Risk assessment

To identify risks, think about what could go wrong in your business; consider past events and risks, and possible future changes within your business or in the wider community, that could impact your business. For each potential issue think of how and why it could happen. Research may help to create a thorough assessment. 
 
Your research may include:

• checking incident reports, hazard logs, customer feedback and complaints, and survey reports
• review audit reports, for example workplace safety reports or financial audit reports
• consider your business's strength's, weaknesses, opportunities and threats (SWOT) - see the marketing plan template for instructions on how to do this
• discuss issues with stakeholders i.e. your staff, customers, suppliers and advisers

After identifying the risks to your business, work out each item's level of risk and which need to be attended to urgently.
 
Analyse risks related to an event by considering:

• the damage the risk would cause
• the likelihood of the risk happening

For example if a competitor was moving onto the same street (risk), you may receive fewer customers (damage). Consider how similar the competitor's business is to yours, and how loyal your customers are (likelihood the damage will occur).

Work out a rating system for damage and likelihood. For example, you could have:

• ratings of 1 to 6 for damage (1 for slight damage, and 6 for severe damage)
• ratings of 1 to 6 for likelihood (1 for not likely, and 6 for extremely likely)

 
The formula: risk level = damage x likelihood, will help you work out the level of risk for each event.

Some risks require immediate action whilst for others taking action may be more costly than just allowing that risk to occur. Evaluating the risk helps you decide whether or not to accept the risk.
 
Evaluating a risk is simply comparing the level of risk for each event against your risk criteria.
 
You may choose to accept a risk if:

• the benefits of taking the risk greatly outweigh the possible damage
• the event has a low risk level
• the cost of avoiding the risk is higher than the cost of incurring the risk itself.