Here’s a number worth sitting with: 74% of Australian small businesses have never completed a formal risk analysis. That’s three in four businesses operating without any structured view of what could go wrong — and what they’d do about it.
A business risk register doesn’t fix everything. But it’s the foundation every other risk management activity depends on. Without one, you’re making decisions in the dark: allocating budget, hiring people, taking on contracts, all without a shared picture of the risks involved.
This guide walks you through exactly how to build a business risk register from scratch — the columns you need, the scoring approach that works, and real examples relevant to Australian industries. If you want to skip the spreadsheet altogether, we’ll show you how Lahebo makes the whole process simpler.
What Goes Into a Business Risk Register?
Before you start building, you need to know what you’re building. A risk register is only as useful as the information inside it — too sparse and it’s decorative, too complex and nobody updates it.
A best-practice business risk register, aligned to ISO 31000 (the Australian and international standard for risk management), typically captures seven core fields for each risk:
1. Risk ID and description — a unique identifier and a plain-language description of what could go wrong. “IT system failure during payroll processing” is useful. “Technology risk” is not.
2. Risk category — the type of risk: operational, financial, compliance, strategic, WHS, reputational, cyber, and so on. Categories make it easier to filter and report by risk type.
3. Likelihood score — how probable is this risk occurring? Use a consistent scale, typically 1–5, where 1 = rare and 5 = almost certain.
4. Consequence score — how severe would the impact be if it did occur? Again, 1–5: 1 = negligible, 5 = catastrophic.
5. Risk rating — calculated by multiplying likelihood × consequence, giving you a score from 1 to 25. This lets you prioritise without gut feeling.
6. Controls and treatment — what’s already in place to manage this risk, and what additional actions are needed? This is the section most basic templates leave out — and it’s where the real value lives.
7. Risk owner — the named person accountable for monitoring and managing this risk. Without ownership, risks get logged and forgotten.
Some registers add columns for residual risk (the remaining risk after controls), review dates, and links to related incidents or actions. If you’re just getting started, the seven fields above are enough.
How to Build a Business Risk Register: Step-by-Step
Here’s how to go from blank page to a working register your organisation will actually use.
Step 1: Define Your Risk Categories
Start by agreeing on the categories you’ll use to group risks. Get this right early — retrofitting categories onto a 200-row register is painful.
For most Australian businesses, a workable starting set includes: Strategic, Operational, Financial, Compliance & Legal, Workplace Health & Safety (WHS), Cyber & IT, Reputational, and Environmental. Adjust based on your industry. A construction company will weight WHS and environmental risks heavily; a financial services firm will have more compliance and credit risk categories.
Step 2: Identify Your Risks
Risk identification is the most important step — and the one that benefits most from breadth. Don’t do this alone.
Run structured workshops with department heads. Review past incidents, near misses, and audit findings. Walk through your core business processes and ask: what could disrupt this? Consider external factors too: regulatory changes, supply chain vulnerabilities, economic shifts, and key person dependencies.
For Australian businesses, there are some consistently overlooked risk areas worth pushing on:
- Psychosocial hazards — now a formal WHS compliance area following Safe Work Australia guidance
- Regulatory change — APRA, ASIC, state WHS regulators, and the Privacy Act 1988 all evolve; your register should capture the risks of non-compliance
- Key person dependency — what happens if your one person who knows the ERP system leaves tomorrow?
A first risk identification session typically surfaces 30–60 risks for an SME, more for larger organisations. Don’t try to filter too aggressively at this stage — capture everything and prioritise in Step 3.
Step 3: Score Each Risk
Once you have your list, rate each risk using your likelihood and consequence scales. Be consistent — use your definitions, not your gut.
The 5×5 matrix is standard practice in Australia, aligned to ISO 31000 principles and to WHS risk assessment methodologies. Your risk rating (L × C) then tells you where to focus:
- 20–25 — Critical: requires immediate treatment; escalate to executive/board
- 12–19 — High: treatment required in the short term; assign owner and deadline
- 6–11 — Medium: monitor actively; review in next cycle
- 1–5 — Low: accept, document, and review periodically
One important note: don’t get too precise. The value of risk scoring is relative prioritisation, not false precision. A risk scored 12 is not meaningfully “safer” than one scored 15 — but a critical risk (20+) demands different treatment than a low one.
