GRAMMATICAS CONSULTING LTD
Briefing Note
By Dominic Grammaticas FCA
September 2026
Last week I asked whether you have the headlights on. This week the question is: where are those risks written down?
Every well-run business should have a risk register. Most do. It was probably created during a planning exercise or at the request of a board member, an investor, or an insurer. It lists the risks. It assigns some ratings. It names some owners. And then, in most cases, it sits in a folder and gathers dust until someone asks to see it again.
When was the last time you really looked at yours?
Not glanced at it. Not included it in a board pack as an appendix that nobody reads. Actually opened it, reviewed every line, and asked whether it still reflects the risks your business is facing right now.
Because the risk landscape has changed dramatically in the past twelve months. A year ago, your register probably did not include a Middle East conflict that doubled your fuel costs. It did not include an Ebola outbreak that triggered Level 4 travel advisories for neighbouring countries. It almost certainly did not include a super El Niño forecast to hit in October or the early stages of an election cycle that will shape the operating environment through to August 2027.
If those risks are not in your register, then your register is not doing its job. If it is not doing its job, maybe you are not doing yours.
A risk register is not a compliance document. It is a management tool. Done properly, it forces you to think systematically about what could go wrong, how likely it is, how severe the impact would be, and what you are doing to mitigate it. It connects risks to actions and actions to people. It creates accountability. And it gives your board and your investors confidence that you are not just reacting to events but anticipating them.
The good news is that updating a risk register is not a major project. It is a disciplined half-day exercise that can transform the quality of your risk oversight. But it needs to be done regularly, not just when a crisis forces it. And it needs to be done thoughtfully. You cannot simply plug the request into an AI tool and expect it to get it right. Context matters. The risks we understood in the last five years may not be those we face in the next five. Having a fresh set of eyes look at yours, someone who knows the sector and the operating environment, might make the difference between missing something critical and being ready if it hits.
If you would like help reviewing and updating your risk register, Grammaticas Consulting Ltd would welcome the conversation.
Dominic Grammaticas FCA
Managing Director, Grammaticas Consulting Ltd
dominic@grammaticas.com
www.grammaticas.com
Your Risk Register: When Was the Last Time You Really Looked at It?
