Free template

Business Risk Assessment Template

A risk register, coverage sheets and a committee report that check what insurance would pay for each risk, then rank risks by what the business keeps.

Edit with AI Download (.docx + .csv)

Free download · No account needed

What you get

Pack of 7 files: 3 documents, 4 spreadsheets

Business Risk Assessment Template

How a Retained Layer Is TypedDocument
Risk AssessmentDocument
Treatment RecommendationsDocument
Risk RegisterSpreadsheet
Coverage RegisterSpreadsheet
Control CoverageSpreadsheet
Gap AnalysisSpreadsheet

Business Risk Assessment Template

Risk Assessment · Rowan Provision Co. · two plants, six policies · assessed 14 Sep, renewal 31 Dec

Sorted on what the client keeps, not on probability times impact

Risk	Score	Retained	Where the transfer stopped
Listeria recall on a co-packed retail brand	10 #4	$5,400,000	Sublimit. $1,000,000 for recall inside the liability aggregate
Ransomware stops the ERP and plant scheduling	20 #1	$2,900,000	Contingent. The cyber application warranted a second factor on all remote access
Freezer bank failure at Fresno	12 #2	$1,250,000	Contingent. Alarm monitoring contract lapsed 14 March
Ammonia release at Fresno	5 #8	$1,100,000	Excess of limit. $3,100,000 against $2,000,000
Meal-break class action at Reno	12 #3	$800,000	Excess of limit. $1,800,000 against $1,000,000
Sole-source pectin supplier fails	9 #5	$740,000	No policy. Contingent business interruption was never bought
At-fault injury on the Reno delivery route	8 #7	$500,000	Layer gap. Umbrella attaches at $1m, auto renewed at $500k
Loss of the manager holding the retort schedule	9 #6	$420,000	No policy. Key person is not on the schedule

Risk

Score

Retained

Where the transfer stopped

Listeria recall on a co-packed retail brand

10 #4

$5,400,000

Sublimit. $1,000,000 for recall inside the liability aggregate

Ransomware stops the ERP and plant scheduling

20 #1

$2,900,000

Contingent. The cyber application warranted a second factor on all remote access

Freezer bank failure at Fresno

12 #2

$1,250,000

Contingent. Alarm monitoring contract lapsed 14 March

Ammonia release at Fresno

5 #8

$1,100,000

Excess of limit. $3,100,000 against $2,000,000

Meal-break class action at Reno

12 #3

$800,000

Excess of limit. $1,800,000 against $1,000,000

Sole-source pectin supplier fails

9 #5

$740,000

No policy. Contingent business interruption was never bought

At-fault injury on the Reno delivery route

8 #7

$500,000

Layer gap. Umbrella attaches at $1m, auto renewed at $500k

Loss of the manager holding the retort schedule

9 #6

$420,000

No policy. Key person is not on the schedule

$18,210,000 of severity, $13,110,000 of it retained. Seven of the eight rows change rank between the two orders, and not one risk is transferred down to its own deductible.

Page 1 of 1202 words

How to do a business risk assessment

A business risk assessment lists the events that could seriously harm a company, estimates how likely and how costly each one is, and decides what to do about each. A good one bases every estimate on a record, such as an incident log or an inventory value. It checks what the company's insurance would really pay, ranks risks by the loss the company would keep, and gives each one an owner and a date.

The principle that matters most: insurance is a fact you check, not a plan you write. The company bought its policies before you started, and they state the limits to the dollar.

A technician holding a folder of documents looks up at stainless steel pipes and valves in a production plant — Check every condition a policy sets on site, not just on paper. Photo: TECNIC Bioprocess Solutions on Unsplash

List each risk as a specific event

Set the scope first: one company or business unit, and the date its insurance renews. Then write each risk as an event with a cause and a cost: "ransomware stops order processing for two weeks," not "cyber risk." You can price an event and match it to a policy, but not a category.

Gather records before you hold a workshop, which is better for testing a list than for building one. Ask for:

Every policy, with its declarations page, endorsements and signed applications
Loss runs (each insurer's claims history), including declined claims
Incident, maintenance, quality and security logs
Payroll, inventory and customer order values
Any earlier risk register

If the business depends on one software vendor, give it a separate vendor risk assessment that checks its security report against what you rely on.

Put a record behind every number

Read likelihood from a count, not a vote: three compressor faults in 12 months of maintenance logs is evidence, and "medium" is an opinion. Read severity from a value the company already holds, such as peak inventory or a large customer's annual orders.

