros and the likelihood as a rough number. That is imprecise, but more honest than a color.

How much risk management does a small company need? Two perspectives

The first view says: formal risk management is for corporations with supervisory boards and auditors. The owner of a small company knows the risks, and every list costs time that is missing in daily business. This view has a true core. Many methods from the corporate world really are too heavy for a company with 15 people.

The second view says: small companies in particular need it, because a single event can endanger them. A survey of 375 small and medium-sized manufacturers in the Chinese province of Guangdong found that risk management practices were associated with better performance, partly through higher organizational resilience (Qiu, Sumesh, and Pertheban 2025). The study is a cross-sectional survey from a different economic environment, so it shows an association, not proof. A case study in a Portuguese hotel also shows that different roles in the same company consider different risks urgent and see differently who owns them (Rodrigues and Magano 2025).

I consider the second view right if the form demanded by the first is taken seriously. A small company does not need a risk manual, but a short list with owners that is looked at regularly. The hotel finding is an argument for not writing the list alone: whoever works only from their own view overlooks the risks others see every day.

The maintained risk register: seven columns

The tool of this guide is the maintained risk register. It has 10 to 15 entries and seven columns: the risk as cause, event, and consequence, the owner, the likelihood, the possible damage in euros, an early warning sign, the measure, and the date of the next review. The early warning sign is the column that keeps the register alive, because it says what to watch for in daily work.

Multiplying likelihood by damage gives the expected damage per year. It is a rough figure, but it orders the list differently from gut feeling. This is especially striking for bad debt: at a 5 percent margin, it takes 200,000 euros in revenue to offset a 10,000-euro loss, as the due diligence guide calculates.

There are four basic directions for a measure. A risk can be avoided by not entering into the business, reduced by lowering likelihood or damage, transferred, for example through insurance or contractual rules, or consciously accepted when all other paths are more expensive. Consciously accepted means: it is on the list, and someone has decided.

How does the register stay alive? The maintenance rhythm

1. Create it in 90 minutes

   The owner and two or three people from different areas collect risks, phrase them as cause, event, and consequence, and sort them with the matrix. The 10 to 15 most important go on the list.

2. Name owners

   Each risk gets exactly one owner, who watches the early warning sign and is responsible for the measure.

3. Fifteen minutes a month

   In the monthly meeting, the owner asks only: has any early warning sign moved? Is a measure due?

4. One hour a quarter

   The whole list is reviewed once, estimates are adjusted, resolved risks are removed, and new ones are added.

5. After every event

   If something happens that was on the list or should have been, the list is revised within a week.

Two connections make the register more effective. Whoever prepares a larger decision checks which risks it changes and writes that into the memo. And risks concerning the absence of people lead to concrete precautions, as the guide to the emergency folder describes for the owner’s absence. For attacks on IT, the guide to basic IT security for small businesses sets out the first rules.

Conclusion: how does a risk register become a tool?

We began by asking
a small company builds a risk register that is actually maintained and changes decisions. The answer begins with the format: few entries, each phrased as cause, event, and consequence, each with an owner, an early warning sign, and a measure. The risk matrix helps with sorting, but as Cox (2008) shows, it is not a measuring instrument. For the most important risks, a rough estimate in euros says more than a color.

The register is maintained through a fixed rhythm that fits into existing meetings and through the rule of revising it after every event. The sober observation is: risk management in a small company is less a method than a habit of regularly asking the uncomfortable questions while there is still time for answers.

First steps for this week

1. Write down the five events that would hit your company hardest, each as cause, event, and consequence.
2. Roughly estimate the likelihood per year and the damage in euros for each.
3. Name an owner for each and an early warning sign they watch.
4. Set a measure with a deadline for the two largest risks.
5. Put a fixed fifteen-minute risk item on the agenda of the next monthly meeting.