A risk register template for mid-sized companies, with the records risks to add
A risk register template for a mid-sized company needs an ID, risk statement, category, owner, likelihood and impact scores, current controls, response and review date for every line. Add two records lines most registers skip: losing historical records to retention purges or system retirement, and unassessed value in records the company could license.
What a risk register template for a mid-sized company needs
A usable register for a company of roughly 50 to 500 employees has twelve columns, a five-point scoring scale and eight categories, with every line owned by a named executive. The version below adds a records and information category, because the two records lines on this page are decided in budget and migration meetings and rarely reach the board.
Build or refresh the register when:
- a board, lender or private equity sponsor asks for one for the first time
- budget season starts and risks should shape where money goes
- an acquisition brings a second set of systems, contracts and people
- a first audit, a refinancing or a sale process is coming and diligence teams will ask how risk is tracked
If you are the fractional CFO, draft version one yourself in the opening quarter of the engagement, then hand each line to its owner so the register outlives your involvement. The fractional CFO partner page explains how this governance work connects to introductions.
Which columns should the register have?
Twelve columns cover what a board, an auditor and a lender will ask about. Copy the headers and replace the example entries.
| Column | What to write | Example entry |
|---|---|---|
| ID | Category prefix plus a number | FIN-04 |
| Risk statement | Cause, event and consequence in one sentence | Because two customers supply a third of revenue, losing either would breach the leverage covenant |
| Category | One of the eight categories below | Financial |
| Owner | One named executive, never a department | Chief revenue officer |
| Likelihood (1-5) | From the scoring table | 3 |
| Impact (1-5) | From the scoring table | 4 |
| Inherent score | Likelihood times impact before controls | 12 |
| Current controls | What reduces the risk today, and whether anyone tests it | Quarterly account reviews; renewal dates tracked in the CRM |
| Residual score | Score after controls | 8 |
| Response | Treat, tolerate, transfer or terminate, plus the action | Treat: multi-year renewal proposal for both accounts |
| Action due | Date and person | End of Q1, CRO |
| Trend and last review | Up, down or flat, with the date | Flat, reviewed at the June board meeting |
Write controls as things people actually do. When a control lives in a documented procedure, point to it; an accounting desk procedures template is a sensible home for the finance controls the register relies on.
How should likelihood and impact be scored?
Use plain-language anchors so two executives scoring the same risk land within a point of each other.
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Not expected in the next five years | Absorbed inside a monthly budget line |
| 2 | Possible within five years | Needs a reforecast, no change to plans |
| 3 | Possible within two years | Delays a plan, a month-end close or an audit |
| 4 | Likely within twelve months | Breaches a covenant, loses a key customer or draws regulator attention |
| 5 | Expected within months, or already happening | Threatens liquidity, a transaction or the right to operate |
A routing rule keeps meetings short: residual scores of 15 or more go in the board pack, 8 to 14 get a quarterly leadership review, and anything lower stays with its owner.
Which risk categories fit a mid-sized company?
Eight categories cover most companies this size. Fifteen to thirty active lines is usually enough; a register with a hundred lines stops being read.
| Category | Typical lines | Usual owner |
|---|---|---|
| Strategic | Market shifts, pricing pressure, AI changing the service model | CEO |
| Financial | Liquidity, covenant headroom, customer concentration, currency | CFO |
| Operational | Supplier failure, capacity limits, quality escapes | COO |
| People | Key-person dependency, succession, wage pressure | CEO or head of people |
| Technology and cyber | Ransomware, unsupported systems, access control | IT lead or managed service provider |
| Compliance and legal | Contract breaches, privacy obligations, tax filings | CFO or general counsel |
| Commercial | Renewal risk, channel conflict, bid losses | Head of sales |
| Records and information | Loss of history, unclear record ownership, unassessed value in records | CFO with the IT lead |
The records category pairs with the census step in a finance transformation roadmap: the census tells you which systems exist and how far back they go, and the register tracks what could go wrong with them.
Two records risks most registers miss
Most templates file records under IT backups. These two lines deserve their own entries because the decisions behind them, such as cancelling a tool or shortening a retention setting, are made in finance and project meetings.
Threat line: loss of historical records
Raise the likelihood score when any of these are true:
- An ERP, CRM, help desk or email migration is planned within twelve months.
- Email, Slack or Teams retention is set to auto-delete.
- Leavers' mailboxes and drives are deleted on a fixed schedule.
- A SaaS subscription was cancelled without an export.
- An acquired company's systems are being shut down after integration.
Opportunity line: unassessed value in licensable records
A register can carry upside entries. Prefix them OPP so they stay out of threat totals and heat maps.
The rights check belongs in the controls column. In a January 2024 post, FTC staff said that companies' promises not to use customer data for undisclosed purposes, such as training models, are enforceable wherever they were made, including privacy policies and terms of service. The post is staff guidance rather than a rule, but it is a good reason to read the privacy policy and key customer contracts before OPP-01 moves forward. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.
