Business Risk Registers – What do they achieve?

Risk registers are a common document that may be forgotten in a businesses’  Workplace Health and Safety systems. These documents form an incredibly important part of the safety practices of any workplace. Having a risk register in place helps businesses to identify what aspects they cannot afford to lose, and how they plan to prevent the potential impacts on the business if a disaster occurs.

Why do I need a Risk Register?

Risk Registers are a great way to initially identify the varying risks that are present to the business. These varying risks can include, but are not limited to:

• Loss of IT systems or Cyber Attack
• Mass exit of Workforce (People)
• Workplace Incidents and Claims
• Insurance
• Loss of Income
• Building and Fire
• Environmental Impacts – Bushfire, Flooding, Storms, Hail etc.
• Motor Vehicle Incidents
• Power Outages
• Pandemic

They can help the board, General Manager, Business Owner, etc. identify the kinds of risks that they need to plan for and implement steps to take in various situations.

Key Considerations

There are 4 aspects that needs to be considered:

Business resilience – this is the overarching principle and will help your business identify its ability to adapt and respond to any business disruptions.

Business preparedness and prevention – This is possibly the most important, yet quite often most overlooked step as this is where a business identifies the risks that are present and create a plan of action to implement should a risk occur.

Business response and continuity – this stage of the business resilience cycle is the point where a disaster has occurred and your business preparedness and prevention plans and actions are about to be implemented.

Business resumption and recovery – This focuses on restoring and recovering all business operations and processes back to normal as soon as possible after a disaster. doing this involves getting your business back to business as usual.

Impacts to a business can be either direct or indirect. A common direct impact to a business is a breach of data protection by cyberattack. Indirect impacts can be increment weather restricting your business from providing services to your clients/customers.

Considering Impact When Assessing Risk

People

People are one of the most important aspects of a businesses operations. If they choose to leave collectively, this can severely impact the businesses operational capacity.

As a business owner you need to consider the roles and responsibilities that are vital to your daily operations. You also need to consider the availability of people for these roles and responsibilities should a worker leave. You need to ask yourself, how easily can this staff member be replaced with another.

Another thing you need to consider is the emotional impact that these resignations or staff departures can have on the remaining team members in the business, and how you intend to provide support through this time.

Finally, you as the business owner needs to consider what might your people need for their own home situations should a disaster occur. This can potentially be harder to manage as some staff members may have the capacity to complete works from home, such as the Accounts team, whilst staff such as Builders wont. 

Process

Business processes always work well until they don’t. Disasters or crisis events are a great way, (but also the worst way) to identify gaps in your processes. It is important to reflect on your current processes and way of operating to identify what might need to change following a disaster or crisis event occurring and create a plan. It is important that when planning for these situations they are documented, and the relevant staff members informed. This communication includes highlighting what changes might need to be made, how internal and external communication may look, the location of these documented plans, and those aware of these plans.

Provider

If your business depends on suppliers or contractors, business owners need to think how a disaster or crisis event will impact you, or others in the supply chain. The sorts of things that need to be considered include identifying the alternative sources you can use to supply services, whether you have an in-depth list of these alternative sources and contractors, and where is this list stored and can it be accessed away from your main place of work (e.g. OneDrive, Sharepoint, etc.). 

Premises

As a business owner you need to consider the potential consequences of not being able to access and use your usual premises in certain situations. These consequences not just impact your business operations, but also impact staff, customers, and suppliers. To ensure you have conducted sufficient planning business owners need to consider whether there are alternative buildings and facilities that can be used in an emergency. However, prevention is better than cure and so it is important to think about the potential risk minimization actions that can be implemented.

Profile

Some disasters can affect how people view your brand and reputation – for example, in the event of a data breach.

To mitigate this risk, think about how your brand, image and reputation in the marketplace might be affected after a disaster. Assessing the elements of your brand for where you need to protect and identify the best methods to do so. Your solution should prepare for a heightened awareness of your brand in a post-disaster situation,

Performance

Some disasters can have long-term effects on your business performance. A business should consider how long it would take to re-establish accepted benchmarking standards post-disaster. This may be best assessed through an evaluation audit of your post-disaster recovery processes to check on their relevance and/or effectiveness.

How to identify what the risk to the business is?

When creating a Risk Register and identifying the risks to a business, it is important to assess the impact it may have. To identify the impact there are two things that need to be considered: the likelihood of this risk in question occurring; and the potential consequences should this risk occur.

There is generally a Risk Matrix attached which assists to identify the seriousness of a risk and 

Questions to ask yourself:

• Do we have a person or team responsible for business resilience?
• Have we identified all natural and unnatural disasters that could interrupt our business?
• Have we identified the critical priorities for our business and what could stop us trading?
• Have we identified how our business will continue to provide products or services during and after disasters?
• Do we have up-to-date procedures that include emergency contact lists for future disasters?
• Have we protected our important business plans, documents and information and made them accessible when we can’t access the premises?

Seeking Advice On Assessing Risk In Your Business?

Call Bramwell Partners on 07 3630 5695 (Brisbane) or 07 4849 5517 (Central Queensland) to get in touch with our WHSE Consultants. With decades of experience across various industries, our consultants can advise on risks specific to your business and provide practical solutions.