Risk Registers for UK Sports Clubs: A Practical Guide

David runs a rugby club in North Yorkshire. Ninety senior members, forty juniors, one clubhouse that's seen better days. Last spring, the council sent him a letter about the lease renewal for their playing fields. Buried in paragraph three was a new requirement: "The lessee shall maintain and make available on request a current risk assessment covering all activities conducted on the premises."

He'd never been asked for one before. The club had been on those fields for thirty-two years.

He Googled "risk register template" and found an ISO 31000 document designed for multinational corporations. There was a section on "risk appetite calibration" and another on "assurance mapping." He closed the browser.

That's not what he needs. What David needs is something he can put together with his committee over a couple of pints on a Tuesday night, write up on two pages, and send to the council by the deadline. That's what this guide is for.

If you're looking for the Australian version, we've written a separate guide - risk register guide for Australian sports clubs - covering the specific risks and regulatory context relevant to clubs down under. The framework is similar, but the details differ quite a bit.

What a risk register actually is

Strip away the management consultancy language and a risk register is just a list. Things that could go wrong at your club. How likely each one is. How bad it would be. What you're doing about it. Who's responsible for making sure the mitigation actually happens.

Five columns and some honest conversation. That's the whole thing.

But why should your club bother? Several reasons - and they're practical, not theoretical.

Council and venue leases. Local authorities across the UK are increasingly including risk management as a condition of playing field leases and facility hire agreements. David's experience is becoming the norm, not the exception. Parish councils, district councils, and unitary authorities are all tightening governance expectations for community use of public land.

Lottery and grant funding. National Lottery Community Fund applications, Sport England capital grants, and most other public funding rounds now ask about your risk management arrangements. Having a register - even a simple one - puts you ahead of the clubs that tick "N/A" on that section.

Insurance. Most sports club insurers ask whether your club has a risk management process. Some offer better premiums to clubs that can demonstrate one. And if you ever make a claim, showing you'd already identified and were managing that particular risk puts you in a materially stronger position.

Personal liability. Committee members carry a duty of care - whether your club is an unincorporated association, a CASC, or a charity. If something goes wrong and nobody ever considered the possibility, that's a governance failure. A risk register is evidence of due diligence. It doesn't guarantee protection, but it demonstrates that your committee was thinking responsibly.

Geoff Wilson writes about this well - the idea that governance isn't about producing documents for their own sake, but about protecting the volunteers who give their time. A risk register is a practical expression of that principle. We reviewed Geoff's book here, and it's worth reading alongside this guide.

The five risk categories

Most clubs, when they think about risk at all, think about injuries and money. Those matter. But they're not the whole picture. Here are the five categories that cover what actually goes wrong at UK sports clubs.

Financial

Money coming in, money going out, and the gap that opens when assumptions don't hold.

• Membership fee shortfall. You budgeted for 180 financial members and 155 renewed. That's a hole of several thousand pounds, depending on your fee structure.
• Bar and social revenue decline. The clubhouse bar used to be your biggest revenue stream. Post-pandemic, drinking habits changed - and if you're relying on bar takings to subsidise subscriptions, the model might not hold.
• Loss of a major sponsor. If one sponsor accounts for 30% or more of your income and doesn't renew, that's a crisis. Concentration risk is the formal term. "We're in trouble" is the committee term.
• Grant acquittal failure. You received a £12,000 National Lottery facility grant and didn't acquit it properly. Now you can't apply for the next round - and you might have to return the money.

Safety

The category with the most serious consequences. Also the one where good process makes the biggest difference between a near-miss and a catastrophe.

• Player injury - particularly concussion. Concussion protocols are now mandatory across most UK sports. The RFU's concussion framework, the FA's guidance, the ECB's policy - if your club doesn't have a documented return-to-play process, you're exposed.
• Spectator or volunteer injury at the ground. A broken step near the pavilion. Uneven paving in the car park. A goalpost not properly anchored. These aren't hypotheticals - they're the stuff of insurance claim data.
• Flooding or storm damage. UK weather is becoming more volatile. If your pitch floods regularly and you're still sending teams out on waterlogged surfaces, that's a safety risk and a liability risk.
• Allergic reaction at the clubhouse. Home-baked cakes at the juniors' presentation day with undisclosed allergens. Preventable with a basic labelling process. Potentially devastating without one.

Legal and compliance

The quietly dangerous category. Consequences arrive months later, by letter, from a government department or regulatory body.

