business risk plan definition

What is business risk?

You know about death and taxes. What about risk? Yes, risk is just as much a part of life as the other two inevitabilities. This became all the more apparent during COVID-19, as each of us had to assess and reassess our personal risk calculations as each new wave of the pandemic— and pandemic-related disruptions —washed over us. It’s the same in business: executives and organizations have different comfort levels with risk and ways to prepare against it.

Where does business risk come from? To start with, external factors can wreak havoc on an organization’s best-laid plans. These can include things like inflation , supply chain  disruptions, geopolitical upheavals , unpredictable force majeure events like a global pandemic or climate disaster, competitors, reputational  issues, or even cyberattacks .

But sometimes, the call is coming from inside the house. Companies can be imperiled by their own executives’ decisions or by leaks of privileged information, but most damaging of all, perhaps, is the risk of missed opportunities. We’ve seen it often: when companies choose not to adopt disruptive innovation, they risk losing out to more nimble competitors.

The modern era is rife with increasingly frequent sociopolitical, economic, and climate-related shocks. In 2019 alone, for example, 40 weather disasters caused damages exceeding $1 billion each . To stay competitive, organizations should develop dynamic approaches to risk and resilience. That means predicting new threats, perceiving changes in existing threats, and developing comprehensive response plans. There’s no magic formula that can guarantee safe passage through a crisis. But in situations of threat, sometimes only a robust risk-management plan can protect an organization from interruptions to critical business processes. For more on how to assess and prepare for the inevitability of risk, read on.

Learn more about McKinsey’s Risk and Resilience  Practice.

What is risk control?

Risk controls are measures taken to identify, manage, and eliminate threats. Companies can create these controls through a range of risk management strategies and exercises. Once a risk is identified and analyzed, risk controls can be designed to reduce the potential consequences. Eliminating a risk—always the preferable solution—is one method of risk control. Loss prevention and reduction are other risk controls that accept the risk but seek to minimize the potential loss (insurance is one method of loss prevention). A final method of risk control is duplication (also called redundancy). Backup servers or generators are a common example of duplication, ensuring that if a power outage occurs no data or productivity is lost.

But in order to develop appropriate risk controls, an organization should first understand the potential threats.

What are the three components to a robust risk management strategy?

A dynamic risk management plan can be broken down into three components : detecting potential new risks and weaknesses in existing risk controls, determining the organization’s appetite for risk taking, and deciding on the appropriate risk management approach. Here’s more information about each step and how to undertake them.

1. Detecting risks and controlling weaknesses

A static approach to risk is not an option, since an organization can be caught unprepared when an unlikely event, like a pandemic, strikes. So it pays to always be proactive. To keep pace with changing environments, companies should answer the following three questions for each of the risks that are relevant to their business.

• How will a risk play out over time? Risks can be slow moving or fast moving. They can be cyclical or permanent. Companies should analyze how known risks are likely to play out and reevaluate them on a regular basis.
• Are we prepared to respond to systemic risks? Increasingly, risks have longer-term reputational or regulatory consequences, with broad implications for an industry, the economy, or society at large. A risk management strategy should incorporate all risks, including systemic ones.
• What new risks lurk in the future? Organizations should develop new methods of identifying future risks. Traditional approaches that rely on reviews and assessments of historical realities are no longer sufficient.

2. Assessing risk appetite

How can companies develop a systematic way of deciding which risks to accept and which to avoid? Companies should set appetites for risk that align with their own values, strategies, capabilities, and competitive environments—as well as those of society as a whole. To that end, here are three questions companies should consider.

• How much risk should we take on? Companies should reevaluate their risk profiles frequently according to shifting customer behaviors, digital capabilities, competitive landscapes, and global trends.
• Are there any risks we should avoid entirely? Some risks are clear: companies should not tolerate criminal activity or sexual harassment. Others are murkier. How companies respond to risks like economic turmoil and climate change depend on their particular business, industry, and levels of risk tolerance.
• Does our risk appetite adequately reflect the effectiveness of our controls? Companies are typically more comfortable taking risks for which they have strong controls in place. But the increased threat of severe risks challenges traditional assumptions about risk control effectiveness. For instance, many businesses have relied on automation to increase speed and reduce manual error. But increased data breaches and privacy concerns can increase the risk of large-scale failures. Organizations, therefore, should evolve their risk profiles accordingly.

3. Deciding on a risk management approach

Finally, organizations should decide how they will respond when a new risk is identified. This decision-making  process should be flexible and fast, actively engaging leaders from across the organization and honestly assessing what has and hasn’t worked in past scenarios. Here are three questions organizations should be able to answer.

• How should we mitigate the risks we are taking? Ultimately, people need to make these decisions and assess how their controls are working. But automated control systems should buttress human efforts. Controls guided, for example, by advanced analytics can help guard against quantifiable risks and minimize false positives.
• How would we respond if a risk event or control breakdown happens? If (or more likely, when) a threat occurs, companies should be able to switch to crisis management mode quickly, guided by an established playbook. Companies with well-rehearsed crisis management capabilities weather shocks better, as we saw with the COVID-19 pandemic.
• How can we build true resilience? Resilient companies not only better withstand threats—they emerge stronger. The most resilient firms can turn fallout from crises into a competitive advantage. True resilience stems from a diversity of skills and experience, innovation, creative problem solving, and the basic psychological safety that enables peak performance.

Change is constant. Just because a risk control plan made sense last year doesn’t mean it will next year. In addition to the above points, a good risk management strategy involves not only developing plans based on potential risk scenarios but also evaluating those plans on a regular basis.

Learn more about McKinsey’s  Risk and Resilience  Practice.

What are five actions organizations can take to build dynamic risk management?

In the past, some organizations have viewed risk management as a dull, dreary topic, uninteresting for the executive looking to create competitive advantage. But when the risk is particularly severe or sudden, a good risk strategy is about more than competitiveness—it can mean survival. Here are five actions leaders can take to establish risk management capabilities .

• Reset the aspiration for risk management.  This requires clear objectives and clarity on risk levels and appetite. Risk managers should establish dialogues with business leaders to understand how people across the business think about risk, and share possible strategies to nurture informed risk-versus-return decision making—as well as the capabilities available for implementation.
• Establish agile  risk management practices.  As the risk environment becomes more unpredictable, the need for agile risk management grows. In practice, that means putting in place cross-functional teams empowered to make quick decisions about innovating and managing risk.
• Harness the power of data and analytics.  The tools of the digital revolution  can help companies improve risk management. Data streams from traditional and nontraditional sources can broaden and deepen companies’ understandings of risk, and algorithms can boost error detection and drive more accurate predictions.
• Develop risk talent for the future.  Risk managers who are equipped to meet the challenges of the future will need new capabilities and expanded domain knowledge in model risk management , data, analytics, and technology. This will help support a true understanding of the changing risk landscape , which risk leaders can use to effectively counsel their organizations.
• Fortify risk culture.  Risk culture includes the mindsets and behavioral norms that determine an organization’s relationship with risk. A good risk culture allows an organization to respond quickly when threats emerge.

How do scenarios help business leaders understand uncertainty?

Done properly, scenario planning prompts business leaders to convert abstract hypotheses about uncertainties into narratives about realistic visions of the future. Good scenario planning can help decision makers experience new realities  in ways that are intellectual and sensory, as well as rational and emotional. Scenarios have four main features  that can help organizations navigate uncertain times.

• Scenarios expand your thinking.  By developing a range of possible outcomes, each backed with a sequence of events that could lead to them, it’s possible to broaden our thinking. This helps us become ready for the range of possibilities the future might hold—and accept the possibility that change might come more quickly than we expect.
• Scenarios uncover inevitable or likely futures.  A broad scenario-building effort can also point to powerful drivers of change, which can help to predict potential outcomes. In other words, by illuminating critical events from the past, scenario building can point to outcomes that are very likely to happen in the future.
• Scenarios protect against groupthink.  In some large corporations, employees can feel unsafe offering contrarian points of view for fear that they’ll be penalized by management. Scenarios can help companies break out of this trap by providing a “safe haven” for opinions that differ from those of senior leadership and that may run counter to established strategy.
• Scenarios allow people to challenge conventional wisdom.  In large corporations in particular, there’s frequently a strong bias toward the status quo. Scenarios are a nonthreatening way to lay out alternative futures in which assumptions underpinning today’s strategy can be challenged.

Learn more about McKinsey’s Strategy & Corporate Finance  Practice.

What’s the latest thinking on risk for financial institutions?

In late 2021, McKinsey conducted survey-based research with more than 30 chief risk officers (CROs), asking about the current banking environment, risk management practices, and priorities for the future.

According to CROs, banks in the current environment are especially exposed to accelerating market dynamics, climate change, and cybercrime . Sixty-seven percent of CROs surveyed cited the pandemic as having significant impact on employees and in the area of nonfinancial risk. Most believed that these effects would diminish in three years’ time.

Introducing McKinsey Explainers : Direct answers to complex questions

Climate change, on the other hand, is expected to become a larger issue over time. Nearly all respondents cited climate regulation as one of the five most important forces in the financial industry in the coming three years. And 75 percent were concerned about climate-related transition risk: financial and other risks arising from the transformation away from carbon-based energy systems.

And finally, cybercrime was assessed as one of the top risks by most executives, both now and in the future.

Learn more about the risk priorities of banking CROs here .

What is cyber risk?

Cyber risk is a form of business risk. More specifically, it’s the potential for business losses of all kinds  in the digital domain—financial, reputational, operational, productivity related, and regulatory related. While cyber risk originates from threats in the digital realm, it can also cause losses in the physical world, such as damage to operational equipment.

Cyber risk is not the same as a cyberthreat. Cyberthreats are the particular dangers that create the potential for cyber risk. These include privilege escalation (the exploitation of a flaw in a system for the purpose of gaining unauthorized access to resources), vulnerability exploitation (an attack that uses detected vulnerabilities to exploit the host system), or phishing. The risk impact of cyberthreats includes loss of confidentiality, integrity, and availability of digital assets, as well as fraud, financial crime, data loss, or loss of system availability.

In the past, organizations have relied on maturity-based cybersecurity approaches to manage cyber risk. These approaches focus on achieving a particular level of cybersecurity maturity by building capabilities, like establishing a security operations center or implementing multifactor authentication across the organization. A maturity-based approach can still be helpful in some situations, such as for brand-new organizations. But for most institutions, a maturity-based approach can turn into an unmanageably large project, demanding that all aspects of an organization be monitored and analyzed. The reality is that, since some applications are more vulnerable than others, organizations would do better to measure and manage only their most critical vulnerabilities.

