Run a Basic Business Risk Assessment Without Hiring a Consultant

TL;DR — You can run a useful first-pass risk assessment with a spreadsheet, a 60-minute meeting, and a short list of business assets, threats, and controls (safeguards). The single most important step is to score risks consistently with one simple 1-5 scale for likelihood and impact, then sort by the highest combined score. Reading time: ~5 min

Goal

When you are done, you will have a completed risk register (a table of risks) that lists your important systems and business processes, the main things that could go wrong, the current safeguards in place, the top risks by score, the person responsible for each one, and the date you will review it again.

Prerequisites

• A spreadsheet tool: Microsoft Excel, Google Sheets, or LibreOffice Calc
• Access to your main business systems and process information
• One person who knows operations and one person who knows your software or IT setup
• 45-60 minutes of uninterrupted time
• A place to save the finished file where your team can find it
• The following information at hand:
  • your key systems and vendors
  • your customer data types (for example: names, emails, payment data, support tickets)
  • your backup method
  • your admin account list
  • your incident contacts

Steps

Step 1: Create the risk register sheet

Open your spreadsheet tool and create a sheet with exactly these column headers in row 1:

A1 Asset or Process
B1 What could go wrong
C1 Cause
D1 Existing controls
E1 Likelihood (1-5)
F1 Impact (1-5)
G1 Risk score
H1 Owner
I1 Action needed
J1 Due date
K1 Review date

If you prefer to paste rows directly, copy this CSV into cell A1 of a blank sheet:

Asset or Process,What could go wrong,Cause,Existing controls,Likelihood (1-5),Impact (1-5),Risk score,Owner,Action needed,Due date,Review date

What you should see when this succeeds: one blank table with 11 columns matching the headers above.

Step 2: List your important assets and processes

In column A, enter one item per row for the things your business depends on. Use these literal examples and replace them with your real items:

Customer database
Website
Payment processing
Email accounts
Source code repository
Cloud file storage
Laptop fleet
Backups
Support desk
Key supplier access

What you should see when this succeeds: column A contains 8-12 items that cover your business-critical systems and processes.

Step 3: Add one realistic failure or threat for each item

For each row, fill columns B and C with one plain-language risk and one likely cause. Use this pattern exactly:

B2 Unauthorized access to customer records
C2 Weak admin password reused from another site

B3 Website unavailable during business hours
C3 Hosting outage or expired domain/payment method

B4 Payments cannot be processed
C4 Third-party provider outage

B5 Staff email account takeover
C5 Phishing link entered on fake login page

Keep each row to one risk. If an asset has several important risks, add more rows with the same asset name in column A.

What you should see when this succeeds: every listed asset has at least one specific "what could go wrong" entry and a short cause.

Step 4: Record the controls you already have

In column D, write the safeguards already in place today, not planned future fixes. Use short, literal entries such as:

MFA enabled for admins; daily backups; endpoint antivirus; least-privilege access; domain auto-renew enabled; password manager required; vendor status page monitored

If no control exists, enter this exact value:

None documented

What you should see when this succeeds: each row has either a real current control or the words "None documented".

Step 5: Score likelihood and impact on a 1-5 scale

Use this exact scoring model in your sheet notes or in rows below the table:

Likelihood
1 Rare
2 Unlikely
3 Possible
4 Likely
5 Very likely

Impact
1 Negligible
2 Minor
3 Moderate
4 Major
5 Severe

Then enter one number in column E and one number in column F for every row.

Use these literal examples if you need a starting point:

Phishing against email accounts: Likelihood 4, Impact 4
Website outage for brochure site: Likelihood 3, Impact 2
Loss of customer database: Likelihood 2, Impact 5
Backups not restorable: Likelihood 3, Impact 5

What you should see when this succeeds: every row has a number from 1 to 5 in columns E and F.

Step 6: Calculate the risk score

In cell G2, enter this exact formula, then fill it down the column:

For Excel, Google Sheets, or LibreOffice Calc:

=E2*F2

Then sort the table by column G from largest to smallest.

Menu path examples:

• In Google Sheets: Data → Sort range → Advanced range sorting options → Sort by "Risk score" Z → A
• In Excel: Data → Sort → Sort by "Risk score" → Largest to Smallest

What you should see when this succeeds: the highest-risk items appear at the top, with scores from 1 to 25.

Step 7: Assign an owner and one action for the top risks

For the top 3-5 rows, fill columns H, I, J, and K with literal values. Use one named person or role in column H and one concrete action in column I.

Use this pattern:

H2 Operations Manager
I2 Enable MFA for all email users and remove shared inbox passwords
J2 2026-11-15
K2 2027-01-15

H3 Engineering Lead
I3 Test backup restore to a separate folder and record the result
J3 2026-11-10
K3 2027-01-15

Do not write vague actions like "improve security". Write the exact next task.

What you should see when this succeeds: the highest-risk rows each have an owner, a due date, and a review date.

Step 8: Save and share the assessment

Save the file with a clear name using this format:

risk-assessment-2026-10.xlsx

Then store it in your shared document location and send the link to the owners you assigned in column H.

What you should see when this succeeds: the file is saved in a shared location and owners can open it.

Verify it works

Use this checklist to confirm the assessment is complete end to end:

• The sheet has entries in columns A through K for at least 8 rows
• Column G contains numeric scores for every row
• The sheet is sorted with the highest score at the top
• The top 3-5 risks have named owners in column H
• The top 3-5 risks have specific actions in column I
• Every top risk has a due date and review date
• The file is saved in a shared location your team can access

A finished top row should look roughly like this:

Email accounts | Staff email account takeover | Phishing link entered on fake login page | MFA enabled for admins only | 4 | 4 | 16 | Operations Manager | Enable MFA for all email users and remove shared inbox passwords | 2026-11-15 | 2027-01-15

Common pitfalls

Using assets that are too vague

Mistake: entering "IT" or "Security" as a single asset.

Symptom: the risks and actions stay generic, and nobody knows what to fix.

Fix: replace the vague item with specific entries such as "Email accounts", "Customer database", and "Backups".

Scoring every risk as high

Mistake: setting most rows to 5 for likelihood and 5 for impact.

Symptom: everything ties for first place, so the table does not help with prioritization.

Fix: rescore using the exact 1-5 scale and compare rows against each other, not against worst-case headlines.

Writing future plans as existing controls

Mistake: putting "MFA rollout next month" in column D.

Symptom: the current risk looks lower than it really is.

Fix: move planned work to column I and keep column D limited to controls that exist today.

Leaving ownership with a team name only

Mistake: using "IT team" or "Management" in column H.

Symptom: no one acts because responsibility is unclear.

Fix: replace the team name with one person or one role, such as "Operations Manager" or "Engineering Lead".

No review date

Mistake: completing the sheet once and never revisiting it.

Symptom: the document goes stale after a system change, vendor switch, or incident.

Fix: enter a review date in column K for every top risk and put a calendar reminder on that date.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.