Risk & Contracts · 10 min read
Risk Management for Small Business: A Risk Register That Actually Works
You do not need a risk department. You need one honest page that lists what could go wrong, how bad it would be and who will do what about it.
Dennis AlejoBusiness consultant · Project & operations manager · · 2,294 words
When it is raining, nobody asks whether an umbrella is a pessimistic accessory. We understand that carrying one costs almost nothing and that being soaked costs a lot. Yet in business, mentioning what could go wrong in a planning meeting often gets you a look that says "why are you so negative?" The result is that small companies, which have the least cushion, tend to do the least risk planning, and the first unexpected event hits them at full strength.
The good news is that risk management for a small business does not need a department, a license or special software. It needs one honest page: a list of what could go wrong, how likely and how damaging each item is, what you will do about it and who is watching. That page is called a risk register. This article shows how to build one in an afternoon, how to keep it alive without adding bureaucracy and how the risks change depending on what kind of project you are running.
What a risk is, and what it is not
Let us start with clear words, because confusion here causes half the problems. A risk is an uncertain event that, if it happens, would affect your objectives. The key word is "uncertain": it might happen, and it might not. An issue is a risk that has already happened, so it is no longer a matter of probability but of response. An assumption is something you are treating as true without proof, like "the supplier will deliver in two weeks." A constraint is a fixed limit, like a deadline set by a contract.
Why does this matter? Because each needs different handling. Issues need action today. Risks need a plan and a watch. Assumptions need to be tested, and many risks are simply untested assumptions in disguise. When a team mixes all of these in one long list, the urgent issues push out the strategic thinking, and the register becomes a complaint box.
One more point is often missed: risk can be positive. An uncertain event that would help, such as a client proposing a larger order or a permit coming earlier than expected, is an opportunity. A good register has room for both, because preparing for the good surprise (can we handle double the orders?) is as valuable as preparing for the bad.
Why small businesses skip it, and why it matters more for them
Small companies skip risk planning for understandable reasons. There is no time. The founder keeps everything in their head. Planning for bad outcomes feels like tempting fate. And formal risk management sounds like something for banks and airlines.
But the logic runs the other way. A large organization can absorb a failed supplier or a lost customer. A small one often cannot. Cash is tight, one key person holds critical knowledge, and a single large customer may represent a big share of income. The less cushion you have, the more valuable it is to see trouble coming. Think of it as the cheapest insurance policy you will ever buy: an hour a week and a page of paper.
Step one: find the risks
The most common failure in risk identification is a list that contains only the obvious risks, like "bad weather." To find the real ones, use two simple tools.
The first is the pre-mortem, a technique popularized by the psychologist Gary Klein. Gather the team and say: "Imagine that it is six months from now and this project has failed badly. Write down, individually and silently, why it failed." Then collect the reasons. The exercise works because it gives people permission to say what they were already worried about but were afraid to raise as a "negative" idea. In ten minutes you will have a list richer than any brainstorm of "what could go wrong."
The second is a category checklist, which prompts you to look in places you might ignore:
- People: key person leaves or gets sick, skills missing, burnout.
- Suppliers and partners: late delivery, quality problems, a supplier going out of business.
- Money: cash flow gaps, cost increases, late payments from customers.
- Regulation and permits: approvals take longer, rules change.
- Technology: system fails, data lost, a tool is discontinued.
- Customers and market: demand lower than expected, a competitor moves.
- Environment and seasonality: weather, holidays, seasonal peaks.
- Scope and requirements: unclear expectations, requested changes.
Write each risk in a standard sentence: "Because of [cause], [event] might happen, resulting in [effect]." For example: "Because we depend on one supplier for the main component, a delay might happen, resulting in a three-week slip in the launch." This format forces clarity. "Supplier risk" is a worry. The sentence is something you can plan around.
Step two: score probability and impact
Now rank the risks, because you cannot manage twenty things at once. For each, estimate two things on a scale from one to five: how likely it is (probability) and how bad it would be (impact). Multiply the two to get a score between 1 and 25.
The scales need to be defined to be useful. For impact, tie each level to something concrete for your business. In a small company, "1" might mean a delay of less than a day or a cost under $500, and "5" might mean a delay of more than a month or a cost above $20,000. For probability, "1" might be "very unlikely, once in many years," and "5" "almost certain." The exact definitions matter less than being consistent and writing them down so that two people scoring the same risk end up in the same neighborhood.
A word of caution: do not take the numbers too seriously. They are not measurements, they are a structured way of having a conversation. The most valuable moment is when two team members disagree about a score, because the disagreement reveals different information. Use the tool below to try it. Replace the sample risks with your own, slide the probability and impact, and see how the ranking changes.
Step three: choose a response
A risk without a response is only a worry. For each significant risk, choose one of four classic strategies.
Avoid. Change the plan so the risk cannot happen. For example, drop a fragile feature from the first version, or choose a different location.
Reduce. Lower the probability or the impact. A second supplier reduces the chance of a stoppage. A checklist reduces the chance of a mistake. Training a backup person reduces the impact of an absence.
Transfer. Move the consequences to someone else, usually through insurance, contract terms or warranties. I look at the contract side in more depth in contract risks that quietly cost projects.
Accept. Decide consciously to live with it, because the cost of responding exceeds the likely loss. The key word is "consciously." Accepting a risk is a decision that someone makes and writes down. Ignoring it is not acceptance.
For opportunities, the mirror strategies are to exploit, enhance, share or simply accept. If a large customer might expand their order, you might enhance the chance by being more responsive, or you might prepare capacity in advance.
