A small organisation needs a compact, practical register that supports decisions instead of becoming another spreadsheet nobody opens. In this article I will outline a simple structure that will work for you.
1. What a risk register is supposed to achieve
A risk register is not a paperwork exercise. Its purpose is to:
- Record the main things that can seriously disrupt your organisation.
- Describe how likely they are and how much damage they would cause.
- Show what you are doing about them and who is responsible.
2. The minimum fields you need
A compact register for a small organisation can work with the following columns:
- Risk ID – a simple reference such as R1, R2, R3.
- Description – clear and non technical, for example “Loss of access to email for more than one day”.
- Asset or process affected – such as email, customer database, payroll system.
- Likelihood rating – low, medium, high.
- Impact rating – low, medium, high.
- Current controls – what you already have in place.
- Planned actions – improvements you intend to make.
- Owner – the person responsible for managing that risk.
- Review date – when you will look at it again.
3. Identifying your top risks
Start by asking three straightforward questions:
- What would seriously disrupt our ability to serve customers.
- What would cause major financial loss or regulatory trouble.
- What would damage our reputation with customers or partners.
Capture the answers in plain language. You can translate them into more formal wording later if needed.
4. Scoring without overcomplicating
You do not need a complex scoring model. A simple approach:
- Likelihood: low, medium, high.
- Impact: low, medium, high.
Combine them into a simple priority:
- High impact and medium or high likelihood – priority one.
- Medium impact and medium or high likelihood – priority two.
- Low impact or low likelihood – monitor and revisit later.
5. Linking the register to real actions
A risk register only has value if it leads to action. For each priority risk, record one or two specific improvements, not vague intentions. For example:
- “Implement MFA for all admin accounts on email and VPN.”
- “Introduce daily server backups with an offsite copy.”
- “Formalise joiner and leaver access processes.”
6. Keeping the register alive
Schedule a short review every quarter. In that review:
- Close out actions that are complete.
- Adjust likelihood or impact if your environment has changed.
- Add any new risks that have emerged.
From paperwork to practical risk management
A small organisation does not need a large risk framework. It needs a short list of serious risks, clear ownership, and visible progress. As part of the Baseline Security Sprint, a compact register is created and linked to technical and procedural changes, so that risk is managed systematically.
Next step: if you want a working risk register tied directly to concrete security improvements, a short discovery discussion can help you decide whether the Sprint format is a suitable way to establish it.