How to Assess Business Risks

1. Set the scope. Name the objective, activity, product, or change being assessed. Include the people, assets, customers, dependencies, and time period that matter.
2. Write specific risk statements. Describe a cause, an uncertain event, and a consequence. For example: “If the sole supplier cannot deliver, the launch may be delayed and existing customer commitments may be missed.”
3. Record current controls and evidence. Note what already reduces likelihood or impact, who owns it, and what evidence shows the control is operating. Keep assumptions separate from verified information.
4. Prioritize consistently. Define likelihood and consequence scales before rating items. Apply the same definitions to each risk and explain ratings that rely on limited evidence.
5. Choose a response and review trigger. Reduce, avoid, transfer, or accept a risk as appropriate. Assign an owner, a next action, and a signal or date that should prompt a review.

Hypothetical example: a planned service depends on an input from one supplier. The cause is single-source dependence, the uncertain event is a disruption or delayed delivery, and the consequence could be a delayed launch or an interruption to service. These are possible outcomes, not a prediction that the supplier will fail.

The assessment could check contract terms, lead-time history, substitute availability, stock policy, and the time needed to qualify another source. Possible controls include a contingency supplier or a staged launch, if those are practical. The risk owner should record which evidence is missing and when the assessment needs review.

A likelihood-by-consequence matrix can help a team sort a long list for discussion. Define what each scale means for this decision, record the basis for each rating, and consider how existing controls change the assessment. Ordinal labels such as “low,” “medium,” and “high” do not create precise probabilities or comparable financial forecasts.

If an outcome depends on a sequence of choices or uncertain branches, a scenario plan or decision tree may expose assumptions that a single risk score hides. For workplace health and safety, use applicable legal guidance and competent professional advice; a business prioritization tool is not a compliance assessment.