Where the numbers come from (illustrative)

Risk	Likelihood read from	Severity read from
Freezer failure	Three compressor faults in 12 months of maintenance logs	Peak one-day value of stock in the freezers
Ransomware	Two phishing incidents in 18 months of security logs	Gross margin lost over an 18-day outage
Ammonia leak	None in nine years of injury and illness records	What an insurer set aside for a similar claim

No record? Leave the cell blank and name what would fill it.

Score likelihood times impact if the board wants a heat map, but don't sort on it. In a 2008 paper in the journal Risk Analysis, Louis Anthony Cox Jr. showed that risk matrices can assign higher ratings to quantitatively smaller risks¹. They can also give identical ratings to very different ones.

Read the insurance before you rank

Cover changes the order, so open every policy first. The declarations page gives the limits, deductibles and dates, and the endorsements widen or narrow that cover.

Work from the policies, not certificates of insurance. Texas law defines a certificate as a summary of coverage issued to someone outside the policy. A certificate, it says, is not a policy of insurance and does not amend, extend, or alter the coverage².

Look hard for sublimits. The International Risk Management Institute (IRMI), an insurance reference publisher, defines one as a cap on one type of loss. It is part of, rather than in addition to³, the limit that would otherwise apply. In IRMI's example, a $2 million property policy may have a $100,000 sublimit for flood.

Check exclusions too. IRMI describes a general liability exclusion, commonly called the product recall exclusion⁴, for the cost of withdrawing your own products. If recall is one of your risks, find what pays for it.

Last, compare each umbrella's attachment point, where its cover starts, with the limit of the policy beneath it. If the umbrella starts at $1,000,000 and the auto policy below renewed at $500,000, the layer between may be the company's to pay.

Work out what the company keeps

For each risk, name the policy that would pay and the limit that applies. The insurer pays the loss above the deductible, up to that limit. The company keeps the rest: its retained exposure. Anything it keeps beyond the deductible has one of five causes.

Five reasons a company keeps more than its deductible

Reason	What happens	Usual fix
Excess of limit	The loss runs past the limit	More limit, or a smaller worst case
Sublimit	A smaller cap inside the policy applies	A separate policy, or a higher sublimit
Layer gap	An umbrella starts above where the policy beneath stops	Raise the lower limit, or lower the attachment point
Contingent	A policy condition isn't being met	Meet it, then tell the broker in writing
No policy	Nothing in the program responds	Accept it in writing, or shrink the worst case

ExampleOne risk, ranked two waysAn illustrative example written for this guide. The food maker is made up.

Risk: a listeria recall of a brand the company packs for a retail customer. Likelihood 2 of 5, from one quality hold in 24 months. Severity $6,400,000, that customer's orders last year.
Heat map score: likelihood 2 × impact 5 = 10, fourth of eight risks.
Cover: general liability, $2,000,000 limit, $100,000 deductible. Recall cover is an endorsement with a $1,000,000 sublimit.
The insurer pays $1,000,000 and the company keeps $5,400,000, the largest figure on its register. The risk moves to first.

The limit that applies. The $1,000,000 sublimit, not the $2,000,000 on the certificate.
Same event, new rank. Nothing about the risk changed. Only the arithmetic did.

Check the conditions each policy sets

Policies also set conditions, and an unmet one can leave a risk uncovered. IRMI explains that a protective safeguards endorsement on a property policy makes it a condition of coverage⁵ that safeguards such as a sprinkler system stay in operation. If one stops working and the insurer isn't told, coverage is suspended until the protection is restored.

The signed application matters too. IRMI notes that a warranty can be a statement of fact given to an insurer⁶ about the risk, one that will void the policy if it is untrue. If a cyber application says all remote access uses multi-factor authentication, check every remote login, including vendors'.

Log each condition as met, partly met or unmet, with the evidence you saw. Until an unmet condition is fixed, you can't rely on that cover, so count the whole loss on the risk it protects as retained.

Have a broker or lawyer confirm coverage

This guide and the template are not legal or insurance advice. Whether a policy pays depends on its exact wording and the governing state law. Before you report a risk as uninsured, ask the company's broker or a coverage lawyer to read the policy.

Write up the business risk assessment

NIST, the US standards agency, lists the responses to a risk as accepting, avoiding, mitigating, sharing, or transferring⁷ it. Insurance is the sharing or transferring, and you've already priced it. The decisions left are whether to avoid the risk, cut the loss or its odds, buy more cover, or accept the rest.

