--- title: "A Risk Register Framework for Fractional CFOs to Deploy with SMB Clients" url: "https://cfodrive.com/insight/a-risk-register-framework-for-fractional-cfos-to-deploy-with-smb-clients/" author: "Amy Coats" published: "2026-01-21" updated: "2026-09-19" --- # A Risk Register Framework for Fractional CFOs to Deploy with SMB Clients # **A Risk Register Framework for Fractional CFOs to Deploy with SMB Clients** Small business owners understand risk in theory. In practice, risk stays in their heads until something breaks - a cash crunch, a client who stops paying, a tax liability that sneaks up. A [risk register](https://cfodrive.com/insight/why-a-slow-website-belongs-on-the-cfos-risk-register/) is a tool that punches above its weight for SMB clients. Not as a compliance exercise - as a lightweight decision tool that gives leadership a place to track real risks, assign ownership, and review them on a schedule a small team can actually maintain. Here's what I use. ## **What the register should look like** If it takes more than a page, your client won't use it. A "minimum viable" risk register is a simple table with these columns: - Risk (short name) - Category (cash, customer, ops, finance, people, legal) - Description (one sentence: what could happen?) - Likelihood (1–5) - Impact (1–5) - Score (Likelihood × Impact) - Owner (one person accountable) - Trigger (what tells you it's starting?) - Mitigation (the action they'll take) - Review cadence (monthly is enough for most) - Status (green / yellow / red) That's it. The goal is clarity and follow-through, not documentation for its own sake. ## **10 risks worth deploying early** These are the risks I build into the first version with most clients - common, measurable, and expensive when ignored. ### 1) Working capital timing **Trigger:** Cash dips below minimum threshold, or they're floating bills waiting for payments. **Mitigation:** Weekly 14-day cash lookahead; set a minimum operating cash threshold; delay nonessential spend when near the line. ### 2) Accounts receivable aging **Trigger:** Over-30/over-60 receivables exceed a set percentage of monthly billings. **Mitigation:** Automatic invoice reminders + weekly follow-up cadence; tighten terms for repeat offenders; require deposits for new clients. ### 3) Customer concentration **Trigger:** One client represents more than X% of revenue or gross profit. **Mitigation:** Set a concentration limit as a strategy metric. Build a pipeline target tied to reducing reliance. ### 4) Margin erosion from scope creep **Trigger:** Projects routinely run past estimated hours, or delivery effort rises while revenue stays flat. **Mitigation:** Define scope boundaries; bill change orders faster; adjust pricing for work that consistently overruns. ### 5) Tax liability timing **Trigger:** Payroll/sales tax/VAT due dates cause recurring cash stress. **Mitigation:** Separate tax set-aside account; weekly transfer rule based on revenue; calendar reminders and owner review. ### 6) Debt service pressure **Trigger:** Debt payments consume a rising percentage of cash, or they're relying on a credit line to cover normal operations. **Mitigation:** Track debt service in the cash lookahead; renegotiate terms early; build a payoff plan tied to cash thresholds. ### 7) Vendor dependency **Trigger:** One vendor is required for delivery, and lead times/pricing are unpredictable. **Mitigation:** Identify alternates; negotiate secondary supply; build lead time into the operations calendar. ### 8) Payment and approval controls **Trigger:** One person can initiate and approve payments, or bank access is too wide. **Mitigation:** Set approval thresholds; separate "initiate" vs "approve" when possible; monthly review of bank users and permissions. ### 9) Financial reporting reliability **Trigger:** Month-end reports arrive late or can't be trusted; reconciliations aren't current. **Mitigation:** Define what "[month-end close](https://cfodrive.com/qa/cut-time-from-the-month-end-close-without-losing-accuracy-finance-leaders-share-what-mattered/) complete" means (bank recs done, key accounts reviewed, balance sheet sanity check); assign due dates and ownership. ### 10) Single point of failure (people/process) **Trigger:** One person holds critical knowledge and the business stalls when they're out. **Mitigation:** Document the process that keeps the business moving (billing, collections, payroll, bank access); cross-train one backup. ## Scoring without overcomplicating it Use a 1–5 scale. Keep definitions simple: **Likelihood:** - 1 = unlikely this year - 3 = plausible / has happened before - 5 = already happening or happens regularly **Impact:** - 1 = annoyance, recoverable quickly - 3 = meaningful cost or disruption - 5 = threatens payroll, reputation, or continuity Multiply them. You don't need perfect math - you need a sorting mechanism. The point is to answer: what deserves attention this month? A simple rule: - Score 12+ → mitigation action scheduled this month - Score 8–11 → monitor weekly; mitigation planned - Score ≤7 → monitor monthly ## What makes it stick: triggers, owners, and a monthly review A risk register fails when it becomes a document no one owns. Two requirements make it usable: **Every risk has one owner.** Not a department. Not "the team." One person. **Every risk has a trigger.** A trigger turns risk into a measurable signal - and prevents the "we didn't realize it was getting bad" conversation. Then run a monthly review. Keep it to 20 minutes: - Review the top 5 risks by score - Status update: green/yellow/red - Confirm mitigation actions (done/not done) - Update triggers and thresholds if needed - Add/remove risks based on what changed That's how risk analysis becomes part of management instead of a one-time exercise. ## Example entries (what "good" looks like) **Risk:** AR aging rising **Trigger:** Over-60 invoices exceed 15% of monthly billings **Mitigation:** Weekly collections block; automatic reminders; deposits required for new clients **Owner:** Operations lead (or owner) **Risk:** Customer concentration **Trigger:** Top customer exceeds 25% of gross profit **Mitigation:** Pipeline goal tied to reduction; pricing review; diversify offers **Owner:** Owner / sales lead **Risk:** Payment controls too loose **Trigger:** Same person initiates and approves payments; multiple bank admins **Mitigation:** Approval thresholds; monthly permission review; dual approval for large transfers **Owner:** Owner / finance lead These are boring. That's the point. Good risk controls prevent problems. They don’t create paperwork. ## Closing thought A risk register is one of those tools that looks simple but changes how a leadership team thinks. It turns vague anxiety into specific, owned, reviewable items. If you're working with SMB clients who are growing but still flying by gut on risk, this is a framework you can deploy in a single session and build from there. Three months of monthly reviews usually gets the client hooked. --- **Amy Coats** is the founder of Accounting Atelier, a bookkeeping firm built for small businesses. Learn more at [**accountingatelier.com**](http://accountingatelier.com).