Setting up a risk and opportunity register and keeping it alive

What goes into the register?

The register is a working document with all the risks and opportunities that matter for your management system and business goals: delivering to customers, meeting requirements, working safely and with care for the environment. A risk is an uncertain event with an adverse effect, an opportunity is an uncertain event with a beneficial effect. It is therefore about what can still happen, not about what has already gone wrong.

Opportunities are often forgotten. A new market, smarter planning or digitalization that prevents errors belongs there just as much. The same pattern applies to both: describe, rate, choose an owner and decide what to do with it. For an opportunity the choice is simply reversed: you want to exploit it rather than prevent it.

The difference from the RI&E

The RI&E (risk inventory and evaluation) is in principle mandatory for employers in the Netherlands and identifies hazards to the safety and health of employees, with an action plan. The risk register looks wider: at business risks around quality, delivery, customers, suppliers and continuity. The two overlap where safety becomes a business risk, but they are separate instruments. Check the current RI&E obligation with the Netherlands Labour Authority (Nederlandse Arbeidsinspectie).

Setup: the columns

Start with a simple table in a spreadsheet or in your management system. More columns do not make the register better, only heavier to maintain. Whoever fills it in should be able to do so within a few minutes per entry, otherwise the work stays on the shelf. A workable basis consists of these elements:

• Process or topic the risk or opportunity belongs to
• Description: what can happen and what is the consequence?
• Likelihood and impact, each with a score
• Risk score and level (low, medium or high)
• Measure or choice: avoid, reduce, transfer, accept or, for an opportunity, exploit
• Owner and date of the next review
• Residual risk after measures and status

Rating scale: likelihood times impact

The most common method gives likelihood and impact each a score from 1 to 5 and multiplies them. What matters is the proportion within your organization, not the exact numbers. Write a recognizable description for each level: for impact, for example, what happens financially, to the customer or to safety.

Agree on the thresholds: from which score is a measure mandatory and when does management decide? Keep the scale the same across the whole organization. Then risks from different departments are comparable and you can see at the management review where the pressure is greatest.

For opportunities the same setup works mirrored: how likely is the benefit and how large is it? You then use the score not to decide whether to prevent something, but whether an opportunity is worth the effort of a pilot or investment.

Owners and measures

Every risk and every opportunity has one owner: a person who is responsible, not a department. That person decides on the measure, monitors the residual risk and reports when something changes. Choose someone with influence over the process, such as a team leader or department head. Without an owner the register belongs to nobody.

A measure is a concrete action or an ongoing control. Carry actions over to your action follow-up with a deadline, so they do not just sit in the register. After implementation, rate again: has the risk really dropped, or have you merely ticked something off?

Example entries

A good entry is written so that a colleague understands it without explanation: what can happen, what is then the consequence and what do we do about it. Avoid general terms such as "quality risk" or "staffing problems"; they say nothing about the cause and do not lead to a measure. Four fictional entries make it concrete. The scores are illustrative and depend on your own scale:

• A supplier of a critical part fails: lead times grow and a customer walks away. Likelihood 3, impact 4, score 12. Measure: qualify a second supplier. Owner: purchasing.
• New employees work with an outdated instruction: errors and complaints. Likelihood 4, impact 2, score 8. Measure: revise instructions and test during onboarding. Owner: team leader.
• A deviation in the disposal of waste goes unnoticed: a violation and reputational damage. Likelihood 2, impact 4, score 8. Measure: periodic check. Owner: environmental coordinator.
• Opportunity: digital work instructions on the shop floor. Benefit: fewer errors and faster onboarding. Choice: pilot with one team. Owner: operations manager.

Evaluating: when do you look again?

Plan a fixed review round, for example every quarter for the high risks and annually for the rest. In addition there is reason for reassessment after an incident, a complaint, an audit finding, a change in process or machine, or new legislation. Any of those signals can change a score unexpectedly.

Take the most important risks to the management review, with the trend: is the level rising or falling? Close risks that have disappeared with a short explanation. That keeps the list small and current, and lets management see whether measures work and where extra resources are needed.

How to prevent a dead list

A register you fill once before certification dies quickly. The cause is almost always the same: it is detached from the work. Nobody opens it because it yields nothing, and because nobody opens it, it is not updated. This breaks the circle and keeps the register alive:

• Link every risk to a process that someone steers daily
• Keep it short: better fifteen risks that live than a hundred nobody reads
• Let risks come from real signals: incidents, complaints, audits and changes
• Discuss the top of the register in a fixed meeting
• Carry actions over to follow-up and look back at whether they had effect
• Remove what is outdated

How BrydgeOne supports this

In BrydgeOne you assess risks and opportunities per process in the Risks & opportunities module. Follow-up runs through Actions. If you want to analyze a process step in more depth, Process FMEA covers failure modes per process step, and you take the outcomes to the Management review.