Why a risk register is not just compliance
In a Swiss SME, cyberattacks, supply chain disruptions, workplace accidents or tax errors are not remote events: they are scenarios that affect liquidity, margins and reputation. A business risk register does not replace insurance or the budget, but aligns them: each threat is described, assessed and linked to measures, costs and accounting responsibilities.
The Swiss Code of Obligations places a general duty of care in management on boards of directors and executive managers (Art. 717 and 812 CO). Even without an explicit obligation to maintain a “risk register”, documenting how the company identifies and addresses material risks supports the defence of investment, insurance and provisioning decisions before auditors, banks and, in tax or regulatory matters, the competent authorities.
This guide explains how to structure an annual register suited to SMEs, how to translate it into budget lines and policies, and how to reflect it in Swiss ordinary accounting with an auditable trail — including using tools such as Accountex to link documents, cost centres and deadlines.
What an effective risk register contains
A register useful for accounting and management control is not a generic list of “dangers”: each entry must be actionable and measurable.
| Field | Typical content | Financial link |
|---|---|---|
| Risk ID and title | E.g. “Customer data loss via phishing” | Reference in notes to the financial statements or internal appendix |
| Category | Operational, financial, legal/tax, people, IT, reputation | Cost centre or budget project |
| Probability × impact | Scale 1–5 or qualitative matrix | Priority for resource allocation |
| Estimated financial impact | One-off loss, annual cost, exposure cap | Input for reserves, deductibles, budget sensitivity |
| Controls and mitigations | Procedures, backups, training, contractual clauses | OPEX (training, audit) or CAPEX (security) |
| Residual treatment | Accept, mitigate, transfer (insurance), avoid | Insurance premium, self-insurance, provisioning |
| Owner and review | Name, date of last review, next due date | Management agenda and document trail |
Typical risks for Swiss SMEs and where they appear in accounting
Operational and supply
Logistics delays, quality defects, dependence on a single supplier or plant breakdowns can trigger contractual penalties, overtime and lost revenue. In accounting they show up as inventory write-downs, revenue adjustments, restoration costs or warranty liabilities.
In the register: estimate impact as a percentage of critical revenue or daily cost of downtime; link to the “operational continuity” budget and business interruption policies where in place.
Tax and regulatory
VAT errors (rates, imports, reverse charge), late tax filings (VAT with the Federal Tax Administration, income tax with the competent cantonal authority) or non-compliance with the nFADP and retention of accounting records expose the business to assessments, default interest and penalties. The accounting trail must allow reconstruction of the tax base and deductibility.
In the register: quantify the administrative “worst case”; budget for tax advisory and compliance software; mitigate via a deadline calendar integrated with accounting.
People and social security
Prolonged absence of key people, uncovered accidents, errors in OASI/IV/EO or BVG contributions create unexpected personnel costs and social security liabilities. HR costs and employer contributions are sensitive items in the annual budget.
Link risks to supplementary accident policies, daily sickness allowance insurance (KTG) where subscribed, and periodic checks on payslips and payroll records.
IT, data and fraud
Ransomware, fraudulent transfers (CEO fraud) and breaches of personal data entail IT, legal and notification costs and possible compensation. Often not everything is insured: a residual risk remains for budget or liquidity reserve.
Document in the register payment controls (four-eyes), tested backups and cyber insurance; record incident response expenses on dedicated accounts for management analysis.
From register to budget: reserves, OPEX and sensitivity
The decisive step for management and the trust firm is to translate the risk matrix into numbers in the income plan. Absolute precision is not required: what matters are orders of magnitude consistent with available liquidity.
Mitigation operating budget: security training, maintenance, nFADP compliance checks, advisory, penalties avoided through clauses — charge to cost centres (administration, IT, production) already used in management accounting.
Reserves and provisions: for accepted risks with material impact but probability not transferable via policy, assess accounting provisions only where legal obligations or applicable Swiss GAAP FER / FER criteria exist (e.g. product warranties, probable litigation). Where no obligation applies, the register still feeds cash planning and bank covenants.
Sensitivity: for the three highest-scoring risks, model a “event in the half-year” scenario (cash flow −X, margin −Y) and verify that short-term credit or a factoring line covers the gap — documenting the outcome in the management or general meeting minutes.
Insurance: mapping coverage vs residual risks
In Switzerland SMEs often combine general liability, professional liability, property, cyber and mandatory accident insurance (LAINF). The register avoids double counting and coverage gaps.
| Risk in register | Typical transfer | Accounting note |
|---|---|---|
| Third-party damage / defective products | General liability / product liability | Deductible as contingent liability; premiums as accrued OPEX |
| Fire, water, theft of assets | Property / contents | Insured values vs book value of fixed assets and inventory |
| Employee accident | LAINF (mandatory) + optional supplementary | Employer contributions and accident statistics for internal review |
| Cyber / data breach | Cyber policy (if subscribed) | Frequent exclusions; response costs often paid upfront then reimbursed |
| Revenue loss due to shutdown | Business interruption (often optional) | Align limits with revenue budget for the most exposed segment |
Every register line with “transfer” treatment must cite policy number, limit, deductible and renewal date. Annual premiums should be recorded in accounting with the correct accrual date; on renewal, update financial impact in the register if limits change.
Accounting trail and documentation for auditors
Under Swiss accounting standards (Swiss GAAP FER for small entities or Swiss GAAP FER), there is no mandatory “risks” account, but management must be understandable from the financial statements and appendices. The annual register acts as a bridge between management and accounting.
Documents to archive: signed or approved version of the register (PDF with date), board/management minutes acknowledging it, policies and general conditions, paid mitigation quotes, any lawyer letters on disputes. Ten-year retention for commercial books and accounting records (Art. 958f CO); for personal data in the register, respect minimisation and access controls under the nFADP.
Consistent postings: mitigation expenses on existing accounts (6400 training, 6500 advisory, 6100 IT); insurance indemnities as extraordinary income or cost offset per matching principle; damage repairs to fixed assets or OPEX depending on nature. Linking each material payment to a “Risk-ID-XX” project code in Accountex simplifies reports for auditor and bank.
Year-end close: compare risks flagged at year start with events that actually occurred; update estimates on contingent liabilities and guarantees; include in notes to the financial statements any material commitments (critical leases, bank guarantees, litigation) aligned with the register, without duplicating information already in the balance sheet.
Annual cycle in five steps
- Inventory: gather input from accounting (variances, impaired receivables), HR, IT and insurer; include prior-year near-misses.
- Assessment: 90-minute workshop with owner, accounting and operational lead; assign score and CHF impact.
- Budget alignment: add mitigation lines to budget N+1 and check insurance limits vs new risks (e.g. foreign expansion).
- Approval: submit register and financial summary to the governing body; archive resolution with date.
- Quarterly monitoring: update mitigation status and flag new material risks; at year-end close the cycle with lessons learned for the financial statements.
Integrating register, budget and accounting with Accountex
For freelancers and SMEs already managing invoicing, VAT and ordinary accounting in one flow, the practical benefit is avoiding Excel registers disconnected from real numbers. Accountex lets you attach the approved register to the accounting period, use cost centres or tags for mitigation spend and set reminders for policy renewals and quarterly register reviews.
Trust firms can standardise a register template for Ltd and PLC clients, import bank statements filtered by risk project and produce for the general meeting a summary linking risk score, insurance premium paid and provisions — reducing last-minute questions at year-end close.
A well-maintained risk register does not remove uncertainty, but makes visible what it costs not to decide: budget, policies and journal entries tell the same story, with verifiable dates and owners — exactly what auditors and financial partners expect from a mature Swiss SME.