Risk Management for US Youth Sports: Building Your First Risk Register

Mike runs a youth baseball league in central New Jersey. A hundred and forty kids across eight teams, one shared field complex through the township parks department. Last spring, the parks department sent him a letter about the facility use agreement renewal. Buried in paragraph four was a new requirement: "The licensee shall maintain and provide upon request a current risk assessment covering all activities conducted on municipal property."

He'd never been asked for one before. The league had been using those fields for nineteen years.

He Googled "risk register template" and found an ISO 31000 document designed for multinational corporations. There was a section on "risk appetite calibration" and another on "assurance mapping." He closed the browser.

That's not what he needs. What Mike needs is something he can put together with his board over coffee on a Saturday morning, write up on two pages, and send to the township by the deadline. That's what this guide is for.

If you're looking for the UK version, we've written a separate guide - risk register guide for UK sports clubs - covering the specific risks and regulatory context relevant to clubs across Britain. The framework is similar, but the details differ quite a bit.

What a risk register actually is

Strip away the management consultancy language and a risk register is just a list. Things that could go wrong at your organization. How likely each one is. How bad it would be. What you're doing about it. Who's responsible for making sure the mitigation actually happens.

Five columns and some honest conversation. That's the whole thing.

But why should your organization bother? Several reasons - and they're practical, not theoretical.

Facility agreements. Municipal parks departments, school districts, and private facility owners across the US are increasingly including risk management as a condition of use agreements. Mike's experience is becoming the norm, not the exception. Towns and school boards are tightening governance expectations for community use of public fields and gyms.

Grant funding. Community foundation applications, state youth sports commission grants, and corporate sponsorship proposals frequently ask about your risk management arrangements. Having a register - even a simple one - puts you ahead of the organizations that leave that section blank.

Insurance. Most youth sports insurance carriers ask whether your organization has a risk management process. Some offer better premiums to organizations that can demonstrate one. And if you ever file a claim, showing you'd already identified and were managing that particular risk puts you in a materially stronger position than scrambling to explain why nobody thought about it.

Personal liability. Board members carry a duty of care - whether your organization is an unincorporated association, a 501(c)(3) nonprofit, or an LLC. If something goes wrong and nobody ever considered the possibility, that's a governance failure. A risk register is evidence of due diligence. It doesn't guarantee protection, but it demonstrates that your board was thinking responsibly. For 501(c)(3) organizations, this is particularly important - the IRS and state attorneys general expect nonprofit boards to exercise reasonable oversight.

The five risk categories

Most organizations, when they think about risk at all, think about injuries and money. Those matter. But they're not the whole picture. Here are the five categories that cover what actually goes wrong at US youth sports organizations.

Financial

Money coming in, money going out, and the gap that opens when assumptions don't hold.

• Registration fee shortfall. You budgeted for 160 registered players and 130 signed up. That's a hole of several thousand dollars, depending on your fee structure.
• Concession revenue decline. The snack bar used to be your biggest revenue stream outside registration. But parents are bringing their own coolers now, and the revenue model doesn't hold.
• Loss of a major sponsor. If one sponsor accounts for 30% or more of your income and doesn't renew, that's a crisis.
• Grant mismanagement. You received a $10,000 community foundation grant for equipment and didn't submit the required final report. Now you can't apply for the next round - and you might have to return the money.
• Embezzlement. It happens in youth sports more often than anyone wants to admit. Small nonprofits with a single treasurer and no financial controls are the most common targets.

Safety

The category with the most serious consequences. Also the one where good process makes the biggest difference between a near-miss and a catastrophe.

• Concussion. All 50 states have youth sports concussion laws. If your organization doesn't have a documented concussion protocol and return-to-play policy consistent with your state's law, you're exposed - legally and ethically.
• Heat illness. Youth athletes are physiologically more vulnerable to heat-related illness than adults. If your organization runs summer programs without a documented heat safety protocol, that's a preventable risk. The Korey Stringer Institute and the National Athletic Trainers' Association provide specific guidelines.
• Lightning. The leading cause of weather-related death in youth sports. If you have outdoor programs and no written lightning policy, you're betting on luck every time a storm rolls in during practice.
• Spectator or volunteer injury. A broken bleacher seat. An uneven parking lot. A loose foul ball that hits someone behind an inadequate backstop. These aren't hypotheticals - they're the content of insurance claims.
• Allergic reaction at the snack bar. Unlabeled food at the concession stand with undisclosed allergens. Preventable with a basic process. Potentially devastating without one.

Legal and compliance

The quietly dangerous category. Consequences arrive months later, by letter, from a government agency or governing body.

