Compliance Risk Register: How to Track Risks in a Simple Excel Sheet

Most small companies do not have a risk register. They have a worry list in somebody’s head, which is updated whenever something goes wrong.

A register is simply that list, written down, scored, and reviewed on a schedule. It does not need risk-management software. A single Excel sheet with the right columns will do more than a complicated tool nobody opens.

This describes a practical management tool, not a legal compliance programme. Applicable legal requirements differ by organisation and sector, so verify current obligations and take qualified advice where needed.

What the register is for

Three uses, in order of importance:

1. Making risk visible so decisions are not made by whoever is loudest in the meeting.
2. Driving action through owners and dates rather than good intentions.
3. Providing evidence that risks were identified and managed — which is exactly what auditors, clients, and certification bodies ask to see.

The columns that matter

I keep eleven columns. More than that and the sheet stops being maintained.

Column	What goes in it	Example
ID	A stable reference	C-014
Risk area	Category	HR documentation
Risk description	The thing that could happen, written plainly	Contracts missing for new joiners
Cause	Why it could happen	Joining checklist not used by branch office
Impact	What it would affect	Labour dispute, audit finding, penalty
Likelihood	1 (rare) to 5 (almost certain)	3
Impact score	1 (minor) to 5 (severe)	4
Rating	Likelihood × impact	12 — high
Control in place	What already reduces it	Head office checklist exists
Action required	The specific next step	Roll out checklist to branch; verify monthly
Owner and due date	One name, one date	HR Officer, 30 November

Two extra columns are useful once the register is running: status (open, in progress, closed) and last reviewed date.

Scoring without overthinking it

Use a simple 1–5 scale for likelihood and impact, multiply, and apply bands:

• 1–6: low — monitor.
• 8–12: medium — plan action.
• 15–25: high — act now, and report upward.

The exact numbers matter far less than using the same scale every time. A risk register that re-scores risks differently each month cannot show trends, and trends are where the insight is.

Populate it in one afternoon

Gather the people who actually know the work — HR, accounts, admin, safety, and one supervisor from operations. Then ask four questions per area:

1. What must this company have, by law, contract, or client requirement?
2. What would happen if it were missing?
3. What evidence would prove that it exists?
4. What could stop that evidence from existing?

Question four is where the real risks appear: staff turnover in HR, no backup for the filing system, contracts signed late because recruitment happens in a hurry, expatriate staff documents handled by a third party.

A first pass should produce 15–30 risks. Anything longer is usually a list of tasks rather than risks.

Starting risk examples for a Nepali service company

Area	Risk
Employment documentation	Signed contracts missing or undated for some employees
Payroll	Wages not updated after a statutory minimum-wage change
Statutory contributions	Provident fund or social security deposits delayed or unreconciled
Attendance and leave	Verbal leave approvals with no record
Safety	Firefighting equipment not inspected; no documented safety training
Contractors	Contractor workers engaged without agreements or documentation
Data protection	Personnel data in an open shared folder
Licences and renewals	Renewal date missed for a permit or registration
Overseas recruitment (if applicable)	Worker-paid costs not documented or refunded; licence conditions breached
Records	No backup; documents only in one physical location

Adapt this to your sector. The purpose is to name the risk precisely enough that someone can act on it.

The monthly review meeting

Thirty minutes, same people, same agenda:

1. New risks — anything that appeared this month.
2. Changed scores — risks that moved up or down, and why.
3. Overdue actions — owner explains the delay and the new date. Do not let overdue items quietly disappear.
4. Closed items — confirm the evidence of closure before closing them.
5. Top three risks — decide whether the management team needs to see them.

Keep minutes. Half a page is enough: date, attendees, decisions, new dates.

How to stop it becoming shelf-ware

The register dies when it stops being connected to work. Three practical ties:

• Connect it to the audit calendar. Every high risk gets a review date that matches when the evidence is checked anyway.
• Connect it to induction. New supervisors should see the risks relevant to their area in their first week.
• Connect it to the management report. If the top risks never reach the decision-makers, the register only records anxiety.

A useful discipline: evidence of closure

“It has been fixed” is not closure. Closure looks like: the missing contracts were signed, a copy of each is in the file, the checklist was updated, and the next monthly sample showed no gaps. Write that sentence in the register. Future auditors read that column first.

Keep it to one page per area

For each major area, a one-page summary of the top five risks, scores, owners, and dates makes a good management report. The full register stays as a working document; the one-page summary is what leadership reads.

Related reading

• How to Prepare for an Internal Audit: A Four-Week Plan
• How I Run a Basic HR Compliance Check in a Nepali Company
• Free 10-Point Compliance Audit Checklist