What could stop you serving customers tomorrow?

Walk through an ordinary order before making a long list of possible disasters. Start when a customer contacts you and finish when you receive payment. At each step, ask what person, account, supplier or piece of equipment you depend on.

Business risk includes threats to finances, daily operations, reputation and information security. These are among the risk categories described by Nationwide. Use those categories as prompts, then write the specific event that concerns your business.

A hypothetical agency example

Imagine a small marketing agency where one person controls every client advertising account. For this planning exercise, assume that person becomes unavailable during a launch. Ask a colleague to explain how they would find approved campaign details and contact the client.

Record what they cannot access. Then assign the work needed to establish appropriate backup access and written handover instructions. Treat this as a scenario to investigate, rather than evidence that your agency already has a problem.

• Which customer payment are you relying on next?
• Which supplier has no tested alternative?
• Which task can only one person complete?
• Which account would prevent trading if access disappeared?

For supplier gaps, use the wholesale supplier selection guide to structure your next conversation. Confirm availability and delivery arrangements before naming someone as your backup.

How should you rank the risks?

Assess likelihood and impact separately. Nationwide recommends considering probability and consequences, then ranking risks to choose priorities. Its assessment guidance uses low, moderate and high categories.

For your first small business risk assessment, use plain labels and explain each judgment. Ask what evidence you have: a previous interruption, an overdue invoice or an unresolved maintenance issue. Mark unknowns for investigation.

These ratings are illustrative, not measured probabilities. Replace them with judgments about your own operation. A printing failure deserves a different impact rating in a print shop than in a consulting office.

Give serious consequences their own review

Do not let a simple ranking exercise dismiss a safety concern. Ask a qualified person to assess the situation and identify any work that should stop. For commercial decisions, also ask whether you could absorb the loss if your estimate is wrong.

Choose three priorities for the first round. Keep the remaining items visible, with a date to revisit them. Record why you chose those three so you can reconsider when circumstances change.

What should go into your business risk management plan?

Give each priority a specific response, an owner and a test. Common responses include avoiding an activity, reducing the risk, sharing or transferring it, and accepting the remaining exposure. These approaches are described in the risk treatment overview.

Write the decision in everyday language

• Avoid: postpone a commitment whose downside you cannot accept.
• Reduce: add a check or alternative way to complete the work.
• Transfer: investigate insurance for a defined financial exposure.
• Accept: document a manageable risk and the conditions for reviewing it.

Use a notebook, Excel or Google Sheets for the first version. Create columns for event, consequence, existing protection, next action, owner, deadline and test result. My recommendation is to choose whichever format the responsible person will actually maintain.

For a hypothetical freelancer, write: “If my laptop becomes unavailable, I need access to current project files on another approved device.” Assign a file recovery test and record what was missing. Do not mark the item complete simply because a backup arrangement exists on paper.

Write recurring tasks using this standard operating procedure guide. A standard operating procedure is a written explanation of how to complete a task. Include the handover contact and what to do when the normal instructions cannot be followed.

How do cash planning and insurance fit together?

Start by reviewing money due in and money due out. Customer concentration and debt are financial risks highlighted in Nationwide's small business guide. Test your exposure using your own payment dates.

Run a delayed payment exercise

In a hypothetical cash planning exercise, move your largest expected receipt to a later week. Check whether payroll, rent and supplier payments still fit. Discuss any gap with your bookkeeper before making new commitments.

Use the cash flow planning guide to organise this review. For money already late, follow a documented process using the overdue payment guide. Keep expected payment promises separate from money actually received.

Ask about specific losses when reviewing insurance

Insurance can transfer some financial exposure, but actual coverage depends on the contract. Nationwide explicitly distinguishes general descriptions from individual policy terms in its insurance guidance. Take your risk list into the conversation.

• Would this particular event be covered?
• Which losses would remain my responsibility?
• What exclusions and payment limits apply?
• What records would I need to provide?
• What must I do when an incident happens?

Ask the adviser to point to the relevant wording. Compare proposals using the business insurance selection guide. Check local requirements separately rather than treating an American insurer's examples as rules for your country.

Where should you start with cyberattack risk?

List the accounts and information needed to take orders, deliver work and receive payments. Nationwide recommends staff education about suspicious messages, password practices and security measures in its cybersecurity section. Turn that advice into a short team exercise.

Rehearse a suspicious payment request

Use a hypothetical email claiming that a supplier has changed bank accounts. Ask the person handling payments how they would verify it. Agree to confirm changes through a previously established contact route before paying.

Explain phishing as a deceptive message designed to obtain information or prompt an unsafe action. Keep the exercise fictional and never collect real passwords during training. Ask staff where they would report a suspicious request.

• Identify who controls each important business account.
• Review access belonging to former workers or contractors.
• Choose someone to maintain recovery information securely.
• Test whether an authorised person can recover a sample business file.

Write down the failed steps and assign repairs. Where the team lacks the knowledge to assess a system, ask your IT provider to explain the recovery process and demonstrate it safely.

How can you prepare for disasters and emergencies?

Prepare a response plan that staff can find and practise. The SBA recommends assessing relevant hazards, tailoring a plan to the business and rehearsing it with employees. Its emergency preparedness guidance provides that sequence.

Separate immediate safety from business recovery

Put your approved safety instructions first. Have the appropriate local specialist check the arrangements for your premises. Then write a separate recovery page covering customer communication, outstanding orders and the conditions for restarting work.

• Who contacts staff and checks their availability?
• Who sends customer updates?
• Where is the latest list of unfinished orders?
• Which work could continue from another suitable location?
• Who authorises reopening, and after which checks?

For a hypothetical online shop, rehearse losing access to the usual packing space. Locate the orders, decide who contacts affected customers and identify what must be confirmed before promising new dispatch dates.

Draft a customer message with three parts: what is affected, what happens to existing orders and when the next update will arrive. Avoid promising a reopening time before you have evidence. Keep an accessible printed copy of essential contacts as well as a protected digital version.

What should you finish this week?

Aim to finish three usable responses and one rehearsal. Adapt this suggested schedule to your workload. Ask each owner to bring evidence of completion, such as a confirmed contact, a corrected instruction or a recorded test.

1. Monday: map one customer order and list its dependencies.
2. Tuesday: assess the risks and select three priorities.
3. Wednesday: assign actions, owners and deadlines.
4. Thursday: verify backup arrangements and insurance questions.
5. Friday: rehearse one interruption and repair the gaps.

Set a review date before ending the meeting. Add a fresh review when you introduce a location, service or supplier. Check whether the reasons behind your original ratings still apply.