Business Risk Checklist
A checklist will not manage risk for you, but it stops the obvious gaps from being forgotten. Work through these items honestly, mark what is confirmed, and turn every 'no' into an action with an owner and a date.
Operations and continuity
Do you know your most critical activities? Are recovery steps documented? Have you set a maximum tolerable downtime? Has a recovery been tested, not just planned?
Cyber and information security
Are backups tested and stored separately? Is multi-factor authentication on for email and admin accounts? Are devices patched? Is there a plan for a ransomware or account-takeover incident?
Suppliers and third parties
Do you depend on a single supplier for a critical service? Do contracts cover security, availability and breach notification? Do you have a fallback if a key supplier fails?
People and knowledge
Is any critical task known to only one person? Are roles and contact details documented for an emergency? Have staff had recent security-awareness training?
Finance, legal and insurance
Is cyber and business-interruption cover in place and tested against a scenario? Are privacy obligations understood? Is there cash-flow buffer for a multi-day disruption?
How to use this checklist
Work through it with the people who actually run the work, not from memory in an office. Mark each item as confirmed, partial or missing, and attach the evidence where it exists. Then convert every missing item into one action with a single owner and a due date, and revisit the checklist at least annually.
The gaps small businesses find most often
Untested backups, a critical task known to only one person, no documented recovery steps, shared or reused admin passwords, a single supplier for an essential service, and insurance that has never been tested against a realistic scenario.
Frequently asked questions
What should a business risk checklist include?
Cover operations and continuity, cyber and information security, suppliers, people and knowledge, and finance, legal and insurance. Each item should be answerable with evidence, not opinion.
How often should I review the checklist?
At least annually, and after any significant change or incident. Set a recurring review date so it does not drift.
What if I answer 'no' to most items?
That is normal and useful. Prioritize by impact: fix the gaps that could stop your most important activity, starting with untested backups and single points of failure.
Can I use this checklist as a compliance document?
It supports good practice but is not a certification. For regulatory or audit purposes, use a formal assessment and retain the evidence.
Is there a free tool to formalize the checklist?
Yes — the AcraSolution Business Risk Score turns a short checklist into a scored snapshot, and the guided assessments produce a professional report.