Keeping a risk register for a small brewery business
A risk register sounds like corporate paperwork. For a small brewery it is a one-page sheet that makes sure the things that could close you are written down, owned and checked. Here is how to keep one without it becoming a chore.
What a risk register is
A risk register is a list of things that could go wrong, how likely each is, how bad it would be, what you are doing about it and who is responsible. It does not prevent problems by itself. It makes sure someone has thought about them before they happen and that the thinking is reviewed.
In a small brewery the owner usually carries all of this in their head. That works until they are on holiday, ill or distracted by a licence renewal. Then the glycol chiller fails on the same day the head brewer quits.
The columns
- Risk: what could happen, in one sentence.
- Cause: why it might happen.
- Likelihood: scored 1 to 5.
- Impact: scored 1 to 5, thinking about money, safety, reputation and licences.
- Score: likelihood times impact.
- Controls: what you already do to reduce it.
- Next action: one concrete step, with a date.
- Owner: one named person.
A spreadsheet is enough. Sort by score and look at the top ten.
Risks most breweries share
Start with the common ones and adjust for your site:
- An excise licence or other approval lapsing because a renewal date was missed.
- Glycol chiller or power failure during active fermentation, especially in summer.
- A contamination or packaging fault that leads to a withdrawal. Our beer recall plan guide covers the response.
- A key person, usually the head brewer, leaving with the recipes in their head.
- CO2 supply shortage, or a CO2 leak in an enclosed space.
- Water supply problems, from a failing borewell to tanker delays.
- Price jumps or shortages in imported malt, hops or yeast, including currency movements.
- Landlord disputes or lease renewal on worse terms.
- Excise or tax policy changes that alter pricing overnight.
- Cash running short because of a slow season or delayed payments.
Scoring without overthinking
Do not spend hours debating whether something is a 3 or a 4. The point is to sort the list roughly. A useful rule: anything with an impact of 5, meaning it could close the business, injure someone or cost the licence, gets an action even if it seems unlikely. A CO2 alarm in a cellar is cheap. A missed licence renewal is not something to leave to chance.
Controls that actually work
Good controls are specific and checkable. "Be careful with renewals" is not a control. "All licence expiry dates in a shared calendar with reminders 90 and 30 days ahead, owned by the operations manager" is. Some examples:
- A temperature alarm on fermenters that sends a message to two phones.
- A written recipe book and SOPs kept outside the head brewer's laptop.
- Two approved suppliers for malt and CO2, with contacts tested before you need them.
- A cash buffer target, reviewed monthly.
Insurance is a control too, for the risks you cannot reduce enough yourself. Our guide to insuring a brewery in India explains what policies cover.
Review it monthly
Put a 30-minute review in the calendar each month with the owner, head brewer and manager. Update scores, close finished actions, add new risks and check that owners did what they said. After any incident or near miss, add it to the register and ask what control would have caught it earlier.
Over time the register becomes a record of how the business learned. It is also useful when talking to banks, investors or a buyer, because it shows the brewery is run with its eyes open. Our guide to why breweries fail is a good prompt for risks you may have missed.
Who should own what
Spread ownership so no single person carries the whole list. The head brewer owns brewing and quality risks: fermentation control, cleaning, contamination and raw materials. The manager owns guest-facing and staff risks: responsible service, safety drills, staffing gaps. The owner or finance lead owns licences, cash, insurance and the lease. Each owner reports on their rows at the monthly review.
If a risk has no obvious owner, that is a finding in itself. Usually it means nobody is watching it.
Keep it small
A register with 80 rows that nobody reads is worse than one with 15 that everyone knows. Keep it to the risks that matter, write in plain language and make each action small enough to finish within a month.
Managing risk is part of managing the business. The owners who do it calmly usually learned the habit before their first crisis rather than because of it.
Common questions
Does a small brewery really need a risk register?
A simple one helps. It turns worries into listed risks with owners, actions and review dates, so nothing depends on one person's memory.
How should risks be scored?
Score likelihood and impact from 1 to 5 and multiply. Anything that could close the business, injure someone or cost the licence gets an action regardless.
How often should I review it?
Monthly, in a short meeting with the owner, head brewer and manager, plus after any incident or near miss.
What are common brewery risks?
Missed licence renewals, chiller or power failures, contamination, losing a key brewer, CO2 problems, water supply issues, raw material price swings and cash shortfalls.