• Lapsed background checks. Your head coach's background check expired six months ago and nobody noticed. That's a SafeSport compliance failure - and if something happens, your NGB and your insurer will both ask when the check expired.
• SafeSport training not current. Your NGB requires annual or biennial SafeSport refresher training. Three of your coaches let theirs lapse. You're technically fielding non-compliant coaching staffs at every game.
• Title IX violation. If your organization receives any form of government funding or uses public facilities, Title IX may apply. Unequal treatment of boys' and girls' programs - in field access, equipment quality, coaching resources - creates legal exposure.
• 501(c)(3) governance failure. Your organization hasn't filed Form 990 for three consecutive years. The IRS has automatically revoked your tax-exempt status. You may not even know until a donor's accountant asks for your determination letter.
• State concussion law violation. You allowed a player back on the field after a suspected concussion without clearance from a licensed healthcare provider. In most states, that violates the law and creates personal liability for the coach who made the call.

Reputational

Harder to quantify, harder to recover from than you'd expect. A financial shortfall can be replenished over a season or two. Trust, once damaged in a small community, can take years to rebuild.

• Social media incident. A parent films a confrontation between a coach and a referee and posts it to the local Facebook group. By Monday, the local newspaper has picked it up. This happens somewhere in American youth sports every single weekend.
• SafeSport allegation. A parent raises a concern about a coach's behavior. Whether it has merit or not, how you respond in the first 48 hours determines whether it becomes a managed incident or a story that spreads through the entire league.
• Public board dispute. Two board members fall out and take it public. Families take sides. Sponsors ask uncomfortable questions. It sounds trivial. It's one of the most common reasons organizations lose registrations.

Operational

The unglamorous risks. The ones that don't make the local news but can bring a season to a halt.

• Key volunteer departure. Your registrar has been handling enrollment for nine years and moves out of state in March. Nobody else knows the systems, the passwords, or the NGB portal. This is the most underestimated risk in youth sports - we'll come back to it in the FAQs.
• Loss of field access. The parks department decides to renovate your fields mid-season. Or a drainage issue makes the complex unusable for six weeks. Or the school district revokes your after-hours gym access because of a policy change.
• Equipment failure. A portable pitching mound with a crack in the base. An AED with a dead battery. Replacement batting cages with a twelve-week lead time. These are the risks that become crises because nobody put them on a list.

How to score risks

Not all risks are equal. You need a way to sort them, and the simplest method is a likelihood-times-impact matrix.

Likelihood scale:

| Score | Label | What it means | |-------|-------|---------------| | 1 | Rare | Could happen, but probably won't in the next 5 years | | 2 | Unlikely | Might happen once in 3–5 years | | 3 | Possible | Could happen once a season | | 4 | Likely | Will probably happen this season | | 5 | Almost certain | Happens regularly - expect it |

Impact scale:

| Score | Label | What it means | |-------|-------|---------------| | 1 | Negligible | Minor inconvenience, no lasting effect | | 2 | Minor | Small financial loss or brief disruption | | 3 | Moderate | Significant cost, temporary loss of capability | | 4 | Major | Serious injury, large financial loss, regulatory action | | 5 | Catastrophic | Life-threatening injury, organization viability at risk, criminal liability |

Multiply likelihood by impact. That gives you a score between 1 and 25.

• 1–6 (Low): Monitor it. Review at the scheduled check-in. No immediate action needed.
• 7–12 (Medium): Have a plan. Assign an owner. Put mitigations in place this season.
• 13–20 (High): Act now. This needs board attention this month.
• 21–25 (Critical): Stop and fix. Don't run the next event until this is resolved.

The point isn't precision - it's prioritization. It prevents your board spending an hour debating the color of new team banners while ignoring the fact that four background checks expired in January and nobody renewed them.

Building your register: step by step

Set aside 90 minutes at a board meeting. Bring a laptop or a whiteboard. And bring someone who works at the ground level - the volunteer who runs the snack bar, the field maintenance coordinator, the parent who helps with the youngest age groups every Saturday. They'll know which bleacher is wobbly and that the first aid kit hasn't been restocked since opening day.

Step 1: Gather the right people. Board members, your SafeSport coordinator, your head of coaching, two or three experienced volunteers. You want people who see the day-to-day reality, not just the people who attend monthly board meetings.

Step 2: Brainstorm risks using the five categories. Work through each category one at a time. Write everything down. Don't filter yet - you'll trim afterward. Most organizations identify 15–25 risks in a first pass.

Step 3: Score each risk. Use the matrix. Don't agonize over the difference between a 3 and a 4 on likelihood. If there's genuine disagreement, go with the higher score.

Step 4: Assign an owner. Every risk needs one person's name next to it. Not "the board." A person. If nobody is willing to own a particular risk, that tells you something about how seriously the organization takes it.

