Many organizations hold an annual session to 'identify supply chain risks', produce a long list of concerns, and then file the document in a folder. The problem is not listing; it is that the list never reaches decisions and action. A risk register has value when it is alive and has owners and actions.
A simple risk register has several fields per risk: a precise description of the event (not 'supply risk' but 'stoppage of material X from supplier Y due to an import restriction'), likelihood, impact, confidence of early detection, preventive action, reactive action if it occurs, and an owner. This structure draws on FMEA (failure modes and effects analysis), common in quality engineering.
In FMEA the risk score comes from multiplying three numbers: severity of impact, likelihood of occurrence and difficulty of detection. Adding the detection dimension matters because a risk that is seen early differs from one that strikes suddenly, even if likelihood and impact are equal. The result is a priority score that helps limited resources reach the top few risks rather than all risks equally.
The key in scoring is using simple scales (say 1 to 5) with a clear definition of each level. For impact, for example, level 5 means 'production stopped more than two weeks' and level 1 means 'negligible'. Without shared definitions each participant gives a different number and arguing about the number displaces arguing about action.
After scoring, actions must be defined for the high risks. Actions are of several types: reduce likelihood (second supplier, long-term contract), reduce impact (targeted safety stock, a fallback plan), improve detection (monitor early-warning indicators such as delivery delays or supplier financial health), or accept consciously. Acceptance is a valid decision, provided it is made explicitly and recorded.
A common mistake is focusing on big, low-probability risks (like natural disasters) and ignoring everyday risks that occur every month, such as supplier delay, currency swings or data errors. Often the set of small, frequent risks costs more than one rare event. Another mistake is naming the owner as a 'team' instead of one person; a risk without a specific owner is never followed up.
Review the register on a regular cycle, say quarterly, and preferably attach it to the S&OP meeting or supplier reviews so it stays alive. Each review should answer two questions: which risks have changed, and which actions have been done or are overdue.
A practical starting point: write down the top ten risks that come to mind today with precise descriptions, give each a three-part score, and assign an owner and a dated action to the top three. That one simple table is far more useful than a 'risk identification' session.