You cannot protect what you have not identified. A risk assessment maps your assets, the hazards that threaten them, and the impacts of each scenario. It tells you exactly where to focus your preparedness efforts.

⚠️ The “It will not happen to me” bias. Every business faces hazards, from fires and floods to cyberattacks and supply chain disruptions. The businesses that survive are the ones that assessed their risks honestly and acted on what they found.

Disclaimer: The information provided in this article is for general informational and educational purposes only. It is not intended as, and should not be considered, professional or legal advice. Consult a qualified professional for your specific situation.

---

The Readiness Audit

Do you know what threatens your business?

• 🟢 Green: You have completed a risk assessment and identified your highest-priority risks.
• 🟡 Yellow: You have a general sense of your risks but no written assessment.
• 🔴 Red: You have never thought about what could shut your business down.

If you are Yellow or Red, execute Phase 1 immediately.

---

Phase 1: List Your Assets

Goal: Identify everything your business depends on.

• People: Employees, customers, and visitors.
• Property: Facilities, machinery, equipment, and vehicles.
• Operations: Raw materials, finished goods, and information technology.
• The Rule: Group assets as needed, but assess highly valued or critical assets separately.

The Takeaway: Your assets are what you are protecting. List them first.

---

Phase 2: Identify Hazards

Goal: Determine what could threaten each asset.

• The hazards: Fire, flood, earthquake, wind, cyberattack, supply chain disruption, and more.
• The scenarios: Consider both high-probability, low-impact and low-probability, high-impact scenarios.
• The rule: Multiple hazards can impact each asset, so you may need more than one row per asset.

The Takeaway: Every asset faces hazards. Identify them all.

---

Phase 3: Rate Probability and Impact

Goal: Prioritize your risks.

• Probability: Rate the likelihood of each scenario as low, medium, or high.
• Impact: Rate the impact on people, property, operations, environment, and your business entity.
• The rating: Combine probability and the highest impact rating into an overall hazard rating.

The Takeaway: The rating tells you where to focus your limited resources.

---

Phase 4: Build Your Program

Goal: Turn the assessment into action.

• The coordinator: Appoint a program coordinator to lead the effort.
• The committee: Build a committee with representatives from key departments and functions.
• The partners: Include external representatives like fire, EMS, and vendors.

The Takeaway: A risk assessment is only useful if someone acts on it.

---

The Essential Kit Checklist

• Assets: List people, property, operations, and information technology.
• Hazards: Identify the hazards that threaten each asset.
• Scenarios: Consider high and low probability scenarios.
• Ratings: Rate probability and impact for each scenario.
• Coordinator: Appoint a program coordinator.
• Committee: Build a committee with key representatives.

---

Scenario Planner (Contingencies)

“My business is too small for a formal risk assessment.” The trap: assuming formal means complex. The fix: even a simple list of assets and hazards is a risk assessment. Start small and build from there.

“I will deal with risks when they happen.” The trap: reacting instead of preparing. The fix: a risk assessment identifies vulnerabilities you can fix now, before they become disasters.

---

Next: Read The Business Continuity Checklist to consolidate this series into a printable script.