It is week three of a new project. A key subcontractor has gone quiet, a batch of workers is still waiting for medicals, and the client has just issued a variation that eats into your margin.
None of it is a surprise. Someone on your team saw each of these coming. The trouble is that nobody wrote them down, nobody owned them, and nobody acted until they turned into costs.
That is exactly what a risk register fixes. It is one of the simplest management tools you can build, and one of the most useful. This guide shows you how to build one for a UAE business in an afternoon, and how to keep it alive without turning it into paperwork.
What a risk register is, and what it is not
A risk register is a single list of the things that could stop your business hitting its goals, with a score, an owner and a plan for each one. That is the whole idea. It can live in a spreadsheet. You do not need software, a consultant or a 40-page policy to start.
It is not a list of everything that could ever go wrong. It is not a compliance document you file once a year and forget. And it is not a blame list. The best registers are short, honest and opened often.
Why UAE businesses need one now
Many owners run risk in their heads, and for a while that works. Then the business grows, and the risks spread across managers, projects and sites that one person cannot watch. A few things make this more pressing in the UAE today:
- Tighter project terms. Delay penalties, variations and subcontractor failures can wipe out the margin on a contract.
- More regulation to track. The UAE Labour Law (Federal Decree-Law No. 33 of 2021), WPS salary payments, Emiratisation obligations and corporate tax, which applies to financial years starting on or after 1 June 2023, all carry real penalties when they slip.
- Clients and lenders ask. Pre-qualification questionnaires, due diligence and bank reviews often want to know how you identify and manage risk.
If a risk lives only in someone's head, it leaves the company when they do.
The nine columns your register needs
Keep it to these nine columns. Each one earns its place.
| Column | What goes in it | Example |
|---|---|---|
| ID | A short reference | R-04 |
| Risk | Cause and effect in one sentence | If our main steel supplier misses deliveries, the tower project slips and delay penalties apply |
| Category | Project, people, financial, compliance, operational or reputation | Project |
| Likelihood | 1 to 5: how likely in the next 12 months | 3 |
| Impact | 1 to 5: how bad if it happens | 5 |
| Score | Likelihood multiplied by impact | 15 |
| Owner | One named person, not a department | Procurement Manager |
| Action and due date | What you will do, and by when | Qualify a second supplier by 30 June |
| Status | Open, in progress or closed | In progress |
A tip that changes everything: write every risk as "If this happens, then that follows." It forces you to name the cause and the consequence. "Supplier risk" tells you nothing. "If our only cable supplier misses a delivery, the fit-out stops" tells you exactly what to protect.
How to build it in six steps
Step 1: Get the right people in a room
Book 60 to 90 minutes with the people who see risk first: the owner or general manager, finance, operations, HR and your lead project manager. Ask one question: "What could stop us hitting our targets this year?" Write everything down. No debate yet.
Step 2: Turn the list into clear risk statements
Merge the duplicates and rewrite each item as an "If... then..." statement. Then separate risks from issues. Anything already happening is an issue: move it to an action list and fix it now. The register is for what might happen.
Step 3: Score each risk
Rate likelihood and impact from 1 to 5, then multiply them. Agree what the numbers mean before you start, or every manager will score differently.
| Score | Likelihood (next 12 months) | Impact |
|---|---|---|
| 1 | Rare: hard to imagine it happening | Minor: absorbed in normal work |
| 2 | Unlikely | Noticeable: small cost or delay |
| 3 | Possible: could happen this year | Serious: hits a project margin or a key client |
| 4 | Likely | Major: hits annual profit, a licence or a big contract |
| 5 | Almost certain | Severe: threatens the business or its reputation |
Then band the results: 15 to 25 is high, 8 to 12 is medium and 1 to 6 is low. High risks get attention this month. Low risks get a glance each quarter.
Step 4: Give every risk one owner
Not "Finance". Not "Management". One person with the authority to act. When everyone owns a risk, nobody does.
Step 5: Decide what to do about it
For each risk, choose one of four responses:
- Reduce it: add a control, a backup supplier or a second trained person.
- Transfer it: through insurance or contract terms.
- Avoid it: walk away from the activity, such as a contract with terms you cannot meet.
- Accept it: a conscious decision, recorded, for risks that cost more to fix than to carry.
Every response needs an action and a date. A risk with no date is a wish.