What is a risk-based cybersecurity approach?

A risk-based approach is a distinct evolution from a maturity-based approach. For one thing, a risk-based approach identifies risk reduction as the primary goal. This means an organization prioritizes investment based on a cybersecurity program’s effectiveness in reducing risk. Also, a risk-based approach breaks down risk-reduction targets into precise implementation programs with clear alignment all the way up and down an organization. Rather than building controls everywhere, a company can focus on building controls for the worst vulnerabilities.

Here are eight actions that comprise a best practice for developing  a risk-based cybersecurity approach:

• fully embed cybersecurity in the enterprise-risk-management framework
• define the sources of enterprise value across teams, processes, and technologies
• understand the organization’s enterprise-wide vulnerabilities—among people, processes, and technology—internally and for third parties
• understand the relevant “threat actors,” their capabilities, and their intent
• link the controls in “run” activities and “change” programs to the vulnerabilities that they address and determine what new efforts are needed
• map the enterprise risks from the enterprise-risk-management framework, accounting for the threat actors and their capabilities, the enterprise vulnerabilities they seek to exploit, and the security controls of the organization’s cybersecurity run activities and change program
• plot risks against the enterprise-risk appetite; report on how cyber efforts have reduced enterprise risk
• monitor risks and cyber efforts against risk appetite, key cyber risk indicators, and key performance indicators

How can leaders make the right investments in risk management?

Ignoring high-consequence, low-likelihood risks can be catastrophic to an organization—but preparing for everything is too costly. In the case of the COVID-19 crisis, the danger of a global pandemic on this scale was foreseeable, if unexpected. Nevertheless, the vast majority of companies were unprepared: among billion-dollar companies in the United States, more than 50 filed for bankruptcy in 2020.

McKinsey has described the decisions to act on these high-consequence, low-likelihood risks as “ big bets .” The number of these risks is far too large for decision makers to make big bets on all of them. To narrow the list down, the first thing a company can do is to determine which risks could hurt the business versus the risks that could destroy the company. Decision makers should prioritize the potential threats that would cause an existential crisis  for their organization.

To identify these risks, McKinsey recommends using a two-by-two risk grid, situating the potential impact of an event on the whole company against the level of certainty about the impact. This way, risks can be measured against each other, rather than on an absolute scale.

Organizations sometimes survive existential crises. But it can’t be ignored that crises—and missed opportunities—can cause organizations to fail. By measuring the impact of high-impact, low-likelihood risks on core business, leaders can identify and mitigate risks that could imperil the company. What’s more, investing in protecting their value propositions can improve an organization’s overall resilience.

Articles referenced:

• “ Seizing the momentum to build resilience for a future of sustainable inclusive growth ,” February 23, 2023, Børge Brende and Bob Sternfels
• “ Data and analytics innovations to address emerging challenges in credit portfolio management ,” December 23, 2022, Abhishek Anand , Arvind Govindarajan , Luis Nario  and Kirtiman Pathak
• “ Risk and resilience priorities, as told by chief risk officers ,” December 8, 2022, Marc Chiapolino , Filippo Mazzetto, Thomas Poppensieker , Cécile Prinsen, and Dan Williams
• “ What matters most? Six priorities for CEOs in uncertain times ,” November 17, 2022, Homayoun Hatami  and Liz Hilton Segel
• “ Model risk management 2.0 evolves to address continued uncertainty of risk-related events ,” March 9, 2022, Pankaj Kumar, Marie-Paule Laurent, Christophe Rougeaux, and Maribel Tejada
• “ The disaster you could have stopped: Preparing for extraordinary risks ,” December 15, 2020, Fritz Nauck , Ophelia Usher, and Leigh Weiss
• “ Meeting the future: Dynamic risk management for uncertain times ,” November 17, 2020, Ritesh Jain, Fritz Nauck , Thomas Poppensieker , and Olivia White
• “ Risk, resilience, and rebalancing in global value chains ,” August 6, 2020, Susan Lund, James Manyika , Jonathan Woetzel , Edward Barriball , Mekala Krishnan , Knut Alicke , Michael Birshan , Katy George , Sven Smit , Daniel Swan , and Kyle Hutzler
• “ The risk-based approach to cybersecurity ,” October 8, 2019, Jim Boehm , Nick Curcio, Peter Merrath, Lucy Shenton, and Tobias Stähle
• “ Value and resilience through better risk management ,” October 1, 2018, Daniela Gius, Jean-Christophe Mieszala , Ernestos Panayiotou, and Thomas Poppensieker

Want to know more about business risk?

Related articles.

What matters most? Six priorities for CEOs in turbulent times

Creating a technology risk and cyber risk appetite framework

Risk and resilience priorities, as told by chief risk officers

• Our Company
• Corporate Governance
• Our Ratings
• Our Locations
• Trade Credit Insurance
• Surety Bonds and Guarantees
• Business Fraud Insurance
• Solutions for Multinationals
• Solutions for Banks and Financial Institutions
• E-Commerce Credit Insurance
• Trade Credit Insurance Solutions for Brokers
• Our Publications
• Meet our Economists
• Country Risk
• Sector Risk
• Collection Complexity
• Economic Insights
• Business tips
• Customer Stories
• Life With Us
• Students and Graduates

How to create a business risk management plan for your company

Running a business comes with many types of risk. They can have negative impact, positive impact, or both. Some of these potential hazards can destroy a business or cause serious damage that is costly and time-consuming to repair. Other risks may represent opportunities.

Companies invest time and money in business risk management but often treat it as a compliance issue with rules and regulations for employees to follow. This approach is limited:  rules-based business risk management alone cannot diminish either the likelihood or the impact of a disaster and can also lessen your ability to seize business opportunities that may involve some degree of risk.  

What is business risk management and why is it important?

Business risk management is a subset of risk management which evaluates, prioritises and addresses the risks involved in any changes to your business operations, systems and processes . It acts as a guide in decision-making and planning in the event of an emergency or an opportunity.

Business risk management also enables an integrated response to multiple risks and facilitates informed, risk-based decision-making capabilities .

What risks are you likely to face?

The Harvard Business Review  divides company risks into three parts: Preventable Risks (those within your organisation), Strategy Risks (those which you may undertake to generate higher returns), and External Risks (those occurring outside of your organisation and therefore beyond your control).   

More specifically, the following examples should be considered in your business risk management assessment:

• Hazard risks: anything in the workplace with the potential to harm people, which is not under the control of the business environment. This includes such items as hazardous materials or fallout from machinery. 
• Physical and environmental risks: fires or explosions; anything that can damage your premises, including natural disasters such as area fires, storm damage, floods, hurricanes or tornados, earthquakes, etc. Some of these can be considered climate-related.
• Human risks: personnel-related issues that can affect your company’s operation, such as alcohol and drug abuse, embezzlement or business fraud .
• Technology and operational risks: anything that compromises your company’s operations, such as a power outage, cyberfraud , system failures, etc. 
• Strategic risks:  failure to respond to changes in the business environment, often the result of poor or wrong business plans and losing the competitive edge in your sector (think Blockbuster video vs Netflix).
• Financial risks:  risks taken with financial assets, including risks in pricing, currency exchange or liquidation of an asset. Customers and partners can also present financial risks in business, such as a credit risk  for example if you sell on credit terms. Business risk management can indicate how much risk your company can handle in financial relationships, including the risk of payment defaults .

Creating effective business risk management involves your entire company and is implemented through enterprise risk management.

What is enterprise risk management?

Enterprise risk management (ERM) is the methodical process of identifying and creating responses to potential events that represent risks to the achievement of your company’s strategic objectives, or to opportunities to gain competitive advantage . It’s the expression of your company’s risk culture, your risk tolerance, your appetite for risk.

These are important elements with which to create an appropriate governance framework for risk, which can involve seeking outside professional assistance – such as expert risk analysts – to determine risks and responses.

Advantages and disadvantages of enterprise risk management

When structured efficiently, the acceptance of strategy risks can create highly profitable operations and improve your compliance with legal, regulatory and reporting requirements.

There are likely to be many advantages and disadvantages of enterprise risk management because it gives you greater awareness of the risks facing your organisation and your ability to respond effectively . This should provide you and your employees with an increase in your operational efficiency and effectiveness while boosting your confidence about your company’s ability to achieve strategic objectives.

However, there can also be a downside to enterprise risk management, as it has inherent limitations. For example, human judgment in decision-making can be based on past experience, false assumptions or sheer gut feeling, resulting in simple errors or more serious mistakes.

Insufficient understanding of what enterprise risk management is might overlook your sector’s business and economic climate, which can result in conflicting data or an overly conservative approach to risk… and missed opportunities. To be effective, enterprise risk management should assess the risks inherent in specific business objectives , anchored in key value drivers.

Remember: strategy-related financial risks in business are inherent in companies’ strategic objectives. For example, financial institutions such as banks or credit unions take on risk when lending to consumers, while pharmaceutical companies are exposed to strategy risk in their R&D development for new products.

Companies exposed to substantial financial risks can mitigate the potential for negative consequences by creating and maintaining infrastructures and solutions such as trade credit insurance .

How to create your own enterprise risk management process

The first step in creating an effective process is to understand the types of risks your organisation faces vis-a-vis the main components or drivers of your business strategy.

Comprehensively analyse your company's specific business activities and components . What internal and external events could impede or derail each of them? Do you have systems and processes in place to handle these risks? Overall, how likely are these risks likely to occur?

Specific initial steps to take in business risk management are:

• Identifying risks by studying internal and external factors that impact your objectives.
• Analysing risks  by calibrating and calculating the outcomes for each risk.
• Responding to risk  by adopting the appropriate strategy needed to mitigate the risk, either by establishing new processes or eliminating old ones.
• Monitoring risk and opportunities by continually measuring and documenting the risks and opportunities of your sector, including financial risks in business and your own risk management protocols.

Make sure to incorporate accountability in your enterprise risk management. Appoint a staff member with managerial authority to oversee business risk management responsibilities. You might also form a risk management committee with members assigned to specific tasks. 

Can you ensure to avoid risks?

Risks in today’s age of technology and climate change have multiplied in number and complexity. Advance planning and expert consultation can mitigate the downside of some of these risks. Many risks are in fact insurable: fire, product liability, or embezzlement among them.

