How to Run a Small Business Risk Assessment in 5 Steps

Small business owner reviewing business risks in a practical office setting

If you have read our post, What Is Risk Management and Why Every Small Business Needs It, you already know that risk management is not just about avoiding problems. It helps you make better decisions, protect your people and keep your business operating when something unexpected happens.

A small business risk assessment is a practical way to identify what could go wrong, understand the potential impact and decide what to do about it. You do not need a complicated system or a large compliance department. You need a clear process that reflects how your business actually operates.

Here is a simple five-step approach.

1. Decide what you are assessing

Start by defining the scope of your risk assessment. You might assess the whole business or focus on one area, such as:

  • Workplace health and safety
  • Staff and human resources
  • Cybersecurity and data
  • Cash flow and financial management
  • Suppliers and contractors
  • Customer service and reputation
  • Business continuity
  • Legal and compliance obligations

For many small businesses, it is useful to begin with the risks that could cause the most serious disruption. Ask yourself:

  • What could stop us from operating?
  • What could seriously injure or harm someone?
  • What could lead to a major financial loss?
  • What could damage our reputation?
  • What risks are becoming more likely as the business grows?

You should also consider your WHS obligations. These cover physical hazards, such as equipment, vehicles, slips and falls, as well as psychosocial risks that may affect workers’ mental health.

Psychosocial hazards can include excessive workloads, poor support, bullying, harassment, workplace conflict, unclear roles, low job control, remote or isolated work and poorly managed organisational change.

Small business team identifying workplace hazards during a practical walk-through

2. Identify the hazards and risks

Walk through your business and list anything that could cause harm or disruption. Include risks that are obvious and those that may be less visible.

You can identify risks by:

  • Speaking with employees and contractors
  • Observing how work is carried out
  • Reviewing past incidents, complaints and near misses
  • Checking absenteeism, staff turnover and customer complaints
  • Reviewing contracts, insurance policies and supplier arrangements
  • Considering what could happen during an emergency or business interruption

It is important to involve your workers. They often understand the day-to-day risks better than anyone else, particularly where workarounds, time pressures or communication issues have developed.

Think beyond physical safety. For example, a small retail business might identify:

  • Manual handling injuries from moving stock
  • Slips caused by wet floors
  • Theft or customer aggression
  • A single supplier failing to deliver
  • A cyberattack affecting its point-of-sale system
  • Inadequate staffing during busy periods
  • Employees experiencing unreasonable workloads or poor support

For psychosocial risks, ask questions in a respectful and confidential way. Do workers have realistic workloads? Are responsibilities clear? Can they raise concerns safely? Are workplace issues dealt with promptly and fairly?

3. Assess the likelihood and consequences

Once you have identified the risks, assess how serious they are. A simple risk matrix can help you prioritise.

For each risk, consider:

  1. Likelihood: How likely is this to happen?
  2. Consequence: What would happen if it did?
  3. Exposure: How often and for how long are people exposed?
  4. Existing controls: What is already being done to reduce the risk?

You can rate each risk as low, medium, high or extreme. The exact labels matter less than using a consistent approach.

For example:

Risk Likelihood Consequence Priority
Key supplier becomes unavailable Possible Major High
Employee slips in storage area Possible Moderate Medium
Business email account is compromised Likely Major High
Staff workload becomes unreasonable Possible Major High

Do not focus only on the risks that are easiest to measure. A workplace culture problem may not appear in your financial records, but bullying, excessive workload or poor management can lead to psychological harm, complaints, absenteeism, turnover and legal exposure.

Under Australian WHS laws, businesses must eliminate risks where reasonably practicable. If elimination is not reasonably practicable, risks must be minimised as far as reasonably practicable. Safe Work Australia provides guidance on identifying, assessing and controlling hazards.

4. Decide how to control the risks

The next step is to decide what you will do. The best controls address the source of the risk rather than relying only on people to be more careful.

For example:

  • Instead of reminding staff to work faster, review whether staffing and deadlines are realistic.
  • Instead of relying only on manual handling training, change how heavy stock is stored and moved.
  • Instead of telling employees to manage stress, examine workloads, role clarity and management support.
  • Instead of hoping a supplier will recover quickly, identify alternative suppliers and hold appropriate backup stock.
  • Instead of only training staff about phishing, improve email security and access controls.

For psychosocial risks, controls may include:

  • Adjusting workloads, deadlines or staffing levels
  • Clarifying responsibilities and performance expectations
  • Giving workers more input into how tasks are performed
  • Improving communication during business changes
  • Providing regular supervision and support
  • Setting clear expectations about respectful behaviour
  • Establishing a fair process for handling bullying, harassment and conflict
  • Reducing unnecessary isolation for remote or lone workers

Support services and training can be helpful, but they should not be the only response to a problem caused by poor work design or management practices. Safe Work Australia’s guidance on psychosocial hazards explains why workplace controls should address the underlying causes of harm.

Small business manager recording controls in a simple risk register

5. Record, review and improve

A risk assessment is only useful if it leads to action. Record your decisions in a simple risk register or action plan.

For each risk, note:

  • The risk or hazard
  • Who may be affected
  • The level of risk
  • Existing controls
  • Further actions required
  • The person responsible
  • The target date
  • The review date

You do not need a lengthy document. A spreadsheet or shared document may be enough for a small business. The important thing is that responsibilities and deadlines are clear.

Review your risk assessment regularly and whenever something changes, such as:

  • You introduce new equipment or technology
  • Your business moves premises
  • You employ more people
  • You change suppliers or work processes
  • You begin offering a new service
  • An incident, complaint or near miss occurs
  • Workers report that existing controls are not working

Psychosocial risks also need ongoing review. Check whether workload, support, behaviour and communication have improved in practice, rather than assuming that a new policy has solved the problem.

Consult workers during the review. They can tell you whether controls are realistic, whether new hazards have emerged and whether the business is managing risks consistently.

A small business risk assessment is a business tool

Risk assessment is not just a compliance exercise. It can help you:

  • Reduce avoidable incidents and downtime
  • Protect employees, customers and contractors
  • Strengthen business continuity
  • Improve decision-making
  • Identify gaps in insurance and contracts
  • Build a healthier workplace
  • Meet WHS and other legal obligations
  • Increase confidence when taking on new work

The key is to start with the risks that matter most. A short, practical assessment is better than a complex document that no one uses.

Need help with your risk assessment?

Integrated Risk & Compliance helps Australian SMEs manage risk, compliance and HR in a practical way. We can help you identify business, WHS, psychosocial and people-related risks, then develop clear actions that suit the size and needs of your business.

If you are unsure where to start, contact Integrated Risk & Compliance for advice that helps you protect your people, meet your obligations and support sustainable growth.

Useful guidance