What is a risk register — and why your spreadsheet isn’t one

Most Australian small businesses have something they call a risk register. It’s usually a spreadsheet, it was usually made for a tender, and it usually hasn’t been opened since.

That isn’t a criticism of the people who made it. A register built to answer someone else’s question, once, has done its job. The trouble starts when you need it to answer your question — what are we actually exposed to, and what are we doing about it? — and discover it was never built to.

The four things a real register holds

A risk register is not a list of things that might go wrong. It’s a live record of four things:

• The risk — described as an event with a cause and a consequence, not a one-word topic like “cyber”. “Ransomware encrypts our production systems and we cannot invoice for a week” is a risk. “Cyber” is a category.
• A rating — likelihood against consequence, both before your controls (inherent) and after them (residual). The gap between those two numbers is the value your controls add.
• The controls — what you already do that reduces it, and the evidence that you do it. This is the part auditors ask about and the part most registers skip.
• An owner and a review date — a risk nobody owns is a risk nobody manages.

Why the spreadsheet falls over

Spreadsheets are good at holding rows. They’re poor at the things that make a register trustworthy: version history, who changed what and when, whether a control is still in place, and whether the list still reflects the business you run today rather than the one you ran when you filled it in.

The failure is rarely dramatic. Nobody deletes the file. It just quietly stops being true — a supplier changes, a system is replaced, someone leaves, a regulation commences — and nothing in the spreadsheet notices.

Where do the risks even come from?

This is the question that stops most people, and it’s a fair one. Starting from a blank page means you list the risks you can already think of — which are, almost by definition, the ones you’re already managing. The risks that hurt are the ones you haven’t thought of.

A downloaded template doesn’t solve it either, because it wasn’t written for your industry, your size or the way you operate. A construction business subcontracting most of its labour and a professional services firm holding client data are exposed to genuinely different things, and a generic list flatters both while helping neither.

The honest answer is that your exposure is a function of what you do, where you do it, how big you are and who you do it for — so that’s where the list should come from.

This article is general information about risk management practice in Australia. It isn’t legal, financial or compliance advice — RiskCompass’s output is advisory and is a starting point for your own judgement, not a substitute for it.