For example, as a specialist in risk monitoring and credit risk management, we cover companies against risks such as fraud, credit risk and risks linked to “green” transactions  by offering predictive protection in the form of trade credit insurance and business fraud insurance .

But the best risk insurance is still prevention . Many risks in your operations, including financial risks, can be tackled through employee training; background checks on employees, customers and partners; safety checks; equipment maintenance, and maintenance of your company’s physical premises.

In the case of monitoring financial risks in business, try embedding experts within your organisation to work with line managers whose activities are generating new ideas, innovation, risks — and, if all goes well, profits.

Enterprise risk management is a company-wide process, but multiple studies have found that people overestimate their ability to influence events, many of which are heavily determined by chance.

You might be interested in

Fidelity insurance: protecting your business from fraud | Allianz Trade

How fidelity insurance offers the ultimate protection against sophisticated fraud.

Managing business risks in times of high inflation | Allianz Trade

How to manage risk and safeguard your business in a high-inflation context

Risks and opportunities in Italy's agri-food sector | Allianz Trade

How food producers in Italy can navigate new and emerging challenges with confidence.

Data-driven decisions with humans at the core | Allianz Trade

How combining human expertise with machine learning models enhances the underwriting process.

BNPL solutions: Transforming risks into strengths

Exploring the risks and rewards of BNPL solutions for B2B traders

How companies can avoid insolvency during rapid growth

How SMEs should protect their working capital during rapid growth to avoid bad debt and insolvency

How to manage risk when trading online | Euler Hermes

Adapting to the new world of e-commerce should not mean forgoing appropriate risk management solutions.

Benefits in bulk: setting up a wholesale business for growth

Wholesalers face challenges that differ from those of retailers or manufacturers. Learn how to tackle them.

Advantages and disadvantages of expanding a business

Discover the benefits of expanding a business and the disadvantages, including international expansion.

Acquisition Or Merger: Prepare With Financial Analysis

Which KPIs to look at when preparing for an acquisition or merger? Read the article for tips on how to use financial analysis in this context.

Bonding Portal  →

Risk management is the process of identifying, assessing and controlling financial, legal, strategic and security risks to an organization’s capital and earnings. These threats, or risks, could stem from a wide variety of sources, including financial uncertainty, legal liabilities, strategic management errors, accidents and natural disasters.

If an unforeseen event catches your organization unaware, the impact could be minor, such as a small impact on your overhead costs. In a worst-case scenario, though, it could be catastrophic and have serious ramifications, such as a significant financial burden or even the closure of your business.

To reduce risk, an organization needs to apply resources to minimize, monitor and control the impact of negative events while maximizing positive events. A consistent, systemic and integrated approach to risk management can help determine how best to identify, manage and mitigate significant risks.

At the broadest level, risk management is a system of people, processes and technology that enables an organization to establish objectives in line with values and risks.

A successful risk assessment program must meet legal, contractual, internal, social and ethical goals, as well as monitor new technology-related regulations. By focusing attention on risk and committing the necessary resources to control and mitigate risk, a business will protect itself from uncertainty, reduce costs and increase the likelihood of business continuity and success. Three important steps of the risk management process are risk identification, risk analysis and assessment, and risk mitigation and monitoring.

Risk identification is the process of identifying and assessing threats to an organization, its operations and its workforce. For example, risk identification may include assessing IT security threats such as malware and ransomware, accidents, natural disasters and other potentially harmful events that could disrupt business operations.

Risk analysis involves establishing the probability that a risk event might occur and the potential outcome of each event. Risk evaluation compares the magnitude of each risk and ranks them according to prominence and consequence.

Risk mitigation refers to the process of planning and developing methods and options to reduce threats to project objectives. A project team might implement risk mitigation strategies to identify, monitor and evaluate risks and consequences inherent to completing a specific project, such as new product creation. Risk mitigation also includes the actions put into place to deal with issues and effects of those issues regarding a project.

Risk management is a nonstop process that adapts and changes over time. Repeating and continually monitoring the processes can help assure maximum coverage of known and unknown risks.

There are five commonly accepted strategies for addressing risk. The process begins with an initial consideration of risk avoidance then proceeds to three additional avenues of addressing risk (transfer, spreading and reduction). Ideally, these three avenues are employed in concert with one another as part of a comprehensive strategy. Some residual risk may remain.

Avoidance is a method for mitigating risk by not participating in activities that may negatively affect the organization. Not making an investment or starting a product line are examples of such activities as they avoid the risk of loss.

This method of risk management attempts to minimize the loss, rather than completely eliminate it. While accepting the risk, it stays focused on keeping the loss contained and preventing it from spreading. An example of this in health insurance is preventative care.

When risks are shared, the possibility of loss is transferred from the individual to the group. A corporation is a good example of risk sharing — a number of investors pool their capital and each only bears a portion of the risk that the enterprise may fail.

Contractually transferring a risk to a third-party, such as, insurance to cover possible property damage or injury shifts the risks associated with the property from the owner to the insurance company.

After all risk sharing, risk transfer and risk reduction measures have been implemented, some risk will remain since it is virtually impossible to eliminate all risk (except through risk avoidance). This is called residual risk.

Risk management standards set out a specific set of strategic processes that start with the objectives of an organization and intend to identify risks and promote the mitigation of risks through best practice. Standards are often designed by agencies who are working together to promote common goals, to help to ensure high-quality risk management processes. For example, the ISO 31 000 standard on risk management is an international standard that provides principles and guidelines for effective risk management.

While adopting a risk management standard has its advantages, it is not without challenges. The new standard might not easily fit into what you are doing already, so you could have to introduce new ways of working. And the standards might need customizing to your industry or business. 

Manage risk from changing market conditions, evolving regulations or encumbered operations while increasing effectiveness and efficiency.

Speed insights, cut infrastructure costs and increase efficiency for risk-aware decisions with IBM RegTech.

Simplify how you manage risk and regulatory compliance with a unified GRC platform fueled by AI and all your data.

Better manage your risks, compliance and governance by teaming with our security consultants.

Identify IT security vulnerabilities to help mitigate business risks.

Create a smarter security framework to manage the full threat lifecycle.

Understand your cybersecurity landscape and prioritize initiatives together with senior IBM security architects and consultants in a no-cost, virtual or in-person, 3-hour design thinking session.

Understand your cyberattack risks with a global view of the threat landscape

Discover how a governance, risk, and compliance (GRC) framework helps an organization align its information technology with business objectives, while managing risk and meeting regulatory compliance requirements.

Find out how threat management is used by cybersecurity professionals to prevent cyber attacks, detect cyber threats and respond to security incidents.

The Cost of a Data Breach Report explores financial impacts and security measures that can help your organization avoid a data breach, or in the event of a breach, mitigate costs.

Keep up to date with the latest strategies from our expert writers.

You are using an outdated browser. Please upgrade your browser to improve your experience.

Bachelor's Degrees

• Business Management – B.S. Business Administration
• Healthcare Administration – B.S.
• Human Resource Management – B.S. Business Administration
• Information Technology Management – B.S. Business Administration
• Marketing – B.S. Business Administration
• Accounting – B.S. Business Administration
• Finance – B.S
• Supply Chain and Operations Management – B.S.
• Accelerated Information Technology Bachelor's and Master's Degree (from the College of IT)
• Health Information Management – B.S. (from the Leavitt School of Health)
• See all Business Bachelor's Degrees

Master's Degrees

• Master of Business Administration (MBA)
• MBA Information Technology Management
• MBA Healthcare Management
• Management and Leadership – M.S.
• Accounting – M.S.
• Marketing – M.S.
• Human Resource Management – M.S.
• Master of Healthcare Administration (from the Leavitt School of Health)
• Data Analytics – M.S. (from the College of Information Technology)
• Information Technology Management – M.S. (from the College of IT)
• Learning Experience Design and Educational Technology – M.S. (from the School of Education)
• See all Business Master's Degrees

Bachelor's with Licensure

• Elementary Education – B.A.
• Special Education and Elementary Education (Dual Licensure) – B.A.
• Special Education (Mild-to-Moderate) – B.A.
• Mathematics Education (Middle Grades) – B.S.
• Mathematics Education (Secondary) – B.S.
• See all Education Bachelor's Degrees
• Science Education (Middle Grades) – B.S.
• Science Education (Secondary Chemistry) – B.S.
• Science Education (Secondary Physics) – B.S.
• Science Education (Secondary Biological Science) – B.S.
• Science Education (Secondary Earth Science) – B.S.
• Educational Studies – B.A. Does not lead to licensure

Master's with Licensure

• Teaching, Elementary Education –M.A.
• Teaching, English Education (Secondary) – M.A.
• Teaching, Mathematics Education (Middle Grades) – M.A.
• Teaching, Mathematics Education (Secondary) – M.A.
• Teaching, Science Education (Secondary) – M.A.
• Teaching, Special Education (K–12) – M.A.