Step 4: Assign an Owner to Every Risk
This is the step that separates a real risk program from a document that sits in a folder.
Every risk in your register needs a named owner — not “management” or “the team”, but a specific person. The risk owner is responsible for monitoring the risk, implementing treatment actions, and reporting status at review cycles.
In practice, operational risks usually sit with department managers. Financial risks with the CFO. Compliance risks with the legal or compliance function. WHS risks with the safety officer or site manager.
Step 5: Document Controls and Treatment Plans
For each risk, record:
- Existing controls — what’s already in place (e.g. “quarterly financial review”, “cybersecurity training onboarding”, “documented emergency procedures”)
- Treatment action — what additional steps are needed, with a due date and responsible person
- Residual risk — the re-scored risk rating after controls are in place (this is what your board or auditors actually want to see)
Here’s the thing many businesses miss: a long list of risks with “to be assessed” in the controls column isn’t a risk register — it’s a risk list. The controls and treatment section is where accountability lives.
Step 6: Set Review Cycles
A risk register that isn’t reviewed is just a snapshot of a moment in time. The risks that hurt organisations are often the ones that weren’t on last year’s register.
Build in review triggers:
- Quarterly for high and critical risks as a minimum
- Annually for a full register review — add new risks, close out managed ones
- Event-driven — after an incident, near miss, major project, or significant regulatory change
Under the Work Health and Safety Act 2011, WHS risk assessments must be reviewed when there is reason to believe a control is no longer effective, when work changes, or after an incident. Building this into your review cycle keeps you compliant.
Step 7: Choose Your Format — Spreadsheet or Software
For very small businesses just starting out, a well-structured spreadsheet is a legitimate starting point. The template in the next section gives you the format.
But be honest about the limitations: spreadsheets have no audit trail, no automated review reminders, no accountability workflows, and no real-time visibility for leadership. When your register grows beyond 30–40 risks — or when you’re answering to a board, auditors, or regulators — a dedicated risk register tool pays for itself quickly.
Free Business Risk Register Template: The Columns You Need
If you’re building in a spreadsheet, here’s the exact format to use. These columns give you a functional, ISO 31000-aligned register without unnecessary complexity.
| Column | Field | Notes |
|---|---|---|
| A | Risk ID | Sequential: R001, R002 etc. |
| B | Risk Description | Plain-language: “what could go wrong” |
| C | Risk Category | Operational / Financial / WHS / Compliance / Cyber / Strategic |
| D | Likelihood (1–5) | 1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain |
| E | Consequence (1–5) | 1=Negligible, 2=Minor, 3=Moderate, 4=Major, 5=Catastrophic |
| F | Risk Rating (D×E) | Formula: =D×E |
| G | Risk Level | Critical/High/Medium/Low based on rating |
| H | Existing Controls | What’s already in place |
| I | Treatment Action | What needs to happen, by when, by whom |
| J | Residual Likelihood | Re-score after controls |
| K | Residual Consequence | Re-score after controls |
| L | Residual Risk Rating | =J×K |
| M | Risk Owner | Named person, not a team or role |
| N | Review Date | When this risk is next reviewed |
| O | Status | Active / Treated / Accepted / Closed |
This gives you 15 columns — enough structure to be meaningful, tight enough to stay manageable.
Business Risk Register Examples: Australian Industries
Here’s how the same register structure looks applied to three different Australian contexts.
Construction and Infrastructure
A Tier 2 construction company might include risks like:
- WHS: Working at heights — Likelihood 3, Consequence 5, Rating 15 (High). Controls: SWMS in place, daily toolbox talks, harness inspection log. Treatment: Upgrade inspection frequency to weekly during Q2 peak period. Owner: Site Manager.
