Free Risk Register Template for NZ Small Businesses
A practical way to identify, assess, assign and review business risks without introducing expensive risk-management software.
What is a risk register?
A risk register is a structured list of the risks that could affect your organisation, the controls already in place, and the actions required to keep those risks at an acceptable level.
For a small business, a risk register does not need to be complicated. The most useful registers make it easy to see what could go wrong, how serious the issue could be, who owns the risk and when it needs to be reviewed again.
Identify
Record the event, situation or uncertainty that could affect the business, customers, workers, services, finances or reputation.
Assess
Estimate likelihood and consequence so that important risks can be prioritised instead of treating every issue as equally urgent.
Manage
Record controls, assign actions to a responsible person and set realistic review dates.
What should a small business risk register include?
A useful risk register should contain enough information to support decisions without becoming difficult to maintain.
Risk description
A clear description of what could happen and why it matters.
Likelihood & consequence
A consistent way to estimate how likely the risk is and how significant the consequences could be.
Risk rating
A score or category that helps management prioritise attention and action.
Existing controls
The safeguards, procedures or practices already reducing the risk.
Actions & owner
Additional improvements, who is responsible, and when the work is due.
Review date
A date for checking whether the risk, controls or circumstances have changed.
Simple risk register example
The example below shows the type of information a small organisation might record. Your own risks and scoring method should reflect your business.
| Risk | Likelihood | Consequence | Rating | Action | Owner |
|---|---|---|---|---|---|
| Key supplier cannot deliver essential materials | Possible | Major | High | Identify secondary supplier and maintain minimum stock level | Operations Manager |
| Customer information sent to the wrong recipient | Unlikely | Major | Medium | Review access controls and introduce a pre-send verification step | Business Owner |
| Critical employee unavailable during peak workload | Possible | Moderate | Medium | Cross-train another worker and document essential procedures | Team Leader |
How does a 5×5 risk matrix work?
A 5×5 risk matrix combines a likelihood score with a consequence score. The result helps the business group risks into practical priority levels such as low, moderate, high or extreme.
The important part is consistency. Define what each likelihood and consequence level means for your organisation and use the same definitions when risks are reviewed.
Example likelihood scale
Rare → Unlikely → Possible → Likely → Almost Certain
Example consequence scale
Insignificant → Minor → Moderate → Major → Severe
A risk matrix is a decision-support tool. It should not replace professional, legal, technical or sector-specific advice where that is required.
When should you review your risk register?
A risk register should be treated as a working management tool rather than a document created once and forgotten.
Consider reviewing risks when:
- a new service, process, supplier or technology is introduced;
- an incident, complaint or significant near miss occurs;
- a control fails or an action becomes overdue;
- responsibilities or staffing change;
- external requirements or operating conditions change; or
- the scheduled review date is reached.
Download the free NZ Small Business Risk Register
Start with a practical Excel register designed to help small businesses document risks, score priorities, assign actions and keep review dates visible.
Get My Free Risk RegisterNeed more than a risk register?
Risk management works best when it connects with incidents, complaints, corrective actions, audits, training and management review.
The NZ Quality & Compliance Starter Pack brings those core registers together in one Excel-based toolkit for NZ small businesses.
What should you do after creating the register?
A useful register is not the finish line. Give each important risk an owner, record the controls and actions, and set a date to check whether those controls are still appropriate and working as intended.
1. Learn the process
Use the free HS-002 course to build a practical understanding of hazards, risks, controls and review.
Take free HS-002 training2. Put it into practice
Use the free register to assign owners, actions and review dates instead of leaving identified risks sitting on a list.
Get the free register3. Review and follow through
When a review identifies an issue, connect it to corrective action, training or another appropriate workplace process.
Browse free trainingWhen one register is no longer enough
If you are also tracking incidents, complaints, corrective actions, audits and training, the NZQC Quality & Compliance Starter Pack brings those records together in one connected toolkit.
See the NZ$79 Starter PackRisk register FAQs
What is a risk register?
A risk register is a structured record of identified risks, their likelihood and impact, the controls in place, responsible owners, actions and review dates.
Do small businesses need complicated risk software?
Not necessarily. Many small organisations can begin with a well-structured spreadsheet that is consistently maintained and regularly reviewed.
How often should risks be reviewed?
The review frequency should reflect the seriousness and rate of change of the risk. Higher or rapidly changing risks generally need closer monitoring.
Can I customise the free template?
Yes. The free template is intended as a practical starting point for adapting risk management to your own organisation.
This information is general guidance and does not constitute legal advice, certification, accreditation or a guarantee of compliance.