How do you adapt the template to a specific company?
| Company situation | What to change | Lines to add |
|---|---|---|
| Sponsor-backed with a lender | Tie the impact scale to covenant definitions | Covenant headroom, sponsor reporting deadlines |
| Founder-owned and weighing a sale | Add a transaction-readiness section | Key-person risk, data room gaps, record ownership |
| Several legal entities | Add an entity column and name an owner per entity | Intercompany reconciliation, which entity owns which records |
| Recently acquired add-on | Merge both registers and keep acquired-company lines open until integration ends | Systems shutdown, retention of the acquired company's archives |
| Professional services firm | Weight people and client-contract risks | Utilization, confidentiality clauses that limit reuse of client work |
| Retiring a core system this year | Raise REC-01 likelihood for the migration window | Export sign-off, cost of keeping legacy access |
When should the register be reviewed?
| When | Who | What happens |
|---|---|---|
| Monthly close | CFO and controller | Update scores that moved; chase overdue actions |
| Quarterly board or owner meeting | Board, CEO, CFO | Review every line scoring 15 or more and every OPP line |
| Annual planning | Leadership team | Re-rate all lines, retire closed ones, add new ones |
| Before any system is retired | CFO, IT lead, system owner | Reopen REC-01 and sign off the export |
| Before a financing, audit or sale | CFO and advisers | Check the register against the diligence request list |
Follow up on OPP-01 within two weeks of raising it. Left longer, it drifts into next year's planning cycle, sometimes after the system in question has already gone.
How does the opportunity line become an introduction?
You stay on the governance side. The company and SourceX do the work, and you never export, upload or describe the records.
- Fill in OPP-01 with what you already know: peak full-time headcount, years of history and the main systems.
- Run the company fit checker, a preliminary, non-binding screen that needs no contact details.
- Take it to the owner or CEO. The baseline on who qualifies is a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations, the right to license its data and an authorized sponsor such as the owner, CEO or CFO.
- If they want to explore, send your partner referral link so the company applies itself, or submit it through the referral form, and log the date in your company introduction record.
- SourceX qualifies the company, the company builds a data inventory, and price and terms are agreed before any buyer review. Nothing binds the company until it signs.
A line for the board pack:
What should never go in the register?
- Extracts, screenshots or samples of customer, employee or financial records.
- Customer or employee names attached to sensitive lines; use IDs instead.
- A license value in the base case or the budget. Keep OPP-01 unpriced until terms are agreed.
- Promises of payment to anyone, or any referral amount.
- Legal conclusions that counsel has not reviewed.
How partner rewards work if you make the introduction
Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee; a lead, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.
The reward is paid from SourceX's share, so the client's proceeds stay the same. If you hold a CPA license, or your engagement letter says anything about referrals, check your state board's rules and the letter itself on referral fees and disclosure before you register. The program terms set out the remaining details.
Next step
Add REC-01 and OPP-01 to the next board pack and score them with the CEO. If the opportunity line passes the first screen, register as a partner and make the introduction, or have the CEO apply at sourcex.si/apply through your referral link.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
How many risks should a mid-sized company track on its register?
Fifteen to thirty active lines is a workable range for a company of a few hundred people. Fewer usually means a category is missing; many more means the register has turned into a task list. Merge risks that share a cause, move closed items to an archive tab, and keep the board view to lines scoring 15 or more after controls, plus any opportunity lines.
Should opportunities sit on the same register as threats?
They can, as long as they are labeled separately. Prefix upside entries with OPP, score them on the same scales and keep them out of threat totals and heat maps. Keeping them in the same document means the same owners and review cadence apply, which stops ideas such as assessing licensable records from disappearing between meetings.
Who should own the records lines, finance or IT?
Finance should own them, with IT as the named second owner. The decisions that destroy history, such as cancelling a subscription, shortening a retention setting or migrating only opening balances, are usually budget and project decisions. IT knows how to run the export, but the CFO or controller knows which years support audits, tax positions, disputes and forecasts.
Is a risk register the same as an enterprise risk management program?
No. The register is the working list; an ERM program adds a risk appetite statement, defined roles, board oversight, regular reporting and a cycle of identification and review. Many private mid-sized companies start with a register and a quarterly review, then add appetite statements and formal oversight when a sponsor, lender or audit committee asks for them.
Does adding an opportunity line for data licensing commit the company to anything?
No. The line only records that the question has not been assessed yet. A preliminary screen, a conversation with SourceX and a data inventory are all non-binding; the company keeps ownership, and nothing is agreed until it accepts price and terms and signs. If the owner decides not to proceed, record that decision on the register and close the line.
What should the board see from the register each quarter?
A one-page view: lines scoring 15 or more after controls, any line whose score moved since the last meeting, overdue actions with their owners, and every opportunity line with its next decision date. Attach the full register as an appendix instead of presenting it line by line, and flag any system retirements planned before the next meeting.
Related pages
- Referral opportunities for fractional CFOs
- Accounting desk procedures template: document each finance workflow step by step
- How to build a finance transformation roadmap that starts with a records census
- Check Company Fit for Data Licensing
- Which US businesses are a fit for a SourceX data licensing introduction
- Company Introduction Record Template
Free resources
- Working capital calculator — Net working capital, current ratio and quick ratio.
- Due diligence checklist generator — A tailored document request list by deal type.
- Cash flow calculator — A 12-month cash forecast with shortfalls highlighted.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment