Guides
Risk management for small businesses: a practical framework
A five-step risk routine for small businesses: list exposures, rate them, choose avoid, reduce, transfer or retain, assign owners, and review every year.
Risk management for a small business is a yearly routine with five steps: list what could hurt you, rate each item by how often it could happen and how badly it would hurt, choose a response (avoid it, reduce it, transfer it or keep it), give each response an owner and a date, and review the list when the business changes. Insurance is one of the responses, and it is usually the last one you settle, after you have decided which risks are worth transferring.
Nothing in this routine requires a risk department. Risk management at this size is a spreadsheet, a few hours twice a year and someone who is responsible for following up. COSO, the body behind the best-known corporate framework, says in its 2017 executive summary that enterprise risk management "can be used by organizations of any size," including small businesses. The scaled-down version below borrows its logic, and the process stages from ISO 31000, the international risk standard (second edition 2018). ISO 31000 is guidance, not a certification you can earn.
Step 1: list your exposures
Start with what the business depends on, not with the policies you already own. Walk through six areas and write down what can go wrong in each.
| Area | Questions to ask | Common controls | Where insurance usually sits |
|---|---|---|---|
| People | Who gets hurt doing the work? Who could not be replaced in a week? | Training, lifting aids, cross-training, written procedures | workers' compensation insurance: how it works, key person life insurance |
| Property | What burns, floods, freezes or gets stolen? | Sprinklers, water shutoff valves, alarms, backups offsite | commercial property insurance: what it covers and what it doesn't |
| Income | Which single event would stop sales? | Second supplier, backup site, writing a business continuity plan: a step-by-step guide | business interruption insurance: how business income coverage works |
| Liability | Who can be hurt by your product, premises or advice? | Waivers, contracts, inspections, quality checks | general liability insurance: what it covers and what it does not, professional liability |
| Vehicles | Who drives for work, and in whose vehicle? | Driver screening, telematics, maintenance logs | commercial auto insurance: what it covers and what it leaves out |
| Technology | What happens if the booking system or email is locked? | Multi-factor authentication, tested backups | cyber insurance: what it covers for a business |
Add the contracts. A lease, a customer agreement or a subcontract can shift risk onto you through an indemnity clause long before any claim happens, which is why contractual risk transfer: shifting liability by contract and insurance belongs in the first pass. Your claims history is the other input: ask your broker for loss runs from every carrier for the last five years and read what actually went wrong. The pattern in those pages usually differs from what the owner expects.
For outside perspective, the Allianz Risk Barometer 2026, a survey of 3,338 risk experts in 97 countries published in January 2026, ranked cyber incidents first for the fifth year running and business interruption third. Allianz says cyber is the top risk for large, mid-sized and small companies alike, and that firms under US$100 million in revenue lean harder on third-party digital infrastructure and have less capacity to absorb an attack. A survey cannot tell you your own list, but it is a fair prompt if your list has no technology line.
Step 2: rate likelihood and severity
Give each exposure two scores from 1 to 5: how likely it is in the next year, and how severe the damage would be if it happened. Multiply them if you like, but look at severity first. Insurance exists for the low-frequency, high-severity events that would end the business or force a sale. High-frequency, low-severity events, such as a cracked windshield or a small slip, are better handled with prevention and a deductible you can pay from cash.
Rate severity in dollars of cash you would need within 90 days, not in adjectives. A loss that costs 8% of annual revenue is a bad year. One that costs 60% may be existential. The business income (interruption) limit calculator helps put a figure on the income side, and the how to build a risk register guide shows how to record the scores so the list can be sorted and updated.
Step 3: choose a response
Every exposure gets one of four responses, or a mix. The detailed trade-offs are in risk transfer vs retention: avoid, reduce, transfer or retain; in short:
- Avoid. Stop the activity. A caterer that drops late-night alcohol service has no liquor liability exposure from it.
- Reduce. Cut the chance or the cost: guards on a slicer, a vendor-screening checklist, sprinklers, a workplace safety program, a tested restore of your backups. This is loss control.
- Transfer. Move the financial consequence to someone else through insurance, an indemnity clause, a vendor's insurance requirement or a bond.
