How to Run a Business Risk Assessment

A business risk assessment helps you identify what could go wrong in your business, how likely it is, and what the impact would be - so you can take action before a risk becomes a problem. You do not need to be a risk specialist to do this. This guide gives you a practical framework you can use today.

Why every SME needs a risk register

Investors, lenders, insurers and some contract counterparties will expect to see evidence that you manage risk systematically. Beyond external expectations, a risk register is simply good business - it surfaces issues before they become crises and helps you prioritise your time.

Step 1 - Identify your risks

Start by brainstorming risks across the main categories. Involve your team - they often see risks you don't.

• Operational risks: key person dependency, supplier failure, IT outage, fraud
• Financial risks: customer concentration, late payment, FX exposure, unexpected cost increases
• Compliance risks: regulatory change, licensing requirements, data protection, employment law
• Reputational risks: negative reviews, social media, supplier conduct, product quality
• Strategic risks: market changes, new competition, technology disruption, Brexit impact

Step 2 - Score each risk

For each identified risk, assign two scores from 1–5:

• Likelihood: how probable is this risk materialising? (1 = very unlikely, 5 = very likely)
• Impact: how serious would the effect be if it occurred? (1 = minor inconvenience, 5 = business-critical)
• Risk score = Likelihood × Impact. Scores of 15–25 are high priority; 8–14 medium; 1–7 lower priority.

Step 3 - Assign controls and owners

For each risk, document:

• What control is already in place to reduce likelihood or impact?
• What further action should be taken?
• Who is responsible (risk owner)?
• Target date for any action required

Step 4 - Review regularly

A risk register is not a one-time exercise. Review it quarterly, after any significant business change, and whenever a risk materialises. Assign a single owner - typically the founder or a senior leader - to maintain it.

As your business grows, consider a simple risk committee (even two people meeting quarterly) to provide oversight and accountability.

Back to all guides