Licensure Information

• State Teaching Licensure Information

Graduate Degrees and Degrees for Teachers

• Curriculum and Instruction – M.S.
• Educational Leadership – M.S.
• Learning Experience Design and Educational Technology – M.S.
• English Language Learning (PreK–12) – M.A.
• See all Education Master's Degrees
• Mathematics Education (K–6) – M.A.
• Mathematics Education (Middle Grades) – M.A.
• Mathematics Education (Secondary) – M.A.
• Endorsement Preparation, English Language Learning (PreK-12)
• Science Education (Middle Grades) – M.A.
• Science Education (Secondary Chemistry) – M.A.
• Science Education (Secondary Physics) – M.A.
• Science Education (Secondary Biological Science) – M.A.
• Science Education (Secondary Earth Science) – M.A.
• Cloud Computing – B.S.
• Computer Science – B.S.
• Cybersecurity and Information Assurance – B.S.
• Data Analytics – B.S.
• Information Technology – B.S.
• Network Engineering and Security – B.S.
• Software Engineering – B.S.
• Accelerated Information Technology Bachelor's and Master's Degree
• Information Technology Management – B.S. Business Administration (from the College of Business)
• See all IT Bachelor's Degrees
• Cybersecurity and Information Assurance – M.S.
• Data Analytics – M.S.
• Information Technology Management – M.S.
• MBA Information Technology Management (from the College of Business)
• See all IT Master's Degrees

Certification Information

• IT Certifications Included in WGU Degrees
• Nursing (RN-to-BSN online) – B.S.
• Nursing (Prelicensure) – B.S. (Available in select states)
• Health Information Management – B.S.
• Health and Human Services – B.S.
• Healthcare Administration – B.S. (from the College of Business)
• See all Health & Nursing Bachelor's Degrees

Certificates

• View all Nursing Post-Master's Certificates
• Nursing Education—Post Master's Certificate
• Leadership and Management—Post Master's Certificate
• Family Nurse Practitioner—Post-Master's Certificate
• Psychiatric Mental Health Nurse Practitioner—Post-Master's Certificate
• Nursing - Education (BSN-to-MSN Program) – M.S.
• Nursing – Leadership and Management (BSN-to-MSN Program) – M.S.
• Nursing – Nursing Informatics (BSN-to-MSN Program) – M.S.
• Nursing – Family Nurse Practitioner (BSN-to-MSN Program) – M.S. (Available in select states)
• Nursing – Psychiatric Mental Health Nurse Practitioner (BSN-to_MSN Program) – M.S. (Available in select states)
• Nursing – Education (RN-to-MSN Program) – M.S.
• Nursing – Leadership and Management (RN to-MSN Program) – M.S.
• Nursing – Nursing Informatics (RN-to-MSN Program) – M.S.
• Master of Healthcare Administration
• MBA Healthcare Management (from the College of Business)
• See all Health & Nursing Master's Degrees
• New Students
• WGU Returning Graduates
• WGU Readmission
• Enrollment Checklist
• School of Education Admissions Requirements
• College of Business Admissions Requirements
• College of IT Admissions Requirements
• Leavitt School of Health Admissions Requirements
• FAQs about Transferring
• Transfer to WGU
• Request WGU Transcripts

What's it like for students at WGU?

At WGU, your experience is our obsession! You're in charge of your college education—but you're never alone. Find out how different WGU is about personalizing and supporting your education. 

• Tuition—College of Business
• Tuition—School of Education
• Tuition—College of IT
• Tuition—Leavitt School of Health
• Applying for Financial Aid
• State Grants
• Consumer Information Guide
• Your Financial Obligations
• Responsible Borrowing Initiative
• Higher Education Relief Fund
• Scholarships
• Corporate Reimbursement

Flexible and affordable. PLUS $20 million in scholarships for 2022!

Find out more about scholarships for new students.

• Our Students & Graduates
• Alumni Services
• Inspiring Stories of Student Success
• Return on Investment
• Accreditation
• How You'll Learn
• Student Reviews
• Partner Organizations
• Paying for School
• Our Faculty
• Tuition and Funding
• Part-Time Options
• Veterans Virtual Resource Center
• Juggling Life and School
• Getting a Raise or Promotion
• Starting a New Career
• Taking the Next Step in Education
• Career Guides

Insights and advice to help you succeed.

Stay up-to-date with the latest articles, student stories, and guides from WGU.  Check out the WGU Blog!

Online Degrees

• Educational Studies – B.A.

Health & Nursing

• Nursing (Prelicensure) – B.S.
• Nursing – Family Nurse Practitioner (BSN-to-MSN Program) – M.S.
• Nursing – Psychiatric Mental Health Nurse Practitioner (BSN-to_MSN Program) – M.S.
• Apply For Admission
• Admission Requirements
• Transferring

Tuition & Financial Aid

• Tuition and Fees
• Financial Aid
• Student Success
• Graduate Outcomes
• Learning at WGU
• Military and Veterans
• Education Outcomes

Part of Western Governors University

What is risk management in business?

Business owners, management, investors, and leaders all have to consider risk as a huge part of their work and success. If you’re going to business school, hoping to become a leader, manager, or run your own company, risk management is an essential element. But what is the definition of risk management? If you want to pursue any kind of business degree, it’s extremely important to understand the risks that are involved in any business operation and how to assess and manage them.

Companies can mismanage business risk which can lead them to scandals, financial repercussions, safety breaches, potential strategy issues, management distrust, and more. Mismanaging risk can come when companies rely too much on historical data, when they make their parameters for risk too narrow, when they disregard risks that are obvious or don’t look closely enough for hidden risks, when they don’t communicate well, and when they don’t react well in real-time to issues. Companies need to define managing techniques and risk assessment capabilities as part of their business plan in order to demonstrate their capabilities.

Business risks are often mismanaged when companies don’t understand the purpose or definition behind risk management, or when they simply don’t want to put in the work to manage their business risks well. It can also be connected to time, effort, and money involved with risk management that a company doesn’t want to expend. 

As a business owner or leader, it’s extremely important to understand how to strategize how you minimize risk for your organization and ensure that you are being careful and conscious as you make business decisions. 

Understanding risk management.

The definition of risk management is the process of finding, assessing, and controlling threats to your company’s financial security. The basic idea behind that definition is that a company will consider all the areas that could result in a problem for them, consider the best ways to handle a problematic situation, and then put controls in place to help keep that risk as low as possible. It also involves handling a problematic situation when it arises. This guide will dive into the examples and define techniques used for risk management to help business owners and leaders bring success to their organization.

How risk management works.

The risk management process can look different for every business and situation. Some companies have entire enterprise risk management teams that focus on strategic risk, risk assessment, risk profiles, risk treatment, and risk preparation for every new product and strategy. Smaller companies may have only one person who focuses on risk assessment or it may simply be a task along with other responsibilities for a company. Before a business begins it’s important that they define and analyze their risk—business owners and investors both need to understand the risk before they really try and make a go of their company.

Management of risk is vital in making sure a company and leadership understand what the potential problems could be, helping them create solutions for those problems and mitigate their risk. A company that has heavy risk or doesn't have the management aspect worked out may find investors are not excited about giving money. They may also find that they run into more problems then they have money or time to fix. Taking risk management seriously can help a company be prepared for the future.

Business owners and investors may measure risk in different ways. One way may be the amount of money that could be lost if a problem arises. Another is the frequency of risk and loss that’s possible. Other risk measurements could be historical, specific scenarios, and customer impact. All of these ways to measure risk can be important for an organization that’s hoping to analyze, mitigate, or minimize potential risks for themselves and investors. 

Risk management examples.

It’s easier to understand the strategy for how you manage risk when you learn how management works in real life by real companies. For example, a company may choose to avoid buying a new building because they’re unsure they can sell enough product to make the cost worth it. An investor may decide not to spend money on a company because they believe there is too much competition in the industry or their objectives don't line up well. Car manufacturers try to lessen risk by having extensive quality and safety checks on vehicles before selling them. Another business risk strategy may be when a retailer may release a new product in stages to see how it does with consumers before releasing the full line. Many business leaders use insurance companies to remove risk altogether. Some organizations have to accept risk, like medical companies, and understand that some risk is simply part of their business.

Why risk management is essential in business.

In the business world, managing risk is absolutely essential. Whether you’re a large company with an entire risk management process and strategic risk management department, or a small business owner that looks into risk management yourself, it’s a very important factor for your success. Your overall objective should be to make your company as safe as possible, prepared for the likelihood of a financial, physical, or technological problem. 

Risk identification and risk management helps keep your company’s finances and reputation secure. It also can keep your company, the employees, and your customers safe. 

Risk management statistics show its importance in business, such as:

62% of organizations have experienced a critical risk event in the past three years

Of the companies that had a critical risk event, they saw the most significant consequences in the following areas: Employee productivity (62%), operational efficiency (59%), employee safety (29%), competitive differentiation (29%), brand and reputation (28%)

Corporations paid $59 billion in penalties for compliance infractions in 2015

On average every organization has 130 security breaches each year

A data security breach can cost your organization anywhere from $1.25 million to $8.19 million

Meeting business objectives.

If businesses can mitigate the potential risks in their way they are better able to meet their business objectives. From financial benchmarks to customer service, risks can get in the way of your objective success. 

There are both internal and external risks that can impact your organization with their likelihood of meeting objectives. Internal risks can be your employees, technology, actual physical risks inside a building, and more. External risks include the economy, natural disasters, politics, and more. Your business goals are focused around making sales and earning money, keeping customers satisfied, making sure your employees are safe and happy, among other things. Companies can learn how to mitigate their risks so that they are able to meet their goals.

Risk management can be more complex than just deciding to do or not do something. For example, in some instances the cost of the risk itself might be lower than the cost of prevention. So business owners may choose not to take risk management measures. In other cases, the risk is a necessary risk that the business has to accept and take on in order to move forward. Whatever business you’re in, risk management is complex but vital in your business operations.

Compliance.

Every business and industry has regulations and rules that govern their operation. That means there are legal risks with not meeting business regulations, and it can have great financial repercussions if you don’t comply. There are many kinds of business regulations you have to follow including:

Data protection— failure to comply can end up costing a company more than $14 million

Internal requirements—corporations will have requirements to form a board of directors, have director meetings, updating bylaws, and providing stock options

Compliance with the Fair Labor Standards Act—this rule establishes minimum wage, overtime pay, and more

Other requirements—there may be other paperwork and tax requirements required based on your industry and size of corporation

Non-compliance can result in financial issues for your company, problems for customers and employees, as well as a bad mark for your company’s reputation.

Risk management techniques.

There are many techniques your company can utilize to lower your company’s risk. It’s important to carefully consider the risks and risk management techniques that will be best for your company. Some of these techniques include:

• Avoiding Risk. Avoiding risk is usually the most effective measure of risk management. Just like the name implies, with this technique you just avoid the risk completely. If you are successful, there’s 0% chance you’ll have a loss from that risk factor. That’s why avoidance is usually the first risk management technique used. Risk avoidance can be seen in businesses doing background checks on employees to avoid potential problems. It can also be seen in an investor deciding not to put money in an industry that is seeing economic loss.
• Transferring risk. Transferring risk is when a company knows that they have risk that they can’t avoid, and they want to hire an insurance or other third-party company to help them mitigate their risk. There are many examples of transferring risk—a company purchases insurance for their building or products to help keep them safe in the event of a fire, theft, flood, etc. Another example of transferring risk is when a company creates contracts with employees or clients through a legal company that helps offset any risk that might come in the future. 
• Preventing loss. Preventing loss is when a company understands that there is some risk that they can’t avoid, but they put preventative measures in place to help reduce the impact of risk. For example, a company may store their inventory in a warehouse, which means it’s susceptible to theft or fire. They prevent the risk and loss by putting up security cameras and hiring a security guard. Another company may require passwords on their computers to prevent data and security breaches of their company information.
• Retaining risk. This technique involves handling risk within your own company instead of relying on outside sources. Companies use this technique because they often believe that they can handle risks themselves instead of paying for an insurance company or other vendor. An example of retaining risk is an organization that has an internal IT department that runs their computer security, rather than utilizing a 3rd party company or software. It can also be seen in a company that opts not to buy an insurance policy for a certain danger because they believe they would be ahead to save money on their policy, and that the cost would be less if the danger actually happened than paying regularly for the policy.
• Spreading risk. Spreading risk happens primarily for insurance companies who opt to work with other insurance companies to spread out the risk of large clients. For example, an oil supertanker purchases insurance. The company would then spread out the insurance through other companies so in the event of a disaster the cost and risk is spread out through multiple companies.