• Lapsed DBS checks. Your junior coach's DBS check hasn't been renewed in four years and nobody noticed. That's a safeguarding compliance failure - and if something happens, your NGB and your insurer will both ask when the check expired.
• GDPR data breach. A spreadsheet with 300 members' names, dates of birth, medical conditions, and payment details sitting in someone's personal Dropbox account with no access controls. That's a reportable data breach under GDPR. The ICO can fine organisations up to £17.5 million - they won't fine a cricket club that amount, but they can issue enforcement notices, and the reputational damage from a data breach reported in the local press is real.
• Equality Act non-compliance. A club that informally excludes certain groups - through pricing structures, facility access, or simply through a culture that discourages participation - is at risk of a discrimination complaint.
• Missed AGM or constitutional breach. You changed the membership fee structure without the resolution your constitution requires. Seems minor until someone disputes a committee decision and the first thing a solicitor checks is whether you followed your own rules.
• Alcohol licensing breach. Your premises licence has conditions attached. Operating outside those conditions - late openings, inadequate supervision, serving at unlicensed events - puts the licence at risk. And a club without a licence often can't sustain its financial model.

Reputational

Harder to quantify, harder to recover from than you'd expect. A financial shortfall can be replenished over a season or two. Trust, once damaged in a small community, can take years to rebuild.

• Social media incident. A parent films a confrontation with a referee and posts it to the village Facebook group. By Monday, the local newspaper's called. This happens somewhere in UK sport every single weekend.
• Safeguarding allegation. A parent raises a concern about a coach's behaviour. Whether it has merit or not, how you respond in the first 48 hours determines whether it becomes a managed incident or a story with legs.
• Public committee dispute. Two committee members fall out and take it public. Members take sides. Sponsors ask uncomfortable questions. It sounds trivial. It's one of the most common reasons clubs lose members.

Operational

The unglamorous risks. The ones that don't make the local news but can bring a season grinding to a halt.

• Key volunteer departure. Your registrar has been running membership for eleven years and emigrates in April. Nobody else knows the systems, the passwords, or the NGB portal. This is the most underestimated risk in community sport - we'll come back to it in the FAQs.
• Loss of playing fields. The council decides to sell the land for housing development. Or a flooding event makes the ground unplayable for two months. Playing field sell-offs have been a persistent threat across England - the Fields in Trust charity exists precisely because this happens regularly.
• Clubhouse structural issues. Many UK sports clubs play out of pavilions and clubhouses built in the 1960s and 1970s. Asbestos surveys, listed building constraints if the pavilion is in a conservation area, basic maintenance on ageing roofs and plumbing - these aren't glamorous, but a condemned clubhouse closes a club faster than anything else.
• Equipment failure. Floodlight columns corroded at the base. Defibrillator battery flat. Replacement goalposts with an eight-week lead time. These are the risks that become crises because nobody put them on a list.

How to score risks

Not all risks are equal. You need a way to sort them, and the simplest method is a likelihood-times-impact matrix.

Likelihood scale:

| Score | Label | What it means | |-------|-------|---------------| | 1 | Rare | Could happen, but probably won't in the next 5 years | | 2 | Unlikely | Might happen once in 3–5 years | | 3 | Possible | Could happen once a season | | 4 | Likely | Will probably happen this season | | 5 | Almost certain | Happens regularly - expect it |

Impact scale:

| Score | Label | What it means | |-------|-------|---------------| | 1 | Negligible | Minor inconvenience, no lasting effect | | 2 | Minor | Small financial loss or brief disruption | | 3 | Moderate | Significant cost, temporary loss of capability | | 4 | Major | Serious injury, large financial loss, regulatory action | | 5 | Catastrophic | Life-threatening injury, club viability at risk, criminal liability |

Multiply likelihood by impact. That gives you a score between 1 and 25.

• 1–6 (Low): Monitor it. Review at the scheduled check-in. No immediate action needed.
• 7–12 (Medium): Have a plan. Assign an owner. Put mitigations in place this season.
• 13–20 (High): Act now. This needs committee attention this month.
• 21–25 (Critical): Stop and fix. Don't run the next event until this is resolved.

The point isn't precision - it's prioritisation. It prevents your committee spending an hour debating padlocks for the equipment shed while ignoring the fact that three DBS checks expired in January and nobody renewed them.

Building your register: step by step

Set aside 90 minutes at a committee meeting. Bring a laptop or a whiteboard. And bring someone who works at the ground-level - the volunteer who runs the bar, the groundsman, the parent who helps with juniors every Saturday. They'll know which floodlight doesn't work properly and that the fire extinguisher in the changing rooms is two years past its service date.

Step 1: Gather the right people. Committee members, your welfare officer, your groundsman if you have one, two or three experienced volunteers. You want people who see the day-to-day reality, not just the people who attend monthly committee meetings.

Step 2: Brainstorm risks using the five categories. Work through each category one at a time. Write everything down. Don't filter yet - you'll trim afterwards. Most clubs identify 15–25 risks in a first pass.

Step 3: Score each risk. Use the matrix. Don't agonise over the difference between a 3 and a 4 on likelihood. If there's genuine disagreement, go with the higher score. This is a living document, not a planning application.

Step 4: Assign an owner. Every risk needs one person's name next to it. Not "the committee." A person. If nobody is willing to own a particular risk, that tells you something about how seriously the club takes it.

