Enterprise risk registers built for large corporations rarely translate well to a smaller business — they demand more reporting overhead than the organisation can sustain, and the exercise stalls after the first workshop.
A more durable starting point is to list the handful of events that would actually stop the business from operating for a week or more, rank them by how likely and how costly they are, and assign one owner per risk who checks in on it monthly.
The goal is not a comprehensive framework on day one. It is a living list that gets reviewed often enough to catch changes in exposure as the business grows.