Step 6: Set the review rhythm
Put high risks on the agenda of your monthly management meeting. Review the full register every quarter, and share the top ten with the owner or board. Add a few key risk indicators, the early warning signs that a risk is growing. For example: days of supplier delay, workers waiting for documents, or weeks of cash cover.
Want a second pair of eyes? Our risk management consultants can run the first workshop with your team and leave you with a working register. Book a consultation.
A worked example
Here is what the top of a register might look like for a mid-sized MEP contractor in Dubai. The company and figures are illustrative, but the risks will feel familiar.
| ID | Risk | L | I | Score | Owner | Action |
|---|---|---|---|---|---|---|
| R-01 | If a main subcontractor fails, the hospital project slips and delay penalties apply | 3 | 5 | 15 High | Projects Director | Pre-qualify a backup subcontractor; weekly progress check |
| R-02 | If our two largest clients pay 60 days late, cash runs short for payroll | 3 | 4 | 12 Medium | Finance Manager | Weekly cash forecast; agree payment milestones in new contracts |
| R-03 | If skilled workers arrive late for mobilisation, the project start slips | 3 | 4 | 12 Medium | Operations Manager | Recruit in batches; track every worker's documents weekly |
| R-04 | If WPS salary files are late or rejected, penalties follow and new work permits can be held up | 2 | 4 | 8 Medium | HR Manager | Payroll checklist; submit files early each month |
| R-05 | If the estimating lead resigns, tender pricing quality drops | 2 | 4 | 8 Medium | General Manager | Document the pricing method; train a second estimator |
Notice three things. Each risk is specific to this business. Each has exactly one owner. And each action is something you could check next month. That is what makes a register useful rather than decorative.
Five mistakes that kill risk registers
- Too long. A register with 80 risks never gets read. Start with the 15 to 25 that matter.
- Too vague. "Economic downturn" is a headline, not a risk. Say how it would hit you.
- Owned by departments. Name a person, every time.
- Scored once, never reviewed. Risks change every month. A register that does not is out of date.
- Finance only. If only the finance team looks at it, people and operational risks get missed. Bring in HR and operations.
Keeping it alive
A register earns its keep through use. Tie it to meetings you already hold, rather than creating new ones. Add risks when something changes: a big contract win, a new market, a senior resignation, a new regulation. Close risks that no longer apply, and keep them in an archive tab so you can see what you have learned.
Here is a simple test. If your register looks the same as it did three months ago, nobody is using it.
When outside help is worth it
Plenty of owners build the first version themselves, and that is a great start. Outside help pays off when the framework has to satisfy a board, lender or investor; when you are preparing for a tender or due diligence; or when you want an independent view of risks your team is too close to see. That is where our Risk Management, Internal Audit and Governance, Risk & Compliance services come in.
Key takeaways
- A risk register is one list: risk, score, owner, action, date.
- Write each risk as "If this happens, then that follows."
- Score likelihood and impact from 1 to 5 and agree what the numbers mean.
- One named owner per risk, and a dated action for every response.
- Review high risks monthly and the full register quarterly.
Free template
Get the risk register template as a PDF
A ready-to-use template with the nine columns, the 5x5 scoring guide and a monthly review checklist. Enter your details and the download starts straight away.
Thank you, . Your download is starting.
If it does not start, use the button below. A consultant may follow up to see if you need help.
Related reading
FAQ
Questions owners ask about risk registers
What is the difference between a risk register and an issue log?
A risk is something that might happen. An issue is something that already has. Risks go in the register with a score, an owner and a plan. Issues go on an action list and get fixed now.
How many risks should a risk register have?
Start with the 15 to 25 risks that could genuinely hurt your goals this year. A short register that people read beats a long one that nobody opens.
How often should a risk register be reviewed?
Review high risks monthly, the full register quarterly, and again after any big change such as a major contract, a new market or a senior resignation.
Who should own the risk register?
One senior person, often the general manager or finance lead, keeps the register up to date. Each individual risk then has its own named owner.
Is a spreadsheet good enough for a risk register?
For most small and mid-sized UAE businesses, yes. Move to dedicated software only when you manage many entities, projects or sites and need automated reporting.
Turn your register into a working risk framework
Our consultants run the first workshop with your team, score your top risks and set up a review rhythm that lasts.