A practical starting point for organising the records, responsibilities and review processes that help a New Zealand small business stay on top of quality and compliance.
Use this as a gap-check. Mark what you already have, identify what is missing, then assign an owner and review date.
If you have very little compliance structure today, don't create dozens of documents at once. Start with records that help you see what is happening.
| Priority | Start with | Why it matters |
|---|---|---|
| 1 | Risk Register | Shows risks, controls, owners and actions in one place. |
| 2 | Incident Register | Creates a reliable record of events and repeated issues. |
| 3 | Corrective Action Register | Stops actions disappearing after an incident, complaint or review. |
| 4 | Training Register | Helps show who is trained and what may be due or expired. |
| 5 | Monthly review | Turns separate records into a working management system. |
Use the free spreadsheet to record risks, controls, owners and review dates — without expensive compliance software.
The exact records depend on your industry and activities. Common areas include health and safety risk controls, incidents, employment records, privacy practices, training evidence, corrective actions and business-specific licences or certifications.
A document specifically called a risk register is not the only way to manage risk. A risk register is a practical way to record risks, controls, actions and review dates.
The Office of the Privacy Commissioner states that every New Zealand business or organisation needs a privacy officer.
Disclaimer: This checklist is general information, not legal advice. Requirements vary by business activity, industry, workforce and contractual obligations.