Risk management isn’t optional for a parish council — one of the AGAR governance assertions is that the council has assessed the significant risks it faces and put arrangements in place to manage them. The tool for that is a risk register: a living list of what could go wrong, how serious it would be, and what you’re doing about it.

What a risk register is

A risk register records each significant risk the council faces and, for each one:

  • a description of the risk;
  • its likelihood (how probable) and impact (how damaging), usually scored 1–5 each;
  • a risk score — likelihood × impact — so you can rank them;
  • the controls already in place; and
  • any further action and who owns it.

Scoring likelihood × impact gives each risk a number from 1 to 25, which lets you focus on the handful that genuinely matter rather than treating everything equally.

What to include

A parish council risk register typically covers:

  • Financial — fraud, error, loss of the sole signatory, inadequate reserves, precept miscalculation.
  • Governance & legal — decisions outside powers, missed statutory deadlines (FOI, AGAR), data breaches.
  • Operational — health & safety at play areas and open spaces, failed asset inspections, cyber/IT.
  • Reputational — complaints handling, transparency failures.

Keep it live, not annual

The common mistake is treating the register as a once-a-year document written the week before the AGAR. A register only manages risk if it’s reviewed regularly (at least annually, and whenever something changes), with actions actually tracked to completion.

Several of a council’s biggest risks are mitigated simply by having good systems: an audit log that records who changed what, statutory deadline clocks so nothing is missed, asset inspection schedules that flag overdue checks, and encrypted, access-controlled data. A joined-up system turns several “red” risks “green” on its own.

How Town Desk handles this

Town Desk has the risk register built in, under Governance → Risks. Each risk is scored likelihood (1–5) × impact (1–5) for a 1–25 score, shown as a red / amber / green band and sorted worst-first, with a status of open, monitoring, mitigated or closed — the format your AGAR and internal auditor expect. And several of your biggest risks are mitigated by the system itself: the append-only audit log, the automatic FOI/DSAR deadline clocks, and asset inspection schedules that flag overdue checks.

See the governance features, or book a demo.

General information for UK town & parish councils, not legal advice. See the JPAG Practitioners’ Guide and your internal auditor for what your council’s register should cover.