Understand your business
Identify the risks
Assess the risks
Address the risks

Operating with risk is a reality for any business. Risks can be generated from within a business or from external circumstances.

Your business is also at risk of major crises that could impact upon the business’ operating capacity – a bushfire may break out in the region, or a disease epidemic may mean that people are not visiting your area. 

It will simplify the management of any situation if you have thought through the range of possible risks, and have identified how you would respond or cope with them. Your business is also subject to Occupational Health and Safety legislation under which you have a duty of care to protect your staff and customers.

Planning gives you the opportunity to acquire appropriate resources you may need to respond effectively, or to implement processes that will address the situation, and to train staff accordingly.

The process to manage risk involves thinking through the following:

1. Understand your business
What does your business need in order to operate successfully?

2. Identify the risks
What are the different risks that may occur and impact upon your business?

3. Assess the risks
What is the likelihood of these risks occurring?
What is the likely level of impact they could have on your business?

4. Address the risks
What would need to be done to address these risks if they happened, or to reduce the chance of them occurring? A useful step is to take out adequate insurance cover to help protect your business against those risks.

Further details on how to undertake each step is explained below.

It can be helpful to gather a small team of people to consider the above steps. This may be yourself and a business partner, or several senior staff in your organisation. Make sure the team members represent all the key areas of your business. Your peak industry sector association, local council and local emergency services can also be useful to consult.

Understand your business

To manage risk in your business requires understanding how your business operates.

It means understanding what the essential ingredients are that make your business operate smoothly and successfully.

Consider things like:

• Suppliers or systems important for your business to work
• Technical systems your business relies on
• Important records or information that are essential for your business
• Security systems that require knowledge of codes or passwords, or keys, to access important property or equipment
• Particular people or other businesses that you rely upon to survive
• Legal or other obligations that you must comply with as part of your business practice

Make a list of all important contacts and information for use in the event of an emergency.

Occupational Health & Safety
Under the Occupational Health & Safety Act Victoria (2004), all employers must exercise a duty of care to ensure the safety of staff and visitors when on their property, or undertaking a service provided by the business.

To help understand your obligations, information is available from WorkSafe Victoria in booklets or downloads from their website worksafe.vic.gov.au. These include Workplace Health & Safety Policies, Procedures & Evaluation – Getting Started and Health and Safety: The Best Investment For Small Business.

WorkSafe Victoria
Ground Floor
222 Exhibition Street
Melbourne 3000
Phone: (03) 9641 1555
Fax: (03) 9641 1222
Website: worksafe.vic.gov.au

Identify the risks

An important stage in the process is to identify which risks are relevant to your business. 

Ask yourself:

• What harmful incidents could occur within my business?
• What types of natural or human disasters outside my business could prevent or hinder my business from operating? 
• What other events have occurred or could occur nearby or in the region that would have a major impact on my business? 

Consider:

• Physical or environmental hazards within your business
• Natural disasters – flood, fire, storm, drought
• Disease epidemics
• Human threats – computer hackers, terrorism, crime
• Unexpected events – power outages, blocked water pipes, gas leaks, supplier problems, building damage.

It is important to note that events such as a bushfire can occur a long way from your business but still cause a significant downturn in trade. Your risk management plan needs to identify how you would manage this.

Talk to your local council to find out which risks are relevant to your area. Each council also has a Municipal Emergency Management Plan which identifies the risks for your area.  Further information on municipal emergency activities is in the Resources section.

If your area is prone to flooding or bushfires, you should also talk to the relevant emergency service agency to find out how to best prepare your business. 

NB. Guidance on assessing a broader range of risks relating to your business, such as financial, political and employee risks can be found at the Business Victoria website, business.vic.gov.au under Risk Management.

Think about the impact on your business if any of the following occurred:

What if:

• The power was cut off?
• Computers and business records were damaged or lost?
• Telephone lines or the internet went down?
• You could not easily contact your customers or they could not contact you?
• You or your staff could not come to work because of a disease epidemic or pandemic?
• The roads were blocked or public transport systems were shut down?
• You had to vacate your premises or find new ones?
• Important suppliers went out of business?
• Your insurance (personal and business) was insufficient to cover costs?

Assess the risks

The next step is to estimate the likelihood of these occurring and the level of impact on your business if they did.  

It is useful to plan for things that may happen, but in order not to waste time, you should talk to experts if you are unsure how realistic your risk assessment has been. Using a recognised and logical process to analyse and assess your particular risk is wise.

An advanced risk measurement matrix is included in the series of Emergency Management manuals currently being prepared by the CFA.

It is also valuable to consider your approach to risk – what risks will you accept and which ones must be addressed.  

Each business will have a different approach to risk. You may be highly risk-averse and want to spend the time and resources on addressing almost all possible risks, or you may be prepared to accept that some risks are unlikely to occur and are perhaps too costly to address.

Address the risks

After identifying the most important risks to plan for, the next step is to consider what actions would be needed to address or minimise these risks, and to reduce the impact of these risks on your business. Write this down so you can share the information with other staff and business partners. 

Document your thinking - prepare a risk management plan

Find an example risk management plan, which shows a response to the outcomes of the previous discussions for a fictional business, in the Resources section. A template for a risk management plan that may be useful to complete for your business is also available.

It is useful to review and update your risk management plan annually to keep it current, or more regularly if an emergency or incident occurs, or there is a change in your operating environment. 

Staff should be trained on the actions you’ve identified to minimise risk. Operations manuals and position descriptions can also be updated to reflect your risk management plan.