Rank actions by retained exposure removed per dollar. Small fixes can lead the list: reinstating a lapsed alarm contract, adding a second login factor for one vendor, or raising a limit to meet the umbrella. Give each action an owner and a date, and split what finishes before the renewal from what waits.

Where no policy responds, accepting the risk is a real decision. Record the amount, the officer with authority to carry it and the date they signed. A risk nobody has priced hasn't been accepted. It has been overlooked.

Before you present it

Every likelihood and severity names its record
Every limit was read from a policy, not a certificate
Each umbrella's attachment point meets the limit beneath it
Every policy condition is marked met, partly met or unmet
Risks are ranked by what the company keeps, with the score alongside
Every action has an owner, a cost and a date

Then plan for the risks the company keeps: a business continuity plan covers how work carries on, and an incident response plan covers a cyber attack. The template on this page follows this order, and Edit with AI in River asks for the policies before it prices any risk.

How to use this template

Use the files as they are, or open them in River. Edit with AI starts with the insurance, not the risks. River asks for every policy with its endorsements and any signed applications, the claims history, your operating records and the renewal date. It builds the coverage register from the declarations pages, then prices each risk against the policy that would pay and checks each condition the policies set.

Download it or open it in River
Get the three Word documents and four CSV sheets free, or open them in River and start with your policies.
Read the policies first
Fill the Coverage Register from each declarations page and endorsement before you score a single risk.
Price each risk
Log each risk with the records behind it, match it to the policy that would pay, and work out what the company keeps.
Write it up and assign owners
Draft the Risk Assessment and Treatment Recommendations yourself or with River, with an owner and a date on every action.

What's in the template

Policy	Cover	Retention	Limit	Sublimits inside it
PKG-9920	Property	$50,000	$5,000,000	None
PKG-9920	General liability	$100,000	$2,000,000	Recall expense $1,000,000, pollution $500,000
CYB-4471	Cyber and network interruption	$250,000	$2,000,000	Dependent business interruption $500,000
EPL-2210	Employment practices	$150,000	$1,000,000	Wage and hour defense $250,000
AUT-3315	Commercial auto liability	$0	$500,000	None. Renewed down on 1 Jan
UMB-0088	Umbrella, attaches at $1,000,000	$0	$5,000,000	Requires underlying auto at $1,000,000

Ref	Likelihood read from	Severity read from	P	Sev
R-01	Two credential-phishing incidents in 18 months of security records	18 days of the FY25 gross margin run rate	4	$2.9m
R-02	One hold-and-release in 24 months of QA deviation records	The largest co-pack customer’s 2025 purchase order value	2	$6.4m
R-03	Three compressor faults in the 12-month maintenance log	Highest single-day Fresno freezer value in the warehouse system	3	$1.25m
R-04	41 unsigned meal-waiver forms in the Reno personnel files	214 non-exempt employees against the payroll register lookback	3	$1.8m
R-05	Two allocation notices from the pectin supplier since March	Eleven weeks of the affected lines at standard margin	3	$740k
R-06	No release in nine years of injury and illness records	The reserve a carrier set on a comparable 2019 release	1	$3.1m
R-07	One name on 22 of 31 retort schedule change records	Six weeks of retort downtime at standard margin	3	$420k
R-08	Two at-fault collisions in 36 months of the fleet log	The carrier’s own reserve on the 2024 Reno claim	2	$1.6m

Ref	What the policy requires	What is happening	Gates	Status
C-01	A second factor on all remote access	The Reno line-controller vendor arrives on a shared password	R-01	Unmet
C-02	Refrigeration alarms monitored to a central station	Contract lapsed 14 March, alarms still sound locally	R-03	Unmet
C-04	Underlying auto liability of $1,000,000	Auto renewed at $500,000 on 1 January	R-08	Unmet
C-05	Complaint procedure issued to every employee	Issued in English, Spanish version not distributed at Reno	R-04	Partial
C-07	Backups held offline and restore-tested	Offline, last proven restore 11 months ago	R-01	Partial
C-03	Recall plan tested in the last 24 months	Tabletop test 9 February with an attendance record	R-02	Met
C-06	Ammonia detection tested to the written procedure	Quarterly tests logged, last 22 August	R-06	Met

