A Risk Register Framework for Fractional CFOs to Deploy with SMB Clients
Small business owners understand risk in theory. In practice, risk stays in their heads until something breaks - a cash crunch, a client who stops paying, a tax liability that sneaks up.
A risk register is a tool that punches above its weight for SMB clients. Not as a compliance exercise - as a lightweight decision tool that gives leadership a place to track real risks, assign ownership, and review them on a schedule a small team can actually maintain.
Here's what I use.
What the register should look like
If it takes more than a page, your client won't use it.
A "minimum viable" risk register is a simple table with these columns:
That's it. The goal is clarity and follow-through, not documentation for its own sake.
10 risks worth deploying early
These are the risks I build into the first version with most clients - common, measurable, and expensive when ignored.
1) Working capital timing
Trigger: Cash dips below minimum threshold, or they're floating bills waiting for payments.
Mitigation: Weekly 14-day cash lookahead; set a minimum operating cash threshold; delay nonessential spend when near the line.
2) Accounts receivable aging
Trigger: Over-30/over-60 receivables exceed a set percentage of monthly billings.
Mitigation: Automatic invoice reminders + weekly follow-up cadence; tighten terms for repeat offenders; require deposits for new clients.
3) Customer concentration
Trigger: One client represents more than X% of revenue or gross profit.
Mitigation: Set a concentration limit as a strategy metric. Build a pipeline target tied to reducing reliance.
4) Margin erosion from scope creep
Trigger: Projects routinely run past estimated hours, or delivery effort rises while revenue stays flat.
Mitigation: Define scope boundaries; bill change orders faster; adjust pricing for work that consistently overruns.
5) Tax liability timing
Trigger: Payroll/sales tax/VAT due dates cause recurring cash stress.
Mitigation: Separate tax set-aside account; weekly transfer rule based on revenue; calendar reminders and owner review.
6) Debt service pressure
Trigger: Debt payments consume a rising percentage of cash, or they're relying on a credit line to cover normal operations.
Mitigation: Track debt service in the cash lookahead; renegotiate terms early; build a payoff plan tied to cash thresholds.
7) Vendor dependency
Trigger: One vendor is required for delivery, and lead times/pricing are unpredictable.
Mitigation: Identify alternates; negotiate secondary supply; build lead time into the operations calendar.
8) Payment and approval controls
Trigger: One person can initiate and approve payments, or bank access is too wide.
Mitigation: Set approval thresholds; separate "initiate" vs "approve" when possible; monthly review of bank users and permissions.
9) Financial reporting reliability
Trigger: Month-end reports arrive late or can't be trusted; reconciliations aren't current.
Mitigation: Define what "month-end close complete" means (bank recs done, key accounts reviewed, balance sheet sanity check); assign due dates and ownership.
10) Single point of failure (people/process)
Trigger: One person holds critical knowledge and the business stalls when they're out.
Mitigation: Document the process that keeps the business moving (billing, collections, payroll, bank access); cross-train one backup.
Scoring without overcomplicating it
Use a 1–5 scale. Keep definitions simple:
Likelihood:
1 = unlikely this year
3 = plausible / has happened before
5 = already happening or happens regularly
Impact:
1 = annoyance, recoverable quickly
3 = meaningful cost or disruption
5 = threatens payroll, reputation, or continuity
Multiply them. You don't need perfect math - you need a sorting mechanism. The point is to answer: what deserves attention this month?
A simple rule:
Score 12+ → mitigation action scheduled this month
Score 8–11 → monitor weekly; mitigation planned
Score ≤7 → monitor monthly
What makes it stick: triggers, owners, and a monthly review
A risk register fails when it becomes a document no one owns.
Two requirements make it usable:
Every risk has one owner. Not a department. Not "the team." One person.
Every risk has a trigger. A trigger turns risk into a measurable signal - and prevents the "we didn't realize it was getting bad" conversation.
Then run a monthly review. Keep it to 20 minutes:
Review the top 5 risks by score
Status update: green/yellow/red
Confirm mitigation actions (done/not done)
Update triggers and thresholds if needed
Add/remove risks based on what changed
That's how risk analysis becomes part of management instead of a one-time exercise.
Example entries (what "good" looks like)
Risk: AR aging rising
Trigger: Over-60 invoices exceed 15% of monthly billings
Mitigation: Weekly collections block; automatic reminders; deposits required for new clients
Owner: Operations lead (or owner)
Risk: Customer concentration
Trigger: Top customer exceeds 25% of gross profit
Mitigation: Pipeline goal tied to reduction; pricing review; diversify offers
Owner: Owner / sales lead
Risk: Payment controls too loose
Trigger: Same person initiates and approves payments; multiple bank admins
Mitigation: Approval thresholds; monthly permission review; dual approval for large transfers
Owner: Owner / finance lead
These are boring. That's the point. Good risk controls prevent problems. They don’t create paperwork.
Closing thought
A risk register is one of those tools that looks simple but changes how a leadership team thinks. It turns vague anxiety into specific, owned, reviewable items.
If you're working with SMB clients who are growing but still flying by gut on risk, this is a framework you can deploy in a single session and build from there. Three months of monthly reviews usually gets the client hooked.
The capital allocation mistake that looks like success until the market goes quietArticle · Nick Sawinyh
CFO Drive, Vol. 9
CFO Drive is the premier destination for CFO's and finance leaders seeking in-depth insights and resources.