- Retain. Pay it yourself, deliberately. Every deductible is a retention decision, and the deductible and retention break-even calculator compares two options on expected cost and shows what a bad year would add.
Retention is not negligence. It becomes negligence when it was never decided, which is how most small businesses end up retaining the biggest risks they have: the uninsured income loss, the exposure that no policy covers, the contract obligation nobody read.
A hypothetical worked example
Say a 14-employee catering company in Ohio, with a commissary kitchen, two delivery vans and a booking website, builds its first list. The ratings and responses below are illustrative, not benchmarks.
| Exposure | Likelihood | Severity | Response | Owner |
|---|---|---|---|---|
| Walk-in cooler fails before a large event | 3 | 3 | Reduce: service contract and temperature alarm. Transfer: spoilage extension on the property policy | Kitchen manager |
| Van crash with a third-party injury | 2 | 5 | Reduce: MVR checks and a driver policy. Transfer: auto liability with an umbrella above it | Operations lead |
| Back strain from lifting equipment | 4 | 2 | Reduce: carts, two-person lift rule. Retain: first-aid costs. Transfer: workers' comp | Kitchen manager |
| Guest illness traced to the event | 2 | 4 | Reduce: written temperature logs. Transfer: general liability with products coverage | Owner |
| Ransomware on the booking site | 2 | 4 | Reduce: multi-factor authentication, offline backup. Transfer: cyber policy | Office manager |
| Fire closes the commissary for 4 months | 1 | 5 | Transfer: business income and extra expense; plan an alternate kitchen | Owner |
Two things come out of a table like this. The owner sees that the fire and the van crash dominate, so limits and the continuity plan deserve the budget before a low deductible does. And the cheap, unglamorous controls (the cooler alarm, the driver rule, the backup test) turn out to be worth more than another endorsement.
Step 4: put names, dates and money on it
A risk list with no owners is a document, not a program. For each response, write who is accountable, what "done" means and the date. Put the cost next to it so the owner can see the whole picture; the Total cost of risk (TCOR) calculator adds premiums, retained losses, fees and safety spending into one annual figure, which is the number to watch year over year.
Use free help before paying for consultants:
- OSHA's On-Site Consultation Program offers no-cost, confidential consultations to small and midsize businesses, delivered by state agency or university consultants and kept separate from OSHA enforcement. The employer does commit to correct serious hazards that the visit identifies. Details are at osha.gov/consultation.
- Your insurer's loss control representative will often visit, and the recommendations carry weight at renewal. Read the guide on loss control inspections before the visit.
- Your broker can match the list against your policies. Bring the table, not just the renewal questionnaire. The What business insurance do I need? is a reasonable second opinion on gaps.
Step 5: review on a schedule and on triggers
Review the list twice a year, and again whenever one of these happens: a new location, a new service line, a large contract with indemnity or insurance requirements, a change in headcount of more than a few people, a serious claim or near miss, a key hire or departure, or a new system holding customer data. Tie the spring review to your insurance renewal. The the annual business insurance review: what to update guide and a 90-day renewal checklist cover what to change on the policy side.
Mistakes we see often
- Buying by price instead of by exposure. The cheapest package is often missing the one coverage the exposure list says matters.
- Mistaking a certificate for protection. A customer's or subcontractor's certificate does not prove the coverage responds to your loss.
- No plan for the income gap. Property insurance rebuilds the building. Sales still stop in the meantime.
- A deductible chosen at renewal under time pressure. Decide your retention capacity in advance, in the same month every year.
Key takeaways
- Risk management for a small business is a five-step routine: list, rate, respond, assign, review. It needs a spreadsheet and a calendar, not a department.
- Rate severity in cash terms first. Insure the events that could end the business, and handle small, frequent losses with prevention and a deductible you can afford.
- Every exposure gets a deliberate response: avoid, reduce, transfer or retain. Retention you never decided on is the most expensive kind.
- Free help exists: OSHA's no-cost On-Site Consultation Program, your insurer's loss control staff and your broker. Use them before buying more coverage.
- Review the list twice a year and whenever the business changes, and keep the owner and the due date next to each action.