Risk is an inevitable part of business, but it’s important to make a plan for your risk management process so your company stays safe. Business leaders and owners alike need to understand and have a plan for risk management in order to be successful.

5 tips for a successful career change at 20.

Here are 5 tips that will help you be prepared for a career change, which could ultimately give you a new life.

Career Development , Business

Starting a business: how entrepreneurs handle risk..

Learn from famous entrepreneurs how calculated risks can pay off, and how business education can help you.

Subscribe to the WGU Blog

Stay up-to-date with the latest articles, tips, and insights from the team at WGU

Most Popular

• Will I earn more money with an MBA?
• Is an online nursing degree credible?
• 3 cybersecurity career myths busted.
• Pop quiz on careers beyond teaching.
• Career Development
• Career Services
• Featured Faculty
• Future of Higher Education
• Information Technology
• Northeast Spotlight
• Nursing & Healthcare
• Online University Experience
• Teaching & Education

One online university. Four colleges. Flexible degrees.

Our focus on your success starts with our focus on four high-demand fields: K–12 teaching and education, nursing and healthcare, information technology, and business. Every degree program at WGU is tied to a high-growth, highly rewarding career path. Which college fits you?

College of Business Online

TEACHERS COLLEGE ONLINE

COLLEGE OF INFORMATION TECHNOLOGY ONLINE

COLLEGE OF HEALTH PROFESSIONS ONLINE

Want to see all the degrees WGU has to offer? View all degrees

REQUEST FREE TRANSCRIPTS

Sign up and learn how you could get your transcripts sent to WGU absolutely free.

By submitting you will receive emails from WGU and can opt-out at any time.

THANKS FOR SIGNING UP!

We're emailing you the info on getting your transcripts sent to WGU for free.

Ready to apply now?

Career Tips , Choosing a Job , Getting a Job

What Is A Business Risk And How Should You Plan For It?

The old adage goes, “No risk, no reward.” When it comes to business, the ultimate goal is to provide value and reap a profit. That doesn’t happen without assuming some risk. However, good business owners understand business risk and how to approach it. Some risks can be avoided, and others are inevitable, so mitigation is the only approach.

To know how to approach business risk, it’s necessary to know the types of business risk that exist and the strategies to handle them. This guide will give you everything you need to know.

What is Business Risk?

Business risks are situations that businesses face which could negatively impact output or profits. There are various kinds of business risk, but they all have one thing in common: they threaten the business’ ability to accomplish its goals.

Risk can come from internal sources like the leadership style of those in charge. Or, it could be something totally uncontrollable, like natural disasters.

While it’s impossible for any organization to exist with zero risk, there are several ways to manage risk. These analytical and forward-thinking approaches can be the difference between having a thriving business and one that fails.

Types of Business Risk

There are four commonly noted types of business risk, which are:

• Strategic Risk: A strategic risk exists when a business doesn’t operate according to its plan. Businesses have their business model outlined, which includes a strategy of how they will reach their goals. Once a business has to stray from their intended plans to meet their goal, they could be facing a strategic risk. For example, if a market has positioned itself to provide low-cost and organic produce straight from farmers to the local community and another farmer’s market opens nearby and undercuts their prices, the first company may have to pivot and offer another strategy (like delivery) to meet its customers’ demands.
• Compliance Risk: There are many types of businesses that are highly regulated, such as insurance, finance, and travel. These industries must comply with numerous governmental rules and regulations. Compliance risk happens when a business fails to meet the regulations and adhere to the rules. For example, if an airline company fails to meet the FCC’s regulations, they can be shut down.
• Operational Risk: Operational risks can decrease a business’ ability to provide value to their customers when the inner workings like day-to-day processes face failed systems. This could come in the form of fraud, privacy risks, legal risks, physical risks, or environmental issues. Operational risks cannot ever be fully avoided, but they must be actively managed.
• Reputational Risk: When an internal or external event affects how people perceive a company, they may lose customers or the business entirely. One example of reputational risk would be if an ecommerce retailer is hacked numerous times. Then, people will lose trust and likely stop making online purchases, which would greatly affect the store’s bottom line.

What Causes Business Risk?

As mentioned, business risk can stem from internal or external sources. These can be broken down into three main categories, namely:

• Nature: Natural causes can affect businesses by slowing down production, hurting people, or destroying physical locations and property. This may be a delivery truck that never makes it to deliver a customer’s package because of a tornado, or an earthquake that destroys a factory’s equipment.
• Humans: People can provoke business risk by striking, being negligent, not fulfilling their job duties, or being mismanaged.
• Economy: Economic and market factors like a change in consumer demand or an increase in the cost of raw materials will impact businesses.

How to Plan for Business Risk

There’s a process-based approach to plan for business risk. Every type of business faces a different degree of risks. To be best prepared, it’s necessary to define a business’ risk appetite and plan for said risk.

The process looks like this:

• Identify: First and foremost, you need to understand what situations could arise and cause risk. This is the identification phase of risk management which involves brainstorming and a well-equipped team. Identifying risks calls for involving employees and team members in each department as they each have their own perspective of what kind of risks may occur.
• Act: Executives and owners can define a plan based on each type of risk identified in step one. Then, if the risk comes to fruition, every person on the team knows how to act and what needs to be done to mitigate the negative outcomes.
• Record: Keep a running report of risks, the plan of action taken, and the results. This helps to pave the way for improvements to be made, if needed.

Approaches to Manages Business Risks

There are four main approaches to manage business risks. Each approach will rely on the said risk that is posed. However, most companies end up mixing and matching these approaches to risk, based on the issue at hand.

• Avoidance: Like the name implies, this would require changing your plan entirely to avoid the potential risk. So, if you want to introduce a new product, for example, but the supplier is out of the country, you could face natural disasters as a risk affecting the supply chain. Instead, you may avoid using a foreign supplier and choose a local supplier instead, thereby avoiding the risk that is tied to the foreign business.
• Acceptance: Some businesses accept small-scale risks because the cost of avoidance, prevention, or transference would be greater than the outcome of the risk occurring.
• Mitigation: Some risks are unavoidable and a core aspect of operating business. As such, one of the most common strategies is to mitigate risk. This is having a plan in place that will lessen the impact of the consequences of the risk on the business.
• Transference: Businesses also often transfer risk, or pay someone else to take on the risk. This is the business of insurance. This strategy will rely on analysis to decide how much insurance is worth it to protect your business from risk.

The Bottom Line

There are a lot of upsides to running and/or owning a successful business. However, every business is faced with business risk. Understanding the variety of risks that could impact your business is a crucial step in preparing to manage it. By categorizing risks in their four main compartments and then choosing an approach for each, you can be the most prepared to handle business risk.

Related Articles

Privacy overview.

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Risk Assessment

A risk assessment is a process to identify potential hazards and analyze what could happen if a hazard occurs. A business impact analysis (BIA) is the process for determining the potential impacts resulting from the interruption of time sensitive or critical business processes.

There are numerous hazards to consider. For each hazard there are many possible scenarios that could unfold depending on timing, magnitude and location of the hazard. Consider hurricanes:

A Hurricane forecast to make landfall near your business could change direction and go out to sea.

There are many “assets” at risk from hazards. First and foremost, injuries to people should be the first consideration of the risk assessment. Hazard scenarios that could cause significant injuries should be highlighted to ensure that appropriate emergency plans are in place. Many other physical assets may be at risk. These include buildings, information technology, utility systems, machinery, raw materials and finished goods. The potential for environmental impact should also be considered. Consider the impact an incident could have on your relationships with customers, the surrounding community and other stakeholders. Consider situations that would cause customers to lose confidence in your organization and its products or services.

As you conduct the risk assessment, look for vulnerabilities—weaknesses—that would make an asset more susceptible to damage from a hazard. Vulnerabilities include deficiencies in building construction, process systems, security, protection systems and loss prevention programs. They contribute to the severity of damage when an incident occurs. For example, a building without a fire sprinkler system could burn to the ground while a building with a properly designed, installed and maintained fire sprinkler system would suffer limited fire damage.

The impacts from hazards can be reduced by investing in mitigation . If there is a potential for significant impacts, then creating a mitigation strategy should be a high priority.

Risk Assessment Process Diagram - Text Version

Use the Risk Assessment Tool complete your risk assessment. Instructions are provided on the form.

Natural Hazards

• Meteorological -Flooding, Dam/Levee Failure, Severe Thunderstorm (Wind, Rain, Lightning, Hail), Tornado, Windstorm, Hurricanes and Tropical Storms, Winter Storm (Snow/Ice)
• Geological -Earthquake, Tsunami, Landslide, Subsidence/Sinkhole, Volcano
• Biological - Pandemic Disease, Foodborne Illnesses

Human-Caused Hazards

• Accidents -Workplace Accidents, Entrapment/Rescue (Machinery, Water, Confined Space, High Angle), Transportation Accidents (Motor Vehicle, Rail, Water, Air, Pipeline), Structural Failure/Collapse, Mechanical Breakdown
• Intentional Acts - Labor Strike, Demonstrations, Civil Disturbance (Riot), Bomb Threat, Lost/Separated Person, Child Abduction, Kidnapping/Extortion, Hostage Incident, Workplace Violence, Robbery , Sniper Incident, Terrorism (Chemical, Biological, Radiological, Nuclear, Explosives), Arson, Cyber/Information Technology (Malware Attack, Hacking, Fraud, Denial of Service, etc.)

