Every small business runs on a handful of things that must keep working: a key supplier, a payment system, one person who knows how the invoicing runs, a single office or website. Most owners know some of these are fragile, but the worry stays in their head and nothing gets done. An operational risk assessment moves that worry onto paper, ranks it, and turns it into actions. You do not need a consultant or special software. You need a few hours and an honest conversation.
What is an operational risk assessment?
It is a structured way to ask three questions: what could go wrong in our day-to-day operations, how likely is it, and how much would it hurt? The answers let you spend your limited time and money on the few risks that really matter instead of trying to guard against everything.
Step 1: List the risks
Gather the people who actually run the work, not only management, and brainstorm. Walk through each part of the business and ask “what would stop us here?” Useful categories to prompt ideas:
- People. Key-person dependency, sudden absence, turnover, skills gaps.
- Suppliers and partners. A single supplier, late deliveries, a vendor going out of business.
- Technology and data. System outages, lost files, weak passwords, no tested backups.
- Process and quality. Manual steps, errors, missing documentation.
- Finance. Late-paying customers, cash-flow gaps, reliance on one large client.
- Premises and external events. Fire, flood, power cuts, bad weather, regulatory change.
Write each risk as a clear sentence with a cause and an effect: “Our only warehouse supplier fails to deliver, so orders ship late.” Aim for 15 to 30 risks at first. Do not filter yet.
Step 2: Score likelihood times impact
Score every risk twice on a 1 to 5 scale. Likelihood: 1 means rare, 5 means almost certain within a year. Impact: 1 means a minor annoyance, 5 means a serious threat to revenue, safety or survival. Multiply the two numbers to get a score from 1 to 25. Define what each number means in your business, for example impact 4 as “more than a week of lost sales,” so scores stay consistent between people.
- 1 to 6: low. Monitor.
- 8 to 12: medium. Plan a sensible response.
- 15 to 25: high. Act first.
Scoring is judgment, not science. If two people disagree by more than one point, discuss why; the disagreement often reveals something nobody had said out loud.
Step 3: Build the risk register
A risk register is simply a table with one row per risk. A spreadsheet is enough. Useful columns:
- ID and short description of the risk.
- Likelihood, impact and total score.
- Owner.
- Mitigation actions and due dates.
- Current status and the date of the last review.
Sort by score so the top of the page shows what needs attention now.
Step 4: Assign owners and choose mitigations
Every risk needs one named owner, a person rather than a team. The owner does not fix everything alone; they make sure someone is watching the risk and that the agreed actions happen. For each high and medium risk, choose a response:
- Avoid. Stop the activity that creates the risk.
- Reduce. Lower the likelihood or the impact, for example by cross-training staff or adding a second supplier.
- Transfer. Move part of the risk elsewhere, through insurance or a contract clause.
- Accept. Consciously do nothing because the cost of acting exceeds the risk. Write it down so it is a decision, not an oversight.
Make actions specific and dated: “Test the backup restore by 30 November” beats “improve backups.” After mitigation, re-score the risk to see the residual level you are living with.
Step 5: Set a review cadence
A register that is never reopened gives false comfort. A practical rhythm for a small business:
- Monthly: a 20-minute check of the top risks and open actions.
- Quarterly: re-score everything and add new risks.
- After any incident or big change: a new supplier, a new system, a lost client. Update the register straight away.
A quick example
A ten-person online shop lists “the only person who packs orders is ill” (likelihood 4, impact 4, score 16) and “payment provider outage” (likelihood 2, impact 5, score 10). The first is high: the owner, Dana, cross-trains a second person by the end of next month. The second is medium: she writes a short fallback plan and checks the provider’s status page monthly. Two clear actions beat a long list of vague worries.
Common mistakes
- Scoring everything high. If all risks are urgent, none is.
- Listing only big disasters. Small, frequent problems often cost more over a year.
- No owner. A risk that belongs to everyone belongs to no one.
- Writing it once. The business changes, so the register must too.
Start small: one workshop, one spreadsheet, five actions. If your tasks and KPIs already live in FulcrumGrid Command Center, you can track risk actions and review dates next to them, so mitigation work does not get lost behind daily tasks. A simple assessment that you actually review will protect you better than a perfect one that sits in a drawer.
Frequently asked questions
How often should a small business review its risk register?
Check the top risks and open actions monthly, re-score the whole register quarterly, and update it right away after any incident or major change such as a new supplier or system.
How many risks should be in a risk register?
For a small business, 15 to 30 is a good start. Keep only risks you can describe clearly and score; you can add more later as the register matures.
What is the difference between likelihood and impact?
Likelihood is how probable the event is within a set period, usually a year. Impact is how much damage it would cause if it happened. Multiplying them gives a score for ranking.
Do I need special software for a risk assessment?
No. A spreadsheet with columns for score, owner, action and review date is enough. What matters is that someone owns each risk and the register is reviewed regularly.
FulcrumGrid Command Center
Keep risk actions visible
FulcrumGrid Command Center lets you track projects, KPIs and follow-up actions in one place, so mitigation tasks and review dates do not slip.