Step 5: Write the mitigation. Two parts: what you're already doing (existing controls) and what you need to do (additional actions). "We already have an AED at the field" is an existing control. "We need to check the AED battery monthly and replace it before it expires in October" is an additional action.

Step 6: Set review dates. Pre-season and mid-season. Put them on the board calendar. If the register doesn't get reviewed, it becomes a document in a drawer - which is worse than having nothing, because it creates a false sense that someone is managing the risk.

Example entries

Here's what a few entries might look like for a typical US youth sports organization:

| Risk | Category | L | I | Score | Owner | Mitigation | |------|----------|---|---|-------|-------|------------| | Assistant coach background check lapsed - not renewed since 2023 | Legal/Compliance | 3 | 5 | 15 | SafeSport Coordinator | Track all background check expiry dates centrally; send reminders 90 days before renewal; stand down any coach whose check lapses until renewed | | Parks department increases field fees by 35% at renewal | Financial | 2 | 4 | 8 | President | Maintain relationship with parks department; attend township recreation committee meetings; diversify revenue so field costs are below 25% of total income | | Single registrar holds all enrollment system knowledge | Operational | 4 | 4 | 16 | Vice President | Document all registration and NGB portal processes; train a second person; store credentials in organization password manager | | Player returns to game after suspected concussion without medical clearance | Safety/Legal | 2 | 5 | 10 | Head of Coaching | Train all coaches on state concussion law; post concussion protocol at every field; require written medical clearance before return | | Lightning strike during outdoor practice or game | Safety | 3 | 5 | 15 | Safety Officer | Adopt 30-30 lightning rule; purchase portable weather alert device; designate shelter locations at every field; train all coaches on protocol | | Parent posts video of sideline confrontation to community Facebook group | Reputational | 3 | 3 | 9 | President | Adopt social media policy; train coaches on de-escalation; prepare response template; display codes of conduct at fields |

That's six entries. A typical organization register will have 15–20. It shouldn't be longer than two or three pages.

How TidyHQ helps

You can build a risk register in a spreadsheet - and for the register itself, a spreadsheet is fine. But tracking the compliance items underneath it is where spreadsheets fall apart. Background check expiry dates, SafeSport training certifications, first aid qualifications, coaching licenses - somebody has to manually check dates and chase renewals. When that person is also running registration, organizing the end-of-season banquet, and dealing with the parks department about field drainage, things slip through.

TidyHQ's member profiles store compliance credentials against individual contacts, with expiry dates that trigger automated reminders before anything lapses. Your risk register says "track all background check expiry dates centrally" - that's not an aspiration, it's a feature you can set up this afternoon. You can also store the register itself in TidyHQ's document storage, attached to your board workspace, so it doesn't live on one person's laptop and disappear when they step down.

Frequently asked questions

How often should we review our risk register?

Twice a year at minimum. Once before the season - that's when you catch changes from the off-season: new activities, new facilities, board turnover, expired certifications. And once at the halfway point, when you've had a few months of reality to compare against your assumptions. If something significant happens between scheduled reviews - a serious incident, a regulatory change, a facility closure - update it immediately. Don't wait for the next review cycle.

Does our organization need a risk register if we have general liability insurance?

Yes. They serve different purposes. Insurance covers you financially after something has gone wrong. A risk register helps prevent things going wrong - or reduces the impact when they do. Most general liability policies contain a condition requiring the insured to take "reasonable steps" to manage foreseeable risks. If you file a claim and the insurer finds you hadn't identified an obvious risk, your claim could be challenged. A risk register is the evidence that you took those reasonable steps.

What's the risk most US youth sports organizations overlook?

Key person dependency, without question. Nearly every organization has someone - usually the registrar, the treasurer, or the league administrator - who knows how everything works. The bank account process, the NGB registration portal, the background check vendor login, the parks department contact, where the field lining equipment is stored. When that person leaves - and eventually they always do - the organization loses months of operational capability. Almost nobody puts this in a risk register because it feels awkward to plan for someone's departure while they're still there. It's not awkward. It's responsible. Document what they know. Train a second person. Store credentials centrally.

You don't need a risk management certification. You need a table, ninety minutes with your board, and honest answers about what could go wrong. That's a risk register. And it's one of the most useful things a volunteer board can produce - not because anyone will read it with admiration, but because the process of creating it forces you to think about the things you've been hoping won't happen.

References

• U.S. Center for SafeSport - Athlete safety risk management and compliance resources
• Aspen Institute Project Play - Youth sports organization management and safety research
• National Council of Nonprofits - Risk management guidance for nonprofit organizations
• Korey Stringer Institute - Heat safety and emergency action planning for youth sports
• National Council of Youth Sports - Safety standards and risk management frameworks for youth sports organizations