Enterprise risk register practice pack

Illustrative example. The business, its supplier and every figure are fictional and were written by LSBUK for practice. This register is not compliance assurance and does not show how any regulator or standard would assess a real organisation.

The worked risk

A small online retailer buys all its packaging from one supplier. If that supplier fails, orders stop.

Field	Example
Cause	All packaging is bought from one supplier with no agreed alternative
Event	The supplier cannot deliver for two weeks or more
Business effect	Online orders cannot be fulfilled; refunds and lost repeat customers
Owner	Operations manager
Current controls	Two weeks of packaging stock, checked monthly
Treatment	Reduce: qualify and test a second supplier with one trial order
Review trigger	Quarterly, or immediately if the supplier misses a delivery

Why cause, event and effect are separate. "Supplier problems" is not a risk anyone can act on. Splitting it shows where controls can work: you cannot stop a supplier failing, but you can shorten the disruption and limit the effect.

Scoring with defined scales

Score	Likelihood (example definition)	Impact (example definition)
1	Less than once in 10 years	Under £1,000, or under a day's disruption
3	About once in 3 years	£10,000 to £50,000, or about two weeks
5	More than once a year	Over £50,000, or over a month

Before treatment the team scored this risk likelihood 3, impact 4, giving 12. After a tested second supplier, impact falls to 2, giving 6. These are ordinal scores that organise discussion and ranking. A 12 is not "twice as risky" as a 6, and neither number is a probability or a financial loss estimate. Record the reasoning in words alongside the score.

Keeping the register alive

A register is only useful if someone reviews it. Give each risk a named owner, a due date for every action and a trigger that forces a review, then report the significant risks to leadership in a consistent format.

Field guide