Technological Hazards

• Information Technology - Loss of Connectivity, Hardware Failure, Lost/Corrupted Data, Application Failure
• Utility Outage - Communications, Electrical Power, Water, Gas, Steam, Heating/Ventilation/Air Conditioning, Pollution Control System, Sewage System
• Fire/Explosion - Fire (Structure, Wildland), Explosion (Chemical, Gas, or Process failure)
• Hazardous Materials -Hazardous Material spill/release, Radiological Accident, Hazmat Incident off-site, Transportation Accidents, Nuclear Power Plant Incident, Natural Gas Leak Supply
• Chain Interruption - Supplier Failure, Transportation Interruption

Risk Assessment Resources

• Multi-hazard Mapping Information Platform - Federal Emergency Management Agency (FEMA)
• Flood Map Service Center - FEMA
• Earthquake Hazards information - United States Geological Survey (USGS)
• Hurricane - FEMA
• Landslide Hazards Program - USGS
• Volcano Hazards Program - USGS
• Protecting Workers from Heat Illness - Occupational Safety and Health Administration (OSHA)
• Survey Your Workplace for Additional Hazards - OSHA Compliance Assistance Quick Start for General Industry
• Workplace Violence—Issues in Response - Federal Bureau of Investigation
• Risk Assessment Portal , guidance and guidelines - U.S. Environmental Protection Agency
• Computer Security Resource Center , Special Publications, National Institute of Standards and Technology, Computer Security Division
• United States Computer Emergency Readiness Team

Last Updated: 02/25/2022

Return to top

• Risk management
• Risk assessment and planning

Business risks

On this page

What is risk management?

How you can manage risk in your business, why manage risk, risks that you must manage, types of risk, risk management in your state or territory.

Risk management helps you make better business decisions. It involves reducing the things that could have a negative effect on your business. For example, the reducing the risk of injury by through safety procedures. You can also look for opportunities that could have a positive impact on your business.

Jimmy owns a transport business. He drives trucks, moving commercial products around Australia. Some of the hazards Jimmy faces each day include:

• contact with chemicals and fumes when refuelling
• uncomfortable seating and fatigue, especially on long journeys
• no heating or air-conditioning to change the temperature inside the truck.

Some steps Jimmy could take to reduce the risks in his daily work include:

• wearing appropriate clothing to reduce his exposure to chemicals
• taking regular breaks during his trips to stretch and walk around
• ensuring that he only works the legal hours for his industry to deal with fatigue
• installing fans or air-conditioning in his truck
• having suitable clothing and water for each trip.

Begin by finding out about risk management practices and how you can use them. You should also talk to others involved in your business (including your employees and customers) to decide on the best way to manage risk in your business.

Before you decide what to do, you’ll need to work out what your risks are and which ones are most urgent:

• Identify – work out what risks your business could face.
• Analyse – find the level of the risks and which ones are most urgent.
• Evaluate – compare the risk against set risk criteria to decide what to do.

Find out how to manage risk in your business.

By managing risk, you can reduce the impact of unexpected events on your business.

Managing risk can also help you to:

• improve your relationships with customers, suppliers, employees and the community, by understanding and managing their expectations
• improve staff confidence in a safe work environment, through workplace health and safety (WHS) and workers’ compensation insurance
• keep your business open during natural or economic disasters, by having an emergency management plan
• reduce your compliance and insurance costs, by having a lower risk of damages.

You won't always have enough information or the resources to manage every risk. A good risk management plan will allow you to change your approach if it isn't working, or when unexpected risk happens.

You're required by law to manage some risks. For example, you must manage or reduce the risk of:

• accidents and injury by making your workplace safe under work health and safety (WHS) laws
• customer complaints by treating customers fairly under Australian Consumer Law
• injury or harm to employees by having workers' compensation insurance
• damaging the environment by meeting the environmental laws that apply to you.

It's a good idea to understand the different types of risks your business may face so you can recognise and plan ahead for them.

Risks can be:

• opportunity-based risk from choosing one option over other options (such as buying a new property)
• uncertainty-based risk from uncertain or unknown events (such as natural disasters or loss of suppliers)
• hazard-based risk from dangerous materials or actions (such as using hazardous chemicals or working at heights).

Opportunity-based risks

This type of risk comes from taking one opportunity over others. By deciding to commit your resources to one opportunity, you risk:

• missing a better opportunity
• getting unexpected result.

Opportunity-based risks for a business include moving a business to a different location, buying a new property, or selling a new product or service.

Uncertainty-based risks

This type of risk is from uncertainty around unknown or unexpected events. It’s hard to predict these events and the damage they can cause. It’s also hard to control the damage once they occur.

Examples of uncertainty-based risks include:

• damage by fire, flood or other natural disasters
• unexpected financial loss due to an economic downturn, or bankruptcy of other businesses that owe you money
• loss of important suppliers or customers
• decrease in market share because new competitors or products enter the market
• court action.

To reduce the impact of uncertain events on your business, you can do things like:

• develop an emergency management plan to reduce the damage to your business in an emergency
• keep a supplier database to help you manage your stock and equipment
• seek and use regular feedback from your customers and other people you deal with in your business
• check your business environment regularly for risks such as changes in trends and customer expectations
• seek expert advice every now and then to check the financial health of your business and to get advice on how to improve your business.

Hazard-based risks

These types of risks come from dangerous situations in the workplace.

Some common examples include:

• physical hazards caused by high noise levels, extreme weather or other environmental factors
• equipment hazards caused by faulty equipment or poor processes when using equipment such as machinery
• chemical hazards caused by improper storage or use of flammable, poisonous, toxic or carcinogenic chemicals
• biological hazards caused by viruses, bacteria, fungi or pests
• ergonomic hazards caused by poor workplace design, layout or equipment use
• psychological hazards caused by bullying and harassment , discrimination, heavy workload or mismatch of employee skills with job duties.

Find information on managing risk in your state or territory

Australian capital territory.

Learn about risk management for your business on the Access Canberra website.

New South Wales

Read SafeWork NSW's work environment and facilities to help identify safety risks in your workplace.

Northern Territory

Read about the NT WorkSafe's small business safety program .

Read about risk management on the Queensland Government website.

South Australia

Find information on risk management on the South Australian Government website.

Read information on managing risk in your business on the Business Victoria website.

Find out what to include in your risk management plan.

Learn about the different insurance types to protect your business from risk..

Our live chat service is open from 8am - 8pm, Monday to Friday, across Australia (excluding public holidays).

Learn about the other ways you can contact us .

• Search Search Please fill out this field.

What Is a Business Plan?

Understanding business plans, how to write a business plan, elements of a business plan, special considerations.

• Business Plan FAQs

Business Plan: What It Is, What's Included, and How To Write One

Adam Hayes, Ph.D., CFA, is a financial writer with 15+ years Wall Street experience as a derivatives trader. Besides his extensive derivative trading expertise, Adam is an expert in economics and behavioral finance. Adam received his master's in economics from The New School for Social Research and his Ph.D. from the University of Wisconsin-Madison in sociology. He is a CFA charterholder as well as holding FINRA Series 7, 55 & 63 licenses. He currently researches and teaches economic sociology and the social studies of finance at the Hebrew University in Jerusalem.

Investopedia / Ryan Oakley

A business plan is a document that defines in detail a company's objectives and how it plans to achieve its goals. A business plan lays out a written road map for the firm from marketing , financial, and operational standpoints. Both startups and established companies use business plans.

A business plan is an important document aimed at a company's external and internal audiences. For instance, a business plan is used to attract investment before a company has established a proven track record. It can also help to secure lending from financial institutions.

Furthermore, a business plan can serve to keep a company's executive team on the same page about strategic action items and on target for meeting established goals.

Although they're especially useful for new businesses, every company should have a business plan. Ideally, the plan is reviewed and updated periodically to reflect goals that have been met or have changed. Sometimes, a new business plan is created for an established business that has decided to move in a new direction.

Key Takeaways

• A business plan is a document describing a company's core business activities and how it plans to achieve its goals.
• Startup companies use business plans to get off the ground and attract outside investors.
• A business plan can also be used as an internal guide to keep an executive team focused on and working toward short- and long-term objectives.
• Businesses may create a lengthier traditional business plan or a shorter lean startup business plan.
• Good business plans should include an executive summary and sections on products and services, marketing strategy and analysis, financial planning, and a budget.

Want Funding? You Need a Business Plan

A business plan is a fundamental document that any new business should have in place prior to beginning operations. Indeed, banks and venture capital firms often require a viable business plan before considering whether they'll provide capital to new businesses.

Operating without a business plan usually is not a good idea. In fact, very few companies are able to last very long without one. There are benefits to creating (and sticking to) a good business plan. These include being able to think through ideas before investing too much money in them and working through potential obstacles to success.

A good business plan should outline all the projected costs and possible pitfalls of each decision a company makes. Business plans, even among competitors in the same industry, are rarely identical. However, they can have the same basic elements, such as an executive summary of the business and detailed descriptions of its operations, products and services, and financial projections. A plan also states how the business intends to achieve its goals.

While it's a good idea to give as much detail as possible, it's also important that a plan be concise to keep a reader's attention to the end.

A well-considered and well-written business plan can be of enormous value to a company. While there are templates that you can use to write a business plan, try to avoid producing a generic result. The plan should include an overview and, if possible, details of the industry of which the business will be a part. It should explain how the business will distinguish itself from its competitors.

Start with the essential structure: an executive summary, company description, market analysis, product or service description, marketing strategy, financial projections, and appendix (which include documents and data that support the main sections). These sections or elements of a business plan are outlined below.

When you write your business plan, you don’t have to strictly follow a particular business plan outline or template. Use only those sections that make the most sense for your particular business and its needs.

Traditional business plans use some combination of the sections below. Your plan might also include any funding requests you're making. Regardless, try to keep the main body of your plan to around 15-25 pages.

The length of a business plan varies greatly from business to business. Consider fitting the basic information into a 15- to 25-page document. Then, other crucial elements that take up a lot of space—such as applications for patents—can be referenced in the main document and included as appendices.

As mentioned above, no two business plans are the same. Nonetheless, they tend to have the same elements. Below are some of the common and key parts of a business plan.