Step 5: Write the mitigation. Two parts: what you're already doing (existing controls) and what you need to do (additional actions). "We already have a fire extinguisher in the clubhouse" is an existing control. "We need to get the fire extinguisher serviced before the start of season - it was last done in 2022" is an additional action.

Step 6: Set review dates. Pre-season and mid-season. Put them in the committee calendar. If the register doesn't get reviewed, it becomes a document in a drawer - which is worse than having nothing, because it creates a false sense that someone is managing the risk.

Example entries

Here's what a few entries might look like for a typical UK club:

| Risk | Category | L | I | Score | Owner | Mitigation | |------|----------|---|---|-------|-------|------------| | Junior coach DBS check lapsed - not renewed since 2022 | Legal/Compliance | 3 | 5 | 15 | Welfare Officer | Track all DBS expiry dates centrally; send reminders 90 days before renewal; stand down any coach whose check lapses until renewed | | Council reviews playing field lease and increases rent by 40% | Financial | 2 | 4 | 8 | Chairperson | Maintain relationship with parks department; attend parish council meetings; explore Fields in Trust protections; diversify revenue so ground rent is below 20% of total income | | Single registrar holds all membership system knowledge | Operational | 4 | 4 | 16 | President | Document all registration and NGB portal processes; train a second person; store credentials in club password manager | | Member data stored in personal Google Drive with no access controls | Legal/Compliance | 4 | 3 | 12 | Secretary | Migrate data to club-managed system with role-based access; delete personal copies; include in data protection policy | | Pavilion roof leaks during heavy rain - water near electrical fittings | Safety | 3 | 4 | 12 | Facilities Officer | Temporary repair completed; formal quote for full replacement obtained; apply to Sport England Small Grants for funding | | Parent posts video of sideline confrontation to local Facebook group | Reputational | 3 | 3 | 9 | Chairperson | Adopt social media policy; train team managers on de-escalation; prepare media response template; display codes of conduct at pitch-side |

That's six entries. A typical club register will have 15–20. It shouldn't be longer than two or three pages.

How TidyHQ helps

You can build a risk register in a spreadsheet - and for the register itself, a spreadsheet is fine. But tracking the compliance items underneath it is where spreadsheets fall apart. DBS check expiry dates, first aid certifications, coaching qualifications, food hygiene certificates - somebody has to manually check dates and chase renewals. When that person is also running registrations, organising the awards evening, and dealing with the council about the car park, things slip through.

TidyHQ's member profiles store compliance credentials against individual contacts, with expiry dates that trigger automated reminders before anything lapses. Your risk register says "track all DBS expiry dates centrally" - that's not an aspiration, it's a feature you can set up this afternoon. You can also store the register itself in TidyHQ's document storage, attached to your committee workspace, so it doesn't live on one person's laptop and disappear when they step down.

Frequently asked questions

How often should we review our risk register?

Twice a year at minimum. Once before the season - that's when you catch changes from the off-season: new activities, new facilities, committee turnover, expired certifications. And once at the halfway point, when you've had a few months of reality to compare against your assumptions. If something significant happens between scheduled reviews - a serious incident, a regulatory change, a facility closure - update it immediately. Don't wait for the next review cycle.

Does our club need a risk register if we have public liability insurance?

Yes. They serve different purposes. Insurance covers you financially after something has gone wrong. A risk register helps prevent things going wrong - or reduces the impact when they do. Most public liability policies contain a condition requiring the insured to take "reasonable steps" to manage foreseeable risks. If you make a claim and the insurer finds you hadn't identified an obvious risk, your claim could be challenged. A risk register is the evidence that you took those reasonable steps.

What's the risk most UK clubs overlook?

Key person dependency, without question. Nearly every club has someone - usually the secretary, registrar, or membership secretary - who knows how everything works. The bank account process, the NGB affiliation portal, the membership database, the combination to the padlock on the storeroom, where the spare set of corner flags lives. When that person leaves - and eventually they always do - the club loses months of operational capability. Almost nobody puts this in a risk register because it feels awkward to plan for someone's departure while they're still there. It's not awkward. It's responsible. Document what they know. Train a second person. Store credentials centrally.

You don't need a risk management qualification. You need a table, ninety minutes with your committee, and honest answers about what could go wrong. That's a risk register. And it's one of the most useful things a volunteer committee can produce - not because anyone will read it with admiration, but because the process of creating it forces you to think about the things you've been hoping won't happen.

References

• Sport England - Risk management guidance and Club Matters resources for community sport
• UK Sport - Governance and risk frameworks for UK sporting organisations
• NCVO - Risk management guidance for voluntary and community organisations
• NSPCC CPSU - Safeguarding risk assessment resources for sports clubs
• Geoff Wilson - Practical risk and governance guidance for grassroots sports clubs