Most small companies either have no risk register or have one that was produced for a certification and never opened again. Both amount to the same thing. A register earns its place only if it is short enough to review and specific enough to act on.
Start with one page
Not a system. A single page, ten to fifteen risks, reviewed quarterly. If it runs to forty entries, it will not be read, and an unread register is worse than none because it creates the impression of control.
Four columns, and the two that get mishandled
The risk. Written as something that could happen and its effect, not as a topic. “Cybersecurity” is a category. “Loss of customer data through an unpatched system, triggering notification obligations and losing key accounts” is a risk you can do something about.
Likelihood and impact. Score coarsely — high, medium, low. Numeric scales to two decimal places imply a precision nobody has and start arguments about the arithmetic instead of the risk.
The existing control. What is already in place. This column is usually optimistic, and it is worth one honest conversation per entry: does that control actually operate, and would we know if it stopped?
The owner. A named person, not a department. This is the column that gets skipped, and it is the one that makes the register do anything. An unowned risk is an observation.
Review it on a schedule
Put four dates in the calendar for the year. At each review, ask only three things: has anything changed, did the actions happen, and what should come off the list. Closing risks matters as much as adding them.
A register maintained this way takes perhaps two hours a quarter, and it converts a set of vague worries into a short list of things somebody is doing.