Business Risk Assessment: Financial Impact and Response Plan

A business risk assessment identifies events that could prevent an objective, estimates their impact and likelihood over a defined horizon, and assigns a response owner. Use a risk register to turn the assessment into dated decisions, not just a colored score.

All amounts and operating results below are original fictional teaching examples in USD. They are not customer results, industry averages or forecasts. Use your own dated records and applicable accounting policies.

Define the objective before listing risks

Start with an observable objective: for this fictional workshop, deliver accepted jobs over the next quarter while keeping available cash above a chosen $6,000 floor. Name the horizon and which operations are included. “Economic risk” is too broad to assign; “the sole component supplier fails to deliver before a committed customer date” identifies an event, a dependency and an exposure.

Separate the cause, event and consequence. An unreliable supplier is a cause; a missed delivery is an event; replacement freight, idle labor and a delayed customer receipt are consequences. Record existing controls before estimating the remaining exposure. A business risk register can sit within enterprise risk management, but this small-business worksheet is not a certified ERM or cybersecurity standard.

Build a register that can produce an action

The probabilities are deliberately uncertain assumptions, not observed frequencies. Add evidence dates, control status and an assessment confidence note. A control described as planned is not an effective control until implemented and tested. Keep inherent exposure and residual exposure as separate versions, with a reason for any estimated reduction.

Calculate exposure without calling it a reserve

At a selected 15% probability and $16,000 loss, the supplier event has a simple probability-weighted exposure of $2,400 per quarter. If a tested backup arrangement reduced the assumed probability to 8%, holding severity constant, exposure would be $1,280. The modeled reduction is $1,120; less a $600 control cost leaves $520 in this narrow comparison. It does not prove the control will work or that spending $600 is the best decision.

Do not multiply an ordinal “likelihood 4” by an ordinal “impact 5” and label 20 as dollars. Do not add overlapping consequences twice, such as total lost sales plus the full profit lost on those same sales. Identify which costs stop when delivery stops. Consider correlated events: one outage could delay both the supplier and the customer. A simple sum of independent-looking scores can conceal that dependency.

Stress the dated cash position separately

Suppose opening available cash is $14,000. Planned receipts of $18,000 and payments of $20,000 give $12,000 closing cash. A receipt delay of $8,000 gives $4,000, below the selected $6,000 floor by $2,000. The customer may still owe the money; moving its clearing date is a funding problem, not automatically an $8,000 permanent loss. Re-run the following periods when the receipt clears.

Combine plausible disruptions and test payment order near the low point. A probability-weighted loss cannot tell you whether payroll clears on Friday. Use the financial contingency plan for response funding and the dated cash-flow forecast for timing.

Choose, test and review the response

Compare avoiding the activity, reducing exposure, transferring a defined part or consciously accepting the residual risk. Check the actual contract or insurance scope before treating a transfer as effective. Record cost, implementation date, responsible person and evidence of a test. A second supplier that has not qualified the component is still an unresolved dependency.

Review when a trigger occurs and at a scheduled cutoff. Preserve the prior estimate so a changed forecast cannot erase the original decision. Close an action only after its evidence exists; keep the risk open if the underlying exposure remains. Tie the major unresolved conditions to the feasibility decision rather than assigning every risk a low score to justify proceeding.

Download the editable worksheet

Download the printable HTML worksheet. It contains the completed case and a separate blank working record. It does not calculate automatically. Edit in your browser, then print or save a completed copy before closing; your edits are not sent to MyBreakeven.

Sources and scope

Primary references below support the stated definitions or framework. The worked case, numbers and decision records are original MyBreakeven material. Reviewed November 6, 2026; no external professional sign-off is claimed.

• Canada School of Public Service: risk-register framework
• NIST: scenario and risk-register context; cybersecurity-specific scope