Risk & Compliance 101 · Beginner · All stages · 8 min read · Updated
Business risk management
A practical way to find the risks that could actually hurt your business, decide which ones deserve attention, and put simple controls in place without drowning in paperwork.
- Identify: List what could go wrong and stop you reaching your goals.
- Assess: Rate each risk by how likely it is and how much it would hurt.
- Treat: Avoid, reduce, transfer or accept each risk deliberately.
- Monitor: Watch the early warning signs and review the list regularly.
Every owner manages risk already. You chase late payers, back up your files, lock the shop and insure the van. What most small businesses lack is a way of seeing all those risks together, so that the effort goes to the things most likely to cause real damage rather than the things that happen to be on your mind this week.
Risk management sounds like a corporate discipline, but the version that works for a ten-person business fits on two pages. It is a short list of what could go wrong, an honest rating of how likely and how serious each item is, a decision about what you will do about it, and a habit of looking at the list every few months. This article explains how to build that list and keep it alive.
Why it matters
The businesses that fail suddenly rarely fail from a surprise. A lost major client, a key person leaving, a cyber incident or a cash squeeze were usually visible months earlier to anyone who was looking. A simple risk process gives you that look. It also matters commercially: banks, insurers, larger customers and government tenders increasingly ask how you manage risk, and a clear answer wins work and lowers premiums.
What a risk actually is
A risk is an uncertain event that would affect your ability to achieve your goals. That definition matters because it ties risk to what you are trying to do. A café with one location and a builder with twelve staff on three sites face very different risks, and a generic checklist will miss the ones that count for each of them.
It helps to think in categories so that nothing obvious is missed. Most small business risks fall into six groups: strategic (the market or a competitor moves), operational (a supplier, machine or process fails), financial (cash, debt, a bad debtor), compliance (tax, employment, licences, privacy), people (losing a key person, injury, misconduct) and technology (outage, data loss, cyber attack). Reputational damage usually arrives as a consequence of one of the others.
- Strategic: A competitor, a new technology or a change in demand makes your model weaker.
- Operational: A supplier, machine, site or process stops and so does delivery.
- Financial: Cash runs short, a debtor fails, rates or input costs jump.
- Compliance: A tax, employment, licensing or privacy obligation is missed.
- People: A key person leaves, is injured, or behaves badly.
- Technology: Systems go down, data is lost or stolen, accounts are compromised.
Rate risks by likelihood and impact
Once you have a list, the temptation is to treat everything. You cannot, and you should not. Rate each risk on two simple scales: how likely it is to happen in the next year or two, and how bad the consequences would be for cash, customers, people or reputation. A three-point scale (low, medium, high) is enough; precision beyond that is false comfort.
Plotting the results on a two-by-two grid makes the priorities obvious. Risks that are both likely and severe need action now. Unlikely but severe risks are usually what insurance and continuity plans are for. Likely but minor risks are best handled by routine procedures. Anything unlikely and minor can be accepted and reviewed later.
- Insure and plan: Rare but serious: fire, major injury, loss of a key site. Transfer with insurance and write a recovery plan.
- Act now: Likely and serious: reliance on one customer, no backups, cash gaps. Reduce the risk this quarter.
- Accept and review: Rare and minor: note it in the register and look again next review.
- Routine controls: Frequent but minor: late payers, small stock losses. Handle with standard procedures.
Choose a treatment for each risk
There are only four things you can do with a risk. You can avoid it by not doing the activity, for example declining a contract whose penalties could sink you. You can reduce it by adding a control: a second supplier, a backup, a checklist, a credit check. You can transfer it, typically through insurance or contract terms that move the liability to someone better placed to carry it. Or you can accept it knowingly, because the cost of treating it is more than the risk is worth.
Write the chosen treatment next to each risk and give it an owner and a date. An untreated risk with no owner is just a worry. The control does not need to be elaborate: for most small businesses the strongest controls are boring ones like separating duties around money, keeping a second quote on file, and testing the backup.
Make it a habit, not a project
The output of all this is a risk register: one row per risk, with its category, likelihood, impact, treatment, owner and the date you last looked at it. A spreadsheet is fine. What makes it work is the review rhythm. Put it on the agenda every quarter, and revisit it whenever something big changes: a new product, a large client, a new site, a change in the law or a near miss.