• Executive summary: This section outlines the company and includes the mission statement along with any information about the company's leadership, employees, operations, and location.
• Products and services: Here, the company can outline the products and services it will offer, and may also include pricing, product lifespan, and benefits to the consumer. Other factors that may go into this section include production and manufacturing processes, any patents the company may have, as well as proprietary technology . Information about research and development (R&D) can also be included here.
• Market analysis: A firm needs a good handle on its industry as well as its target market. This section of the plan will detail a company's competition and how the company fits in the industry, along with its relative strengths and weaknesses. It will also describe the expected consumer demand for a company's products or services and how easy or difficult it may be to grab market share from incumbents.
• Marketing strategy: This section describes how the company will attract and keep its customer base and how it intends to reach the consumer. A clear distribution channel must be outlined. The section also spells out advertising and marketing campaign plans and the types of media those campaigns will use.
• Financial planning: This section should include a company's financial planning and projections. Financial statements, balance sheets, and other financial information may be included for established businesses. New businesses will include targets and estimates for the first few years plus a description of potential investors.
• Budget: Every company needs to have a budget in place. This section should include costs related to staffing, development, manufacturing, marketing, and any other expenses related to the business.

Unique Business Plans Help

The best business plans aren't generic ones created from easily accessed templates. A company should entice readers with a plan that demonstrates its singularity and potential for success.

Types of Business Plans

Business plans help companies identify their objectives and remain on track to meet goals. They can help companies start, manage themselves, and grow once up and running. They also act as a means to attract lenders and investors.

Although there is no right or wrong business plan, they can fall into two different categories—traditional or lean startup. According to the Small Business Administration (SBA) , the traditional business plan is the most common. It contains a lot of detail in each section. These tend to be longer than the lean startup plan and require more work.

Lean startup business plans, on the other hand, use an abbreviated structure that highlights key elements. These business plans aren't as common in the business world because they're short—as short as one page—and lack detail. If a company uses this kind of plan, it should be prepared to provide more detail if an investor or lender requests it.

Financial Projections

A complete business plan must include a set of financial projections for the business. These forward-looking financial statements are often called pro-forma financial statements or simply the " pro-formas ." They include an overall budget, current and projected financing needs, a market analysis, and the company's marketing strategy.

Other Considerations for a Business Plan

A major reason for a business plan is to give owners a clear picture of objectives, goals, resources, potential costs, and drawbacks of certain business decisions. A business plan should help them modify their structures before implementing their ideas. It also allows owners to project the type of financing required to get their businesses up and running.

If there are any especially interesting aspects of the business, they should be highlighted and used to attract financing, if needed. For example, Tesla Motors' electric car business essentially began only as a business plan.

Importantly, a business plan shouldn't be a static document. As a business grows and changes, so too should the business plan. An annual review of the company and its plan allows an entrepreneur or group of owners to update the plan, based on successes, setbacks, and other new information. It provides an opportunity to size up the plan's ability to help the company grow.

Think of the business plan as a living document that evolves with your business.

A business plan is a document created by a company that describes the company's goals, operations, industry standing, marketing objectives, and financial projections. The information it contains can be a helpful guide in running the company. What's more, it can be a valuable tool to attract investors and obtain financing from financial institutions.

Why Do Business Plans Fail?

Even if you have a good business plan, your company can still fail, especially if you do not stick to the plan! Having strong leadership with a focus on the plan is always a good strategy. Even when following the plan, if you had poor assumptions going into your projections, you can be caught with cash flow shortages and out-of-control budgets. Markets and the economy can also change. Without flexibility built into your business plan, you may be unable to pivot to a new course as needed.

What Does a Lean Startup Business Plan Include?

The lean startup business plan is an option when a company prefers a quick explanation of its business. The company may feel that it doesn't have a lot of information to provide since it's just getting started.

Sections can include: a value proposition, a company's major activities and advantages, resources such as staff, intellectual property, and capital, a list of partnerships, customer segments, and revenue sources.

Small Business Administration. " Write Your Business Plan ."

• Business Development: Basic Overview of Activities 1 of 46
• Business Ethics: Definition, Principles, Why They're Important 2 of 46
• Business Plan: What It Is, What's Included, and How To Write One 3 of 46
• Organizational Structure for Companies With Examples and Benefits 4 of 46
• Which Type of Organization Is Best For Your Business? 5 of 46
• What Are the Major Types of Businesses in the Private Sector? 6 of 46
• Corporate Culture Definition, Characteristics, and Importance 7 of 46
• What Is an S Corp? 8 of 46
• LLC vs. Incorporation: Which Should I Choose? 9 of 46
• Private Company: What It Is, Types, and Pros and Cons 10 of 46
• Sole Proprietorship: What It Is, Pros & Cons, Examples, Differences From an LLC 11 of 46
• Bootstrapping Definition, Strategies, and Pros/Cons 12 of 46
• Crowdfunding: What It Is, How It Works, Popular Websites 13 of 46
• Seed Capital: What It Is, How It Works, Example 14 of 46
• Venture Capital: What Is VC and How Does It Work? 15 of 46
• Startup Capital Definition, Types, and Risks 16 of 46
• Capital Funding: Definition, How It Works, and 2 Primary Methods 17 of 46
• Series Funding: A, B, and C 18 of 46
• Small Business Administration (SBA): Definition and What It Does 19 of 46
• Upper Management: What it is, How it Works 20 of 46
• What is the C Suite?: Meaning and Positions Defined 21 of 46
• Chief Executive Officer (CEO): What They Do vs. Other Chief Roles 22 of 46
• Operations Management: Understanding and Using It 23 of 46
• Human Resource Planning (HRP) Meaning, Process, and Examples 24 of 46
• Brand: Types of Brands and How to Create a Successful Brand Identity 25 of 46
• What Is Brand Personality? How It Works and Examples 26 of 46
• What Is Brand Management? Requirements, How It Works, and Example 27 of 46
• What Is Brand Awareness? Definition, How It Works, and Strategies 28 of 46
• Brand Loyalty: What It Is, and How to Build It 29 of 46
• Brand Extension: Definition, How It Works, Example, and Criticism 30 of 46
• What Is Social Networking? 31 of 46
• Affiliate Marketer: Definition, Examples, and How to Get Started 32 of 46
• What Is Commercialization, Plus the Product Roll-Out Process 33 of 46
• Digital Marketing Overview: Types, Challenges, and Required Skills 34 of 46
• Direct Marketing: What It Is and How It Works 35 of 46
• Marketing in Business: Strategies and Types Explained 36 of 46
• What Are Marketing Campaigns? Definition, Types, and Examples 37 of 46
• How to Do Market Research, Types, and Example 38 of 46
• Micromarketing Explained: Definition, Uses, and Examples 39 of 46
• Network Marketing Meaning and How It Works 40 of 46
• Product Differentiation: What It Is, How Businesses Do It, and the 3 Main Types 41 of 46
• Target Market: Definition, Purpose, Examples, Market Segments 42 of 46
• Outside Sales: What They are, How They Work 43 of 46
• What Is a Sales Lead? How It Works and Factors Affecting Quality 44 of 46
• Indirect Sales: What it is, How it Works 45 of 46
• What Is Inside Sales? Definition, How It Works, and Advantages 46 of 46

Small Business

Trading Basic Education

How to Start a Business

Financial Advisor Careers

Business Essentials

Finding a Financial Advisor

• Terms of Service
• Editorial Policy
• Privacy Policy
• Your Privacy Choices

By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

Risk Management, Risk Analysis, Templates and Advice

• #1 Mind Mapping Tool
• Collaborate Anywhere
• Stunning Presentations
• Simple Project Management
• Innovative Project Planning
• Creative Problem Solving

The Top 50 Business Risks And How To Manage them!

Risk is simply uncertainty of outcome whether positive or negative ( PRINCE2, 2002, p239 ). Business risk is uncertainty around strategy, profits, compliance, environment, health and safety and so on. stakeholdermap.com

