Assessing business risks

Before you can take action to reduce risk in your business, you need to work out what the risks are. You also need to work out which ones are most urgent.

Risk assessment usually involves steps such as:

  1. Identify – note the risks your business may face.
  2. Analyse – work out the level of risk and which ones are most urgent.
  3. Evaluate – compare the risk against set risk criteria to decide what action to take.

1. Identify the risks

Working out the risks to your business could be as easy as thinking about what could go wrong, and how and why it could happen. You might also need to do some research into:

  • past events and risks
  • possible future changes to your business environment, such as changes in economic trends (find out how to conduct market research and industry research)
  • social and community issues that could affect your business.

To identify risks, you can also:

  • look at hazard logs, incident reports, customer feedback and complaints, and survey reports.
  • review audit reports such as financial audit reports or workplace safety reports.
  • do a Strength, Weaknesses, Opportunities and Threats (SWOT) check for your business (download our marketing plan template for instructions on how to do this).
  • discuss business issues with your staff, customers, suppliers and advisers.

It's important to look at all types of risks, including opportunity-based risks.

Example: Jane's story

Jane runs a catering business and is thinking about buying a new delivery van. She works out the risks of buying a van, such as extra expenses if the van breaks down.

However, she should also focus on the other opportunities she could have taken with the same amount of money. Her other choices could be to buy new equipment or to hire more staff.

If she buys a van instead of hiring more staff, she risks missing out on the benefits of having more staff, such as faster customer service in her business. She should try to compare the future impacts of each possible choice before making her decision.

2. Analyse the risks

After identifying the risks to your business, it’s time to work out which ones are urgent. To analyse the risks related to an event (such as a competitor moving into the same street), you should first look at:

  • the damage that the risk would cause
    (for example, the risk of fewer customers means lower sales for your business)
  • the likelihood of the risk happening
    (for example, think about how similar the competitor's business is to yours, and how loyal your customers are)

Work out a rating system for damage and likelihood. For example, you could have:

  • ratings of 1 to 4 for damage (1 for slight damage, and 4 for severe damage)
  • ratings of 1 to 4 for likelihood (1 for not likely, and 4 for extremely likely)

Finally, to work out the level of risk for an event, use this formula: risk level = damage x likelihood

Based on our example above, the lowest risk level you could get is 1 (1 x 1), and the highest risk level you could get is 16 (4 x 4). You can use the risk levels to rank your risks from least urgent to urgent.

Find out more about rating systems and how to analyse and evaluate the impact of risks on the Business Queensland website.

3. Evaluate the risk

To evaluate a risk, you should compare the level of risk for various events against your risk criteria (find out how to set your risk criteria when you design a risk management plan). This process helps you decide whether to accept the risk or not. You should also check if your existing risk management methods are enough to accept the risk.

When to accept risk?

Sometimes businesses choose to accept risks and not spend any resources on avoiding them. You might decide to accept a level of risk for the following reasons:

  • The cost of treatment is much higher than the potential results of the risk.
  • The risk level works out to be very low.
  • The benefits of taking the risk greatly outweighs the possible damage.

Example: Petra's story

Petra runs a clothing retail store. She is worried about the rise in theft during the busy end of year period. To manage the rise in theft, she decides to do a detailed assessment.  She works out that she lost $5000 to theft last December. As a result, she has security cameras installed in her store which leads to a 40% reduction in loss due to theft.  She works out the expected loss at:

Expected Loss (current year) = $5000 – ($5000*40%) = $3000

She expects similar levels of theft this year. To reduce the risk of theft even more, the next step will be to hire a security guard during working hours. The cost of hiring a security guard for a month will be $4000 which is more than the expected loss, so she decides to accept the risk.

Instead of hiring a security guard, Petra meets with her staff to brainstorm possible ways to reduce the theft. They decide to move the shelves  so staff can see customers more clearly. She also hires more staff for peak times to check on theft.

What to do next

Thanks for your feedback. If you have any ideas on how we can improve, we'd love to hear them.

Please provide your comments in the feedback form.

You might also be interested in