Developing a risk management plan from a risk assessment

Key points

• Understanding different types of risks that could impact your business
• Putting together a risk management plan
• Reviewing and updating your plan
• Consulting with stakeholders and advisors

From intellectual property disputes to costly data breaches, business owners are frequently exposed to a variety of risks. Despite this, for time-poor business owners, risk assessment and risk management plans can often fall to the bottom of the to-do list. However, every hour spent safeguarding your business against risks is an investment in the future of your business – time well spent! 

Understanding different types of business risk

Business risks come in many forms. Considering the different types of risks your business may attract will give you an understanding of what business risks to plan for. 

• Reputational risk refers to the potential for negative publicity or public perception of a business. This could result from poor online reviews
• Operational risk includes incidents such as errors leading to loss of stock caused by flawed or failed processes or systems, as well as natural disasters that disrupt business operations or damage business equipment or premises.
• Compliance risk includes scenarios such as your business being fined by a regulatory body for not complying with laws.
• Financial risks can include a business defaulting on loans, or a business being owed funds from an insolvent business. 
• Security risks can be something that could cause harm to people or that exposes personal or confidential information unintentionally. This includes cybersecurity breaches and physical risks such as your business premises being broken into. 

What is a risk assessment?

Business risk assessment involves analysing a range of factors including the type and level of risk, and the likelihood and consequences of that risk occurring. If you don’t already have your own risk assessment method, a good place to start is with ANZ’s business risk assessment checklist.

Workplace safety logs, hazard logs, incident reports, financial audit reports, customer complaints and staff feedback are all important sources of information that can be used to identify risks to your business.

Putting together a risk management plan

Once you’ve identified a risk, it’s time to create systems and processes to manage (and minimise) that risk, including actions to take if an event unfolds. For example, to manage a security risk you may create a process that ensures anti-virus software is updated regularly, data is backed up frequently and multi-factor authentication is used on devices.

To protect your business against financial losses you may decide to review your insurance policies and develop processes for evaluating debtors on a weekly basis.

Reviewing and updating your risk management plan

Running a business is a dynamic situation that changes daily. As your business grows and evolves, so should your risk management plan. Importantly, you should consider adapting your plan when you move premises, open new locations, enter new markets, grow your workforce or add new products or services that attract a broader risk.

Ideally, your risk assessment and risk management plan should be reviewed annually to ensure it is relevant, accurate and meets your business needs.

Consulting with stakeholders and advisors

Business owners are often under cost pressures which can result in them tackling everything on their own. But when it comes to business risk assessment and planning, winging it might not be your best option.

Depending on what type of business you’re running, you may need to consult with other professionals. Lawyers, accountants, insurers, banks, local councils, public relations professionals and industry-specific consultants may be useful people to engage with when undergoing the risk assessment and planning process.

Next steps

If you are looking to start your own business or haven’t reviewed your risk management plan recently, use our risk assessment checklist as a place to start

Cyber criminals are getting more sophisticated each year. Learn about protecting your business against cybercrime.