How to Do a Risk Assessment [Step-by-Step Guide]

Some risk is normal when you’re a business owner. The challenge is what to do about it. Fully assessing what your risks are, what aspects of your business could be affected and what to do about each exposure can be a big job. But the right process makes tackling risk easy.

A risk assessment is a simple process any business can use to discover risks and take effective action, saving you money, time and heartache. Here’s a step-by-step guide for how to do a risk assessment for your business.

What to Know About Conducting a Risk Assessment

Hazards and exposures combine together to create risk, and today’s businesses face numerous hazards and risks. Yet not all are equal. Some scenarios have a low likelihood of occurrence, while others are likely to have little impact on your business, even if they do occur.

Where a risk assessment really shines is in its ability to guide you to focusing on the hazards, risks and scenarios that do matter. These are the events that are more likely than not to occur and be a problem for your business when they do.

Ready.gov offers great resources to help businesses conduct a risk assessment, including a Business Risk Assessment Table you can download and use to get started with your business’s own risk assessment. Here’s how to use this kind of a resource to get the most out of conducting your own risk assessment.

Step-by-Step Guide to Risk Assessment

In general, a risk assessment is comprised of 8 key steps. Follow this process to conduct your assessment.

Step 1: Compile a List of Assets

Your business assets include all the resources owned or controlled by your business that are of economic value and expected to provide a future benefit to the business or its operations. Assets can be tangible property, such as cash, real estate, inventory or equipment, or intangible, such as human resources or intellectual property.

Start your risk assessment by compiling a list of the assets important to your business. You likely have more assets than you think, so it’s best to organize them in writing. The kinds of assets you have can also vary depending on your specific business operations, but many business risk assessments will list assets that include:

Facilities
Personnel
Inventory
Equipment
Machinery
Technology
Finished goods
Raw materials

Step 2: List the Hazards for Each Asset

A hazard is something that increases the likelihood or severity of an insurable loss. It could be a particular condition, behavior or circumstance. For example, a building fire causes a loss, but the building’s outdated wiring would be a hazard that makes a damaging fire more likely.

For each asset that you identified above, there will be at least some kind of hazard that could impact it, and some assets may have multiple hazards. List the hazards for each asset. Most business hazards fall into several general categories. It can be helpful to start with these hazards and add additional ones as needed. Common hazard categories include:

General Workplace Hazards

Housekeeping
Slip, trip and fall
Electrical
Equipment
Machinery
Fire safety
Workplace violence

Health Hazards

Chemical
Biological
Physical
Ergonomic

Environmental Hazards

Seasonal weather
Emergency weather events
Other natural phenomena

More resources for identifying hazards are available at OSHA and Ready.gov websites.

Step 3: List Possible Hazard Scenarios

A hazard scenario is a short description of how a particular hazard may contribute to an insurable loss. Scenarios address key questions about an incident, such as:

Who or what is the cause of the loss?
What hazard contributes to loss?
What asset or assets are impacted?
What occurs in the incident?
What time or duration the loss involves?
What impact the loss has on the business?

An example of a hazard scenario could be: Outdated wiring leads to a small electrical fire that impacts operations for twelve weeks.

In this step of your risk analysis, brainstorm scenarios in which the hazard may occur. Be sure to include scenarios with:

A low impact but high probability of occurrence.
A high impact but low probability of occurrence.

Step 4: List Current and Potential Mitigation Strategies

In many scenarios, there are opportunities to:

Reduce the severity of a loss
Prevent its occurrence altogether

These mitigation efforts can play an important role in your business’s risk management efforts. Mitigation efforts can focus on common problems that are easily prevented, as well as less common problems that it’s smart to protect against, due to their severity, potential disruption or high cost.

In this step of the risk analysis, list mitigation strategies that can prevent or minimize potential losses for each hazard scenario. You likely already have some mitigation procedures in place, so be sure to note these current efforts in the analysis. However, additional solutions are likely available. To help identify fresh mitigation strategies, assess each asset’s vulnerabilities and weaknesses and what could be done to protect or strengthen them.

Step 5: Assign a Probability to Each Scenario

As OSHA notes, risk is the product of a hazard and your exposure to that hazard. Thus, not all hazards are something every business should worry about, nor are all exposures worth the cost, time and effort required to protect against them. It’s best to focus on what is:

Most likely
Most impactful

To start, use this step of the risk analysis to estimate the probability of occurrence for each scenario identified above. Decide how likely it is that each scenario may occur. A scale of “low,” “medium” and “high” probability offers enough detail for the purposes of this analysis.

Step 6: Analyze the Impact on the Business

Business impacts from a loss can be wide-ranging. Some incidents can impact your entire operation, others may be limited to one segment of the business. Impacts can also be mild, moderate or severe, and some parts of your business may feel a loss more than others.

Analyze the various impacts a potential scenario may cause to your business in this part of the risk analysis. It’s recommended that businesses consider the impact on your:

People
Property
Operations
Environment
Business Entity

Use the same scale of “low,” “medium” and “high” impact for each of the five areas of your business. A business impact analysis can also be conducted to help you gauge the impact on your operations.

Step 7: Assign an Overall Hazard Rating

At this point in the risk assessment, it’s time to begin drawing some conclusions about the hazards you’ve identified for your business. You’ll start by assigning each hazard an overall hazard rating.

The hazard rating has two parts:

The first deals with the likelihood of loss. Note the “low,” “medium,” or “high” probability of occurrence rating given to each hazard scenario in Step 5.
The second part deals with the impact of the loss. For each hazard, pair the probability of occurrence rating with the highest impact rating assigned in Step 6, either “low,” “medium,” or “high,” across the categories of People, Property, Operations, Environment or Business Entity.

The combination of the two, the probability of occurrence and its greatest impact, gives your business a better idea of the true risk that hazard presents to your business and its operations. With this information in hand, you can start to make some decisions and take preventative action.

Step 8: Review Scenarios with High Risk

In the last step of the risk assessment, you’ll review your hazards and scenarios, looking for the ones that pose the greatest risk to your business. Any overall hazard ratings from Step 7 that rise to the level of “medium” or “high” risk deserve special attention.

These are the areas of focus where your risk mitigation and management efforts make the most sense and have the greatest likelihood of positively benefiting your business. Consider what actions can be taken to reduce the probability of the hazard scenario occurring, minimize the impact to your people, property, organization, environment or business entity if it does occur, or positively benefit both the probability of an occurrence and its impact.

Further steps can include identifying action steps for each hazard and setting deadlines for their completion. The risk assessment can also be used to note the date that these actions were completed for documentation purposes.

Conclusion

A risk assessment is a great first step to prioritizing and managing the many risks your business faces. However, not all risk can be eliminated, which is why having the right insurance protection is key. Insurance from the FASTSIGNS® Insurance Program is designed for your business and industry, helping you protect what matters most.

With products to cover your employees, property, financial security and more, Lockton Affinity’s FASTSIGNS Insurance Program has everything you need to protect your franchise. Our team is well-versed in the needs of FASTSIGNS franchisees like you. Whether you have a simple question or need a full policy review, we’re here to help. Visit us online or call (866) 879-9024 to learn more.