A small company does not need a risk department to run a proper risk assessment. It needs an afternoon, the few people who know the business, and a template simple enough that filling it in feels like clear thinking rather than paperwork. This is that template — a worksheet you can copy, plus a starter catalog of the risks most small businesses actually face, so you are adapting a list rather than staring at a blank page.
If you want the full method — how to run the workshop, who to invite, and the quarterly rhythm that keeps it alive — the companion guide on risk management for small companies walks through all of it. Here we focus on the artifact: the assessment template and how to fill it.
The assessment template
One row per risk. Seven columns, and not one more.
| Column | What it holds |
|---|---|
| Risk | One sentence: what could happen, and why it would hurt. |
| Likelihood (1–5) | How probable in the next year or two. 1 = rare, 5 = expected. |
| Impact (1–5) | How severe if it happens. 1 = annoying, 5 = threatens the company. |
| Score | Likelihood × impact (1–25). This ranks the list. |
| Owner | The one person responsible for doing something about it. |
| Response | The single first action — and whether you avoid, reduce, transfer, accept. |
| Deadline | When that first action is due. |
That is the entire template. You do not need inherent-versus-residual ratings, categories, or a status workflow yet — a small company running its first assessment is better served by a shortlist that gets acted on than by a form that impresses. You can grow into the fuller risk register template once the habit is established.
How to score without overthinking
Two quick judgments per risk, each on a 1–5 scale. You are ranking, not forecasting, so speed beats false precision.
Likelihood asks how probable the event is within a fixed window — one to two years works well for a small business. Fix the window in your head before you start, or every rating drifts.
Impact asks how bad it would be if it happened, rated on the worst dimension it touches: money, survival, reputation, or the ability to keep operating. Rate the plausible serious case, not the theoretical apocalypse. Anchor the top of the scale to survival — 5 means "this could end the company" — because for a small business, unlike a large one, that ceiling is real.
Multiply the two, sort by the result, and keep the top five to ten. Managing ten risks well beats cataloguing a hundred. One rule during the scoring: the boss speaks last, because founder optimism is the strongest bias in a small company's room.
A starter catalog of small-business risks
Most small-company disasters come from a short, predictable set of blind spots. Use this list to prime the workshop — read each item and ask "does this apply to us, and how badly?" The example ratings are typical starting points, not answers; yours will differ.
Customer concentration — one client is more than 20–30% of revenue, and losing them would force cuts. Often high impact, moderate likelihood.
Key-person dependency — the founder, lead developer, or top salesperson holds knowledge or relationships nobody else has, and their departure or long illness would stall the business. High impact, moderate likelihood.
Cash-flow and late payment — a big client pays late or defaults and turns their problem into your liquidity crisis. Cash-flow problems are among the most common causes of small-company failure. High impact.
Ransomware and untested backups — an attack encrypts your systems, and the backup you have never test-restored turns out not to work. High impact, and more likely than most owners assume.
Supplier single point of failure — one supplier with no ready alternative fails, and you cannot deliver. Impact depends on how central they are.
Data-protection gap — personal data is mishandled or exposed, triggering a reportable breach and possible penalties. Rising likelihood as obligations tighten.
Critical equipment or premises — fire, water, or a machine with a long replacement lead time halts operations. Low likelihood, potentially severe impact.
Loss of a required certification or contract clause — a key customer suddenly requires a certification or a compliance standard you do not hold. Moderate, and often sudden.
Regulatory change — a new rule in your sector demands changes you are not ready for. Sector-dependent.
Reputational incident — a public complaint, review, or social-media event damages trust faster than you can respond. Low likelihood, fast-moving impact.
Sweep this list, add anything specific to your trade, and you will usually reach twenty to forty raw items — plenty to work with.
Turning the assessment into action
An assessment that ends with a ranked list and nothing else is a diagnosis with no prescription. For each of your top five to ten risks, pick one of the four responses and commit to a single first measure with an owner and a date.
Small-business treatments are refreshingly cheap. Key-person risk: a documentation sprint and a named deputy. Customer concentration: a sales push aimed squarely at the second tier. Ransomware: an offline backup and one real restore test — an afternoon and a hard drive. Cash-flow: a credit line arranged before it is needed, and tighter invoice terms. Fire and liability: insurance matched to today's business, not the one from five years ago. The realistic constraint is that you can seriously work on perhaps three to five measures per quarter, so choose a short list that gets done over a long one that impresses.
Keeping it alive
An assessment done once and filed away describes a company that no longer exists within a year. The maintenance is light: once a quarter, for about an hour, the same group asks three questions — has anything changed, did the measures get done, and is there anything new? That is roughly four hours a year of shared attention, and it compounds, because after a few cycles people start asking those questions reflexively in daily decisions.
The place you keep the list matters less than that it stays visible and remembered. A shared tool beats a file on someone's laptop precisely because it keeps its history and reminds people when a review is due without anyone playing nag. EasyRisk.io gives a small company exactly that — a shared, always-current list with history and review reminders built in — and it is free to start, so the template above becomes a living register rather than a document that quietly ages.
Copy the seven columns, walk the starter catalog with the people who know the business, keep your top ten, and give each an owner and a date. That is a complete risk assessment, and few afternoons in business pay off better.
Frequently asked questions
What is a risk assessment template for a small business? A simple worksheet with one row per risk and a handful of columns: a one-sentence risk description, a likelihood and an impact rating on a 1–5 scale, a score to rank by, an owner, a single first response, and a deadline. It is deliberately lighter than a full corporate register — the goal is a ranked shortlist that gets acted on, not a form that impresses.
How do you do a risk assessment for a small company? Gather the four to eight people who collectively know the business for one afternoon, and ask what could threaten the company in the next one to three years. Walk a starter list of common small-business risks, rate each for likelihood and impact, keep the top five to ten, and give each one an owner and one concrete first action. No committee, policy, or software is required to begin.
What risks should a small business assess? The predictable big ones: customer concentration, key-person dependency, cash-flow and late payment, ransomware and untested backups, supplier single points of failure, data-protection gaps, critical equipment or premises, and any certification or regulatory change your sector may bring. Start from that list, then add whatever is specific to your trade.
How often should a small business review its risk assessment? About once a quarter, for an hour, with the same group — calendared rather than left to "when things calm down." Check what changed, whether the measures got done, and what is new. Four hours of shared attention a year keeps the assessment honest and current.