Pair the register with a handful of early warning indicators you already see in your numbers: debtor days creeping up, one customer passing a third of revenue, staff turnover, overdue maintenance. When an indicator moves, the related risk gets a second look. That link between the register and the dashboard is what turns risk management from an annual chore into a steering tool.
- One register, one owner, reviewed at least quarterly.
- Each risk has a rating, a treatment, an owner and a next review date.
- Near misses are recorded and discussed, not buried.
- The register is shown to your accountant, broker and bank when they ask how you manage risk.
How to build a risk register in an afternoon
- Write down your top three goals Risk only means something relative to what you are trying to achieve this year.
- Brainstorm what could stop you Walk through the six categories with whoever knows the business. Aim for 15–25 risks, not 100.
- Rate likelihood and impact Low, medium or high on each. Argue about the top ten, not the bottom ten.
- Pick a treatment for each Avoid, reduce, transfer or accept. Be explicit when you choose to accept.
- Assign an owner and a date One name per risk and a date by which the control will be in place.
- Choose three early warning indicators Numbers you already track that would move before the risk crystallises.
- Book the next review A quarterly calendar entry is the difference between a living register and a forgotten file.
Real-world example
A Sunshine Coast landscaper looks at what could go wrong
Greenline Landscapes has eight staff, two crews and a single excavator that most jobs depend on. The owner, Marcus, has never written a risk register but spends a Friday afternoon doing one with his site supervisor. They list 19 risks. Three stand out as likely and severe: the excavator failing mid-project, one developer client accounting for almost half of revenue, and no documented safety procedures for a crew that works around trenches and machinery.
The treatments are modest. He books a maintenance contract and gets a hire company on standby for the excavator, starts quoting for two new builders to dilute the client concentration, and uses a template from his state WHS regulator to write site safety procedures, which also helps when the developer’s compliance officer asks for them. The register goes into a shared spreadsheet, and debtor days and the share of revenue from the top client become two of the four numbers he looks at each month.
Common mistakes
- Listing hazards instead of risks "Cyber" is a category, not a risk. "Our shared mailbox is compromised and a supplier invoice is redirected" is a risk you can rate and treat.
- Trying to treat everything Spreading effort across fifty risks means nothing gets done properly. Fix the top five first.
- Confusing insurance with risk management Insurance pays for some losses after they happen. It does not stop the loss, cover every policy exclusion or protect your reputation.
- Ignoring the risks you created Taking on a single large client, signing a long lease or hiring fast all introduce new risks. Update the register when you make big decisions.
- Writing it once and filing it A register that is not reviewed is out of date within six months and gives false comfort.
KPIs to track
- Top-quadrant risks with a control in place The share of likely-and-severe risks that have a working treatment. Aim for all of them.
- Overdue risk actions Treatments that have passed their due date. Should be zero at each quarterly review.
- Revenue from the largest customer A concentration indicator. Above about a third of revenue, start treating it as a risk.
- Near misses recorded A rising count is often healthy: it means people are reporting and you are learning before a loss.
- Days since last register review A simple discipline check. More than about 100 days means the habit has slipped.
Frequently asked questions
Is a risk register a legal requirement?
Not in general, although WHS laws in every state require you to identify and manage hazards to workers, and some licences, tenders and insurers require evidence of a risk process. Even where it is optional, the register is the simplest way to show you take those duties seriously.
How many risks should be on the list?
Enough to cover the six categories without padding. Most small businesses land between 15 and 30. If you have more than 40, you are probably listing tasks or hazards rather than risks.
Who should own the register?
The owner or general manager owns the register; individual risks are owned by whoever controls the relevant part of the business. Ownership means being accountable for the treatment, not doing all the work personally.
What is the difference between a risk and an issue?
A risk might happen; an issue has happened. When a risk crystallises it moves to your issues or incident list, and the register should be updated with what you learned.
Key takeaways
- Risk management is a short list and a review habit, not a thick document.
- Rate every risk on likelihood and impact and work on the top-right quadrant first.
- Every risk gets one of four treatments and one named owner.
- Link the register to a few numbers you already watch so it warns you early.
- Update it whenever a big decision changes what could go wrong.
This article is general information only, not financial, legal or tax advice.