BUSINESS RISK ASSESSMENT QUESTIONNAIRE

COMPLETED BY	DATE

Gain context regarding your organization’s risk culture by asking these questions about the business as a whole.

What is the company’s overall risk appetite?
Is risk management important to achieving the organization’s objectives?
Are there systems in place to identify and react to changes that may affect the organization? (Such changes include things like new laws.)
Are robust controls in place for accounting and financial matters?
Is there a history of fraud or compliance issues?
What is the company’s reputation?
What is the communication climate? What communication barriers are in place? Are people punished for speaking up?
Is management well informed about what happens on the front lines of the business?
Is there an active program for monitoring and reporting risks?
Are the safety and education programs adequate?
Does the board provide strong oversight of management by reviewing decisions that entail taking on more risk?
Is management stable?
Does the organization do contingency and continuity planning?

What is your mission?

What are your long-term goals or objectives?

What are your short-term goals or objectives?

What are the core processes or major functions that help you achieve your mission, goals, and objectives?

For each core process or major function, list the key activities involved.

CORE PROCESS / MAJOR FUNCTION	KEY ACTIVITIES INVOLVED

What are the risks to these activities?

Brainstorm both objective (measurable) and subjective (qualitative) risks, like worker injuries and economic downturns.

Drill down to understand the risk factors for each activity by asking questions such as the following:

What tends to go wrong in this process or function?

What could cause the process to fail?

What kinds of events would be catastrophic for this function?

What are the biggest concerns of the frontline workers in this area?

Are the processes and activities straightforward and repeatable or are they complex and subject to change?

Is the staff well trained?

Are procedures clear and well documented?

Do staff members ever face pressure to skip or deviate from standard procedures for any of the following reasons: because they need to meet deadlines; because they lack materials, time, or managerial support; or because the procedures are cumbersome or do not make sense?

Do staff members routinely work long hours, overnight, or fluctuating shifts?

Has there been high turnover or have key personnel left in the past year?

Has the company restructured the function or changed the function’s activities in the past year?

Are measures in place to ensure safety?

Have IT systems caused problems in this activity?

Are exceptions, faults, errors, variances, and problems monitored and reported?

What risks have increased and decreased in the past year and why?

Has the company considered what would happen regarding this function if a major disruption were to occur? (Major disruptions include such events as the loss of facilities, key personnel, or IT systems?

If the risks you identified were to occur, what would be the impacts of these risks on the business?

Try to estimate the impacts of these risk occurrences on the following areas of your business: financial, operations, marketing, reputation, legal, workforce, environmental, property/assets, and intellectual property. Also, describe the impact severity and duration of each kind of risk occurrence.

RISK	IMPACT	SEVERITY	DURATION

DISCLAIMER Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.