• The Top 50 Business Risks
• Insure assets
• Compliance with fire & building regulations
• Early warning systems e.g. smoke alarms, sprinklers.
• Credit checks
• Set credit limits
• Set payment terms for suppliers
• Use debt collection agency
• Check financial background
• Use business intelligence agencies
• Early warning indicators e.g. late payment
• Avoid single source dependence
• Good record keeping
• Use analytics to measure engagement/CTR etc.
• Provide personalized useful insights
• Less may be more
• Create creative, entertaining content
• Have a clear vision
• Set clear goals and objectives
• Regularly review strategy against market conditions
• Improve cashflow management
• Review costs and inventory
• Accountancy software use/replacement
• Careful use of long and short term financing
• Use customer success managers
• Engage throughout the customer lifecycle
• Sell to the right customers
• Provide value
• Monitor trigger events e.g. change of ownership/Senior management team
• Gather intelligence and assess risk
• Deploy a defensive strategy
• Flip the negative messages e.g. if competitor says your company is too small, push your agility and ability to focus on your customers
• Use an industry research and advisory firm like Gartner or Forrester, to scan for competitive risk
• Invest in intelligence tools e.g. social media monitoring
• Improve competitive analysis
• Outsource to or engage consultants e.g. BrandTotal
• Reduce contractual disputes with contract advice and standard terms and conditions
• Train employees on legislation, e.g. around harassment, bribery, etc
• Insure against the risk of legal action
• Have inhouse counsel or retain a legal firm
• Employee training and refresher courses
• Seek legal advice on contracts, new legislation and industry specific regulations
• Create a quality assurance team
• Implement more quality and safety checks
• Register work via a copyright registration service
• Mark all work with a copyright notice, include in all footers etc
• Take prompt action on infringment
• Train employees to recognise infringment and to avoid infringing copyright in the materials they produce on behalf of your business
• Use stock footage and images
• Develop a dedicated strategy for components that are subject to volatility
• Use financial and operational hedging
• Monitor pricing trends
• Manage inventory to soften impact of price changes e.g. stockpile
• Identify the source of low satisfaction e.g. is it difficult to do business with your company or is product quality the problem
• Use Customer Relationship Management Software
• Review product quality increase quality controls
• Implement CSAT surveys or similar to monitor sentiment
• Invest in employee including sales training
• Get the essentials in place e.g. anti-virus, firewalls, password use, whitelisting, access control, SSL, SSO
• Network and data encryption
• Conduct component driven and system driven risk assessments
• Conduct security audits
• Lock down hardware e.g. company laptops, disable USB, company image if employees bring their own device
• Have a procedure which will be triggered in the event of loss or a suspected attack
• Consider focussing on solutions rather than the product
• Review marketing materials, sales plays, provide additional sales training
• Are the right customers/markets/locations being approached?
• Identify the unique selling point
• Improve market research and Research and Development
• Repurpose product
• Decomission product
• Risk to employees of extreme weather - ensure safe temperatures at work, access to water, home working in bad weather, support with travel, accomodation etc
• Risk to facilities, buildings, resources , materials - insurance e.g. buildings and contents, invest in storm protection, fire prevention etc
• Develop an emergency prevention and recovery plan
• Identifying your most valuable data and conduct a risk assessment
• Establish effective security policy - such as prohibiting password sharing and bringing your own devices to work
• Maintain efficient data access policy
• Secure your infrastructure. such as firewall and anti-virus, separate valuable data from your corporate network and prohibit access to it. Protect border routers and establish screen subnets
• Educate employees e.g. teach them about simple security practices, that they should incorporate in their daily workflow - lock unattended laptop, use strong passwords, challenge people without ID etc
• Conduct background checks
• Create proper termination procedure
• Monitor employee activity
• Accept the risk and buy or sell currency in the spot market
• Fix rate via a forward exchange contract
• Insure against the Forex risk
• Use an Forex structured product
• Back up generators and/or off grid solutions
• Water storage on site or own bore hole
• Move location for more reliable supply e.g. rural locations have more/longer black outs
• Change products/processes to reduce reliance on utilities e.g. require less water
• Create a health and safety policy
• Identify hazards
• Evaluate the risks and complete a risk assessment
• Provide staff training e.g. on manual lifting
• Have procedures for reporting incidents.
• Consider flexible working options e.g. working from home and hot desking
• Obtain longer leases or buy freehold office space
• Consider relocation
• Use government scheme e.g. apprenticeships
• On the job training
• Offer relocation packages for skilled recruits
• Use employee incentive or bonus schemes
• Check pay reflects industry (going rate)
• Identify top performers and reward/offer incentives to stay
• Remove hygiene factors e.g. poor parking, lack of flexible working
• Identify risks ask, "How can political actors or conditions impact our business?"
• Diversify sources of materials, suppliers, site locations, markets
• Influence the political landscape via lobbying, networking, assisting candidates/parties
• Agreed fixed rates, prices. Hedge against price volatility.
• Follow recommended servicing and maintenance schedules
• Keep stock of parts
• Have contract with emergency/24/7 repair services
• Train employees on safe use, maintenance and basic repair
• Make use of early adopters to refine the product
• Ask your existing customer base what they want/need
• Invest in beta testing
• Shadow test - open product for pre-ordering
• Investment risk models
• Use value at risk in measuring portfolio risk
• Monte Carlo simulation
• Sensitivity and scenario risk measures
• Identify natural hazards
• Measure vulnerability to natural hazards
• Connect to early warning systems if required
• Use forecasts to measure proximity of risk e.g. use weather forecast to decide date for shipment
• Create plans for responding to natural disasters
• Insure against losses were possible
• Conduct due diligence
• Identify new stakeholders
• Identify challenges e.g. curroption/lack transparency in new emerging markets
• Use shadow testing and beta testing to reduce exposure and test acceptance in the new market
• Used recognised Operational Risk Management (ORM) process
• Assess risks for each operational area e.g. IT, HR, finance, security
• Automate operational workflows
• Use risk-based capital
• Improve people management
• Additional training
• Invest in infrastructure
• Implement process to respond to patent notice letters, patent assertions and lawsuits
• Budget for patent defense expenses
• Develop standing litigation teams inhouse and outside
• Join Patent Pool
• Use Rational Patent Exchange (RPX) Corporation
• Review recruitment processes - employ great managers
• Don't use promotion to a management role as reward for long service
• Invest in training for your managers
• Have open transparent process for raising grievances, whistleblowing
• Take out Political Risk Insurance (PIR)
• Assess risk in the country, use consultants or government advice e.g. U.S. Department of State's background notes
• Negotiate compensation terms with a country before locating there
• Create contingency plans
• Diversify overseas investments
• Ensure realistic forecasting and sales pipeline. Understand what % of opportunities won't win.
• Improve quality of leads, before handing opportunities to sales
• Adjust sales pipeline multiplier
• Prevent orders being shipped without payments clearing in advance
• Have revenue incentives for suppliers who meet targets
• Increase sales quotas
• Reduce costs e.g. downsize office space by moving to hot desking or consider outsourcing some functions
• Undertake operational savings initiatives with a strong ROI
• Prioritise initiatives that enable high value customers to be identified and retained
• Take out key person insurance in case of redundancy
• Revise decision making processes to make them more nimble and faster
• Freeze recruitment i.e. don't replace leavers
• Review supplier list check that alternatives are available
• Invest in compliance consultants
• Train employees on regulations e.g. GDPR
• Use analytics and technology monitor compliance activities
• Conduct a compliance risk assessment
• Reputational risk occurs when performance doesn't match expectations. Track evolving stakeholder expectations to manage the risk
• Put a plan in place to manage a reputation crisis
• Monitor sentiment online using social media monitoring tools, engage promptly
• Use variance analysis and comparisons to highlight potential inaccuracies in forecasts
• Set high, low and expected forecasts (30, 50 and 70 percent probabilities)
• Measure forecasts against actual results to improve accuracy
• Update forecasts regularly e.g. monthly
• Consider a complete shutdown during off-peak periods to reduce costs
• Adapt your services/product to the seasons e.g. skiing in winter, walking in summer
• Market in off-peak times
• Reduce opening times during off-peak periods
• Provide medical insurance with a well-being program/incentives
• Log sickness, and trigger sickness absence procedures after x days
• Separate sick pay from annual leave so that it can be tracked
• Have a fit for purpose sickness absence policy
• Know the location of your suppliers and their suppliers facilities
• Meet with your suppliers and understand their rerouting procedures and risk management procedures
• Check your suppliers are compliant with local regulations
• Diversify your approved suppliers
• Outsource and/or use Software as a Service
• Continuously review the market and technological advances
• Invest in new technology companies e.g. buy shares, acquire the company
• Invest in Research and Development team
• Beta test new technology
• Build in redundancy and use data back ups
• Use SaaS model to reduce onsite hardware
• Have power and cooling back ups e.g. generators
• Invest in monitoring and early warning systems
• Invest in security hardware and personnel
• Invest in cyber security, encryption, VPN etc
• Retail style alarms on products
• Strict access control, badges, scanners, search etc
• Integrate innovation into your business
• Assign revenue goals for the R and D/ innovation team
• Cultivate pilot ready customers or market segments
• Automate the development process
• Purchase Marine Insurance which covers sear or air transit
• Chose a suitable freight forwarder
• Understand value of shipments, split high value shipments
• Be clear on the impact of losses in the supply chain on corporate financials
• Have a contract with a temp agency for HR resources needed over peak periods
• Outsource provision of human resources e.g. Amazon warehouse model
• Set expectations with customers and stakeholders around lead times
• Invest in automation and AI to free up resource from repetitive time-consuming work
• Keep some inventory (stockpile)
• Diversify supply chain
• Adjust supply for seasonal fluctuations e.g. holiday periods.
• Diversify locations
• Have data and warehouse backups in different locations
• Insure against war, terrorism and political violence

Download the full list of Business Risks

Word download - the top 50 business risks (word), pdf download - the top 50 business risks (pdf), 20 common project risks - example risk register, checklist of 30 construction risks, overall project risk assessment template, simple risk register - excel template, business risk - references and further reading, read more on risk management.

• Risk Assessment
• Construction Risk Management
• Risk Management Glossary
• Risk Management Guidelines
• Risk Identification
• NHS Risk Register
• Risk Register template
• Risk Management Report
• Risk Responses
• Prince2 Risk Register
• Prince2 Risk Management Strategy
• Risk Management Guides
• Risk Management Templates
• 20 Common Project Risks - risk register
• Construction Risk Register
• 30 Construction Risks
• Risk Data Sheet Template
• Risk Definition
• Insurance for Risk Management
• Risk Management
• Risk Management Plan Template
• Risk Matrix 4x4 Download
• Risk Matrix 3x3 Download
• Risk Matrix - Aviation Example
• Risk Mitigation
• Overall Project Risk Assessment
• Project Risk Management
• Simple Risk Register template
• Project Management Guides
• Project Management Templates
• Microsoft Project plan templates
• Advantages of Projects and Programs
• 10 Awesome Project Management apps
• BPM Business Process Management
• BPM Examples
• Project Audit
• The Business Case
• Get the best out of Project Calendar
• ChatGPT AI for Project Management
• Change Management Process
• Change Management RACI
• Configuration Management
• Construction Management
• Definition of a Project
• Programme Management
• Project Checklists
• Project Funding
• PID - Project Initiation Document
• Project Manager Job Descriptions
• Project Life cycle
• Project Milestones
• Project Methods vs Tools
• Project Monitoring and Control
• Project Manager Salary
• Small business productivity
• Project Success Factors
• Task Management's best kept secret
• Project Teams
• Project Tolerance
• Project Triangle
• Top 10 Project Management Tools
• Variance Analysis
• Weighted Scoring Model
• What is programme management?
• What is a Project?
• Why do we need Project Managers?
• Why Project Management Fails
• Project Planning Guides
• How to Plan a Project
• Business Process Modelling WBS
• Project Plan Checklist
• Construction Project WBS
• Crashing plans
• Critical Path Analysis
• Estimate duration
• Finding a Job WBS
• Fixing start dates
• Gantt Charts
• Marketing Campaign Project Plan
• What is a Network Diagram?
• Office Move Project Plan
• Project Initiation Document (PID)
• Precedence Diagram
• Prepare House for Sale WBS
• Resource planning
• Software Development Project Plan
• Software WBS example
• Software Upgrade WBS
• Task Dependencies in Project Planning
• Task Sequence in Project Scheduling
• Timeline Maker
• Work Breakdown Structure (WBS) Checklist
• Creating a Work Breakdown (WBS)
• WBS Dictionary
• WBS Examples
• Work Breakdown Structure Template
• Microsoft Project guides
• Analyze MS Project Plan
• Viewing Critical Path
• Create Task Constraint
• How to use Constraints
• Mistakes using Constraints
• Microsoft project add Holidays
• Project Calendars
• Counting in MS Project
• Custom fields in Microsoft Project
• Using Filters
• Custom Filters in MS Project
• Highlight Project tasks
• Hyperlinks in MS Project
• Masamiki.com alternatives
• Import Outlook tasks to MS Project
• MS Project PDF
• Progress Lines in MS Project
• Scheduling problems in MS Project
• Summary tasks in MS Project
• Ten little known features in MS Project
• Timeline in Microsoft Project - QUICK Guide
• How to use Microsoft Project Timeline
• Top 10 Microsoft Project mistakes
• Microsoft project VBA examples