How to Build a Risk Register for Your Scheme

A risk register is a critical governance tool that documents all identified risks to your scheme, their likelihood and impact, and the mitigation strategies in place. It's required by best practice governance standards and is often requested by CSOS during investigations. Building and maintaining an effective risk register is one of the most important steps you can take to reduce trustee liability.

Step 1: Identify Risks

Start by brainstorming all potential risks to your scheme. Common categories include:

• Financial risks (cash flow, budget overruns, fraud)
• Operational risks (maintenance failures, service provider issues)
• Governance risks (non-compliance, poor decision-making)
• Legal risks (disputes, liability claims)
• Reputational risks (resident dissatisfaction, media coverage)

Step 2: Assess Likelihood and Impact

For each identified risk, assess its likelihood (Low/Medium/High) and potential impact (Low/Medium/High). This creates a risk matrix that helps prioritize mitigation efforts. High-likelihood, high-impact risks require immediate attention.

Step 3: Define Mitigation Strategies

For each risk, identify specific actions to reduce its likelihood or impact. Assign responsibility for each mitigation action and set timelines for completion.

Step 4: Document and Review

Create a formal risk register document (spreadsheet or dedicated software) and review it at every board meeting. Update the register as risks change, new risks emerge, or mitigation actions are completed.