- Compliance: Environmental licence conditions — Likelihood 2, Consequence 4, Rating 8 (Medium). Controls: Environmental management plan, fortnightly site audit. Owner: Project Director.
Healthcare and Aged Care
A healthcare provider faces a different risk profile:
- Compliance: Privacy Act 1988 — patient data breach — Likelihood 2, Consequence 5, Rating 10 (Medium-High). Controls: Encrypted patient management system, staff NDA, access logging. Treatment: Conduct annual penetration test. Owner: IT Manager.
- Operational: Key clinical staff turnover — Likelihood 4, Consequence 4, Rating 16 (High). Controls: Competitive salary review, succession planning. Owner: HR Manager.
Financial Services
An APRA-regulated financial services firm would include:
- Compliance: APRA CPS 230 operational resilience — Likelihood 2, Consequence 5, Rating 10. Controls: Business continuity plan, annual DR test. Treatment: Complete CPS 230 gap analysis by Q3. Owner: Head of Risk.
- Financial: Interest rate exposure on fixed-rate book — Likelihood 3, Consequence 3, Rating 9. Owner: CFO.
The risks change; the structure doesn’t. That consistency is what makes a register useful across a complex organisation.
The Most Common Business Risk Register Mistakes
Honestly, the most expensive risk register mistakes aren’t in the scoring — they’re in how the register is managed after it’s built.
Not assigning real owners. “The risk team” does not own a risk. A named person does.
Treating the register as a one-off deliverable. Risk registers that aren’t reviewed become liabilities — a false sense of security backed by stale data.
Scoring risks without calibration. If your operations team scores everything a 2 and your IT team scores everything a 5, your risk ratings are meaningless. Calibrate your scales before you start.
Leaving controls blank. The most common gap in SME risk registers. If you haven’t documented what you’re actually doing about a risk, the register tells you nothing useful.
Frequently Asked Questions About Building a Business Risk Register
How long does it take to build a business risk register from scratch?
A first-pass risk register for an SME typically takes one to two days: a half-day identification workshop, time to score and categorise risks, and a review session with leadership. Using a template (or software with pre-built frameworks) cuts that significantly. Expect ongoing time investment for quarterly reviews and annual refreshes.
What’s the right number of risks in a business risk register?
There’s no magic number — it depends on your organisation’s size and complexity. A small business might have 20–40 risks; a mid-market organisation 80–150. The danger on both ends: too few risks (false comfort) or too many (the register becomes unmanageable and stops being updated). Focus on quality over quantity.
Does a business risk register need to follow ISO 31000?
Not legally — ISO 31000 is a guidelines standard, not a mandatory compliance requirement in Australia. But it’s the recognised best-practice framework, and most regulators (APRA, ASIC, Safe Work Australia) expect risk management approaches consistent with its principles. Structuring your register around ISO 31000 also makes it easier to demonstrate due diligence if questions arise.
What’s the difference between a risk register and a risk matrix?
A risk register is the full record of all identified risks — with descriptions, owners, controls, and treatment plans. A risk matrix (heat map) is a visual tool that maps risks by likelihood and consequence. They work together: the matrix gives you the big picture; the register gives you the detail. You need both.
When should a business risk register be reviewed?
As a minimum: quarterly for high and critical risks, and annually for a full register review. Additionally, review after any significant incident, near miss, major project start or completion, or regulatory change. The WHS Act 2011 requires WHS risk assessments to be reviewed when controls may no longer be effective.
Ready to Build Your Business Risk Register?
A risk register built in a spreadsheet will get you started. But if you want something that actually scales — with automated review reminders, accountability workflows, a live legislation library, and board-ready reporting — you need a purpose-built tool.
Lahebo is designed specifically for Australian organisations. The risk register module connects directly to incident management, corrective actions, and a real-time Australian legislation library — so your risk program stays current without manual effort.
Start your free trial today or book a demo to see how Lahebo handles your risk register from day one.
Related Articles in This Series
- Complete guide to risk registers — What Is a Risk Register? The Complete Guide for Australian Businesses
- Risk register vs risk matrix — Risk Register vs Risk Matrix