Every business, regardless of size, faces losses if the risks it carries are not recognised and properly managed. A robust risk management plan is therefore essential to reduce your business’s vulnerability.

Here’s how to create one in five simple steps.

1. Ask the big questions

A good way to get started is to ask yourself some key questions about your business. For example – how would your business manage if certain events were to happen, such as serious loss of power or internet, loss of key customers, or catastrophe such as fire or flood?

This enables you to see the big picture and to decide what matters most in your business.

Feedback and input from your stakeholders (e.g. employees, contractors, clients, investors) can be very valuable here, as it brings different viewpoints and expertise into the mix. It could also highlight risks you’d not previously considered as well.

2. Identify significant hazards and risks

This step involves listing the hazards that could lead to harm or loss. The idea here is not to seek out every little thing that could go wrong, but to pinpoint those that could have a substantial impact.

To do this, you can use a mix of observations, consultations, past feedback, complaints, incidents, audits, and/or workplace safety reports.

Many of the hazards identified are likely to be about potential harm to physical safety, such as slip or trip hazards. But they could also be based around finances, mental health, workplace tasks, your workforce, legal issues, security, perils, access to supplies or services – or something else altogether depending on your particular business.

3. Evaluate the risks

Once you’ve identified your important hazards and risks, you should analyse the likelihood of each of them occurring as well as any potential consequences.

A common method for this is to use rating system, for example:

• Likelihood – 1 for low likelihood to 4 for highly likely.
• Consequence – 1 for low up to 4 for severe.

This enables you to calculate the risk level of each one, using the formula:

• Risk rating = likelihood x consequence.

4. Control the risks

There are several ways to control risks. Total removal of a hazard gives the best protection, but where this is not possible, you should consider substitution (e.g. using safer processes), isolation (such as cordoning off dangerous zones) or other controls such as use of personal protection equipment.

Getting the right insurance cover is an important part of risk control as it provides financial protection in case harm or loss does occur.

This includes cover for property, liability, workers’ compensation, cyberattacks, and business interruption to enable you to keep functioning following a catastrophic event.

5. Do regular reviews

Regular reviews of your plan – such as at the end of each year, or whenever there is a significant change in your business – is important for keeping on top of your game. It also helps ensure your risk plan remains robust, from one year to the next!