Ref	Type	Retained	Action	Cost	After
R-02	Sublimit	$5,400,000	Dedicated recall policy, or a cap in the co-pack agreement	Renewal	Quote
R-01	Contingent	$2,900,000	Second factor on the vendor tunnel	$18,000	$900,000
R-03	Contingent	$1,250,000	Reinstate the alarm monitoring contract	$9,600	$50,000
R-06	Excess of limit	$1,100,000	Board decision on buying the extra limit	Renewal	Quote
R-04	Excess of limit	$800,000	Higher limit, or cure the 41 unsigned waivers	Renewal	Quote
R-05	No policy	$740,000	Accept in writing, or qualify a second pectin source	Decision	$740,000
R-08	Layer gap	$500,000	Restore the auto limit to the attachment point	$6,400	$0
R-07	No policy	$420,000	Accept in writing, or train a second scheduler	Decision	$420,000

Risk AssessmentThe committee report: severity against what is retained, both rankings side by side, and where every number came from.
Treatment RecommendationsActions ranked by exposure removed per dollar, each with an owner and a date, plus the accept decisions.
How a Retained Layer Is TypedA short guide to the five reasons a company keeps part of a loss, and the fix for each.
Coverage Register sheetOne row per policy: retention, limit, attachment point, sublimits and exclusions, with the page each came from.
Risk Register sheetEach risk's likelihood and severity, the record behind each, and its rank by score and by retention.
Control Coverage sheetEach condition the policies set, whether it is met today, the evidence checked and the risk it affects.
Gap Analysis sheetWhat each risk retains, which of five reasons applies, the action that closes it and what that costs.

Common questions

What should a business risk assessment template include?

It should list each risk with its likelihood, severity, owner and planned response. A stronger template also names the record behind every estimate, lists the insurance policies with their limits and conditions, and shows what the business would keep on each risk. It ends with a written assessment for the board and a dated action plan. This template includes all of them.

How often should you do a business risk assessment?

Once a year is a sensible minimum, timed a few months before the insurance renewal so fixes can land first. Update it sooner after a big change, such as a new site, product, major customer or acquisition, a large claim, or a policy renewed on different terms.

What is retained exposure?

Retained exposure is the part of a loss a business would pay itself after insurance. It adds the deductible, anything above the limit that applies, any uninsured layer between two policies, and the whole loss where no policy responds. A cautious assessment also counts the whole loss on any risk whose policy condition is unmet. Ranking on it shows what the business carries.

Is a certificate of insurance enough to assess coverage?

No. A certificate only summarizes cover for someone outside the policy, and it doesn't change what the policy pays. Read the policy itself for the sublimits, exclusions and conditions that decide a claim. Ask the broker for each declarations page and endorsement by policy number. If you must start from certificates, mark those rows as provisional.

What's the difference between a risk assessment and a risk register?

A risk register is the running list: each risk with its likelihood, severity, owner and status. A risk assessment is the work of finding and weighing those risks, and the report that comes out of it. That report explains where each number came from, what insurance would pay, what the business keeps and what to do next. This template gives you both.

Is this business risk assessment template free?

Yes. Download the three Word documents and four CSV sheets with no signup. They come filled with a worked example, a made-up food manufacturer with two plants, so you can see how each sheet works before you clear it. Edit with AI opens the same template in River.

What does Edit with AI do?

It opens the template in a free River workspace. River asks for your policies, endorsements and signed applications, the claims history, incident and maintenance records and the renewal date, and reads the policies before it scores any risk. It prices each risk against the policy that would respond and flags unmet conditions. It doesn't place insurance or recommend an insurer.

Sources

Risk Analysis. “What's wrong with risk matrices?” pubmed.ncbi.nlm.nih.gov (opens in a new tab)
Texas Legislature. “Insurance Code Chapter 1811. Certificates of Property and Casualty Insurance.” statutes.capitol.texas.gov (opens in a new tab)
International Risk Management Institute. “sublimit.” irmi.com (opens in a new tab)
International Risk Management Institute. “sistership liability exclusion.” irmi.com (opens in a new tab)
International Risk Management Institute. “protective safeguards endorsement.” irmi.com (opens in a new tab)
International Risk Management Institute. “warranty.” irmi.com (opens in a new tab)
NIST. “risk response - Glossary.” csrc.nist.gov (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedIn GitHub X

Reviewed by

Brian Joseff, Co-founder, River

LinkedIn X

Business Risk Assessment Template

Sorted on what the client keeps, not on probability times impact

How to do a business risk assessment

List each risk as a specific event

Put a record behind every number

Read the insurance before you rank

Work out what the company keeps

Check the conditions each policy sets

Write up the business risk assessment

How to use this template

Download it or open it in River

Read the policies first

Price each risk

Write it up and assign owners

What's in the template

Coverage Register

Risk Register

Control Coverage

Gap Analysis

Common questions

Sources

Chandler Supple

Related tools and templates

More free templates