Step four: owner, trigger and date
Three more fields turn a list into a working tool.
An owner is the one person responsible for watching the risk and executing the response. Not a team, not "management." Without a name, nothing happens.
A trigger is the early-warning sign that the risk is becoming real. For "supplier might be late," the trigger could be "no shipping confirmation by day five." Triggers convert vague worry into a precise watch. They also connect with the leading indicators I discuss in data-driven project management.
A date is when the response must be in place or the next review happens. Risks without dates age quietly until they become issues.
Contingency: a reserve for the unknown
Even with all this work, some things will go wrong that you did not anticipate. That is what a contingency reserve is for: a deliberate buffer of time and money that you hold for risks, not for convenience. Size it by looking at the risks rather than applying a flat percentage, and make it larger at the start of a project when you know less, and smaller as uncertainty is retired. The important discipline is governance: agree in advance who may spend it and for what, so that the buffer does not quietly become part of the base budget. A reserve that everyone spends on small wishes protects nothing when the real surprise arrives.
A worked example: a bakery opens a second location
Here is a made-up illustration to show the whole method working together. A small bakery plans to open a second shop in six weeks. The owner and her manager spend thirty minutes on a pre-mortem and end up with eleven risks. Four rise to the top after scoring.
The first is that the oven installation slips, because only one installer serves the area. Probability is high and impact is severe, since no oven means no opening. The response is to reduce: book the installer now, confirm the date in writing and arrange a backup option of renting a temporary oven. The owner is the person responsible, and the trigger is "no confirmed installation date by the end of week two."
The second is that the lead baker at the new shop has not been hired. The response is to reduce and avoid: start recruiting immediately and train the current assistant as a stand-in. The third is a permit inspection that could be rescheduled. That risk is transferred partly by booking the earliest slot and preparing the checklist that inspectors use. The fourth is a cash gap, because supplier invoices for equipment arrive before the first sales. The response is to accept a small risk and reduce the rest by negotiating payment terms and keeping a reserve.
Notice what happens. None of the four risks is exotic. But by naming them, scoring them, assigning owners and writing triggers, the owner turns a vague anxiety into four specific, dated actions that fit on a single page. When the installer calls in week three with a delay, the response is already half prepared. The only cost was an hour of planning, and the value was a calmer opening.
Keep the register alive
A risk register written once and filed is a decoration. Make it a living tool with a short weekly habit: in your regular project meeting, spend five minutes on the top five risks. Has the probability changed? Has a trigger fired? Is the response on track? Add new risks as they appear, and close those that can no longer happen. Over time, you will notice patterns, and the exercise will become faster.
It also helps to keep two clearly separate lists: the risk register for things that might happen and an issues log for things that have. When a risk materializes, move it across and start the response immediately. The same discipline helps in stakeholder mapping, where a change in someone's attitude is often the first trigger that a risk is becoming real.
Different projects, different risks
The method is constant. The content changes with the project.
Construction and fit-out projects are dominated by supply delays, weather, ground or building conditions that differ from assumptions, permit timing and the performance of subcontractors. The practices in how a clinic opens on time are largely a risk management story: integrating operations into the construction schedule removes a whole category of opening-day risk.
Import and trade businesses, like the heavy machinery imports behind Titan Heavy Imports, carry risks around transport, customs, exchange rates and supplier reliability. Many of these are transferable through terms and insurance.
Exploration projects, such as Llama Purisima, live with geological uncertainty by nature, which is why the work is organized in stages with a decision after each: you spend a limited amount to learn something before committing more.
Research and trading projects, like Trade Arena, have a risk that is easy to miss: believing a result that is only luck or a data error. The defense is a pipeline with gates, where a strategy has to pass several honest tests before any real money is at stake.
Startups face risks of focus and cash. The 90-day sprint is partly a risk tool: by choosing three projects and a scoreboard, you limit the number of bets in flight.
Common mistakes
A few errors recur. The register is too long: fifty risks means none are managed, so keep the top ten visible. The risks are vague: "things might slip" cannot be owned. The scoring becomes theater: people argue about whether a risk is a 3 or a 4 instead of deciding what to do. There are no owners. And the register is never revisited, so by the third month it describes a project that no longer exists.
A simple template
If you want a starting format, use a table or spreadsheet with these columns: number, risk statement, category, probability, impact, score, response strategy, action, owner, trigger, next review date and status. That is all. Print it or put it on a shared page, and make it the second page after your project plan.
Risk management is, in the end, a habit of looking ahead together and saying the uncomfortable thing early. A small business that does it for an hour a week gains a calm that no amount of heroics can replace. If you want help building the habit across your projects, it is part of the way I work with teams through Project Focus and in the operations and owner's representation service.
What is the risk you are most afraid to put on your own list? Tell me in the comments.
Frequently asked questions
What is a risk register?
A risk register is a simple list of the uncertain events that could affect a project or business, each with a probability, an impact, a chosen response, an owner and an early-warning trigger. It is reviewed regularly and updated as things change.
How is a risk different from an issue?
A risk is something that might happen. An issue is a problem that has already happened and needs action now. Keep them in separate lists so that urgent issues do not crowd out planning for risks.
How do I score risks?
Rate probability and impact from one to five, using written definitions tied to your business, and multiply them for a score from 1 to 25. Treat the numbers as a structured conversation, not as exact measurements.
What is a pre-mortem?
It is an exercise where the team imagines that the project has failed and writes down why. Because people are imagining a past failure, they feel free to name worries that they would otherwise keep to themselves.
Join the conversation
Did this help? A quick reaction tells me what to write next.
Be the first to react.
Loading comments…