How to build a risk register

List what could go wrong, score it, and record what you did about it. The scoring before and after is the useful part.

A risk register makes uncertainty explicit. Its purpose is not to predict but to ensure the significant risks have been thought about rather than merely worried about.

Step-by-step

1. List what could go wrong. Widely — you can prune later.
2. Score likelihood and impact.
3. Multiply for a rating and sort.
4. Record mitigations, and score again afterwards.

Before and after is the point

An inherent score says how bad the risk is untreated. A residual score says how bad it remains after what you have done. The difference measures whether the mitigation was worth anything.

A mitigation that does not move the score is not a mitigation. This catches a great deal of activity that exists to be seen to be doing something.

Rare and catastrophic beats common and trivial

Multiplying likelihood by impact tends to flatten these. A risk that would end the business deserves attention even at low likelihood, and simple multiplication understates it.

Treat anything existential separately, whatever it scores.

The four responses

• Avoid — do not do the risky thing.
• Reduce — lower likelihood or impact.
• Transfer — insurance or contract terms.
• Accept — consciously, and written down.

Accepting is legitimate. Accepting by never having considered it is not, and the register exists to tell those two apart.

Frequently asked questions

How do I score likelihood and impact?

A simple scale of one to five for each is enough. Precision is not available here, and pretending otherwise adds no value.

What is the difference between inherent and residual risk?

Inherent is the risk untreated; residual is what remains after mitigation. The gap between them tells you whether the mitigation actually achieved anything.

What about risks that are unlikely but catastrophic?

Handle them separately. Multiplying likelihood by impact understates them, and a risk that could end the business deserves attention regardless of its score.