DiligenceOperations
Risk Register
Also known as: Exposure register, claims register, risk log
A live document listing every known exposure — pending claims, regulatory inquiries, insurance disputes — with current status and estimated cost. What the buyer expects to see and most founders don't maintain.
WHY IT MATTERS
A risk register is a live document cataloging every known exposure the business carries: pending litigation, open insurance claims, regulatory inquiries, OSHA findings, employment disputes, and any other contingent liability. Each entry includes the current status and an estimated cost range. The buyer's risk team runs their own version during diligence — pulling public records, loss runs, and regulatory databases. When the seller's risk register matches what the buyer's team finds independently, the signal is: this founder knows their exposures and has been managing them. When the buyer finds things the seller didn't disclose, the signal is the opposite — and the credibility hit affects how every subsequent disclosure gets treated. Most founder-owned businesses don't maintain a risk register because the founder carries the information in their head. That works for running the business. It doesn't work for selling it, because the buyer needs to verify, not trust.