Risk assessment has a reputation problem. It sounds like a weeks-long project involving consultants, heat maps, and a binder nobody ever opens again. So many small and mid-sized companies either skip it or do it once for an audit and quietly forget about it.
That’s a shame, because at its core, a risk assessment is one of the most useful things a company can do. It’s just a structured way of asking: what could go wrong here, and what are we going to do about it?
You can do that without a risk team.
Start with what matters to your business
The most common mistake is starting with a generic list of threats pulled from a template. A better starting point is your own business. What data are you responsible for? Which systems would hurt most if they went down? What would a bad day actually look like?
Gather a few people from different parts of the company, such as engineering, operations, and customer-facing teams, and ask them what keeps them up at night. You’ll surface real risks faster than any template, and you’ll find that people closest to the work often see problems leadership hasn’t noticed.
Write each risk in plain language
A useful risk statement describes a cause, an event, and an impact. “Former employees may keep access to internal systems after they leave, leading to unauthorized exposure of customer data” is a risk you can work with. “Access control weakness” is a label that teaches you nothing.
Keep the writing simple enough that someone outside the security team would understand it. If leadership can’t read your risk register, it won’t influence any decisions.
Rate them, but don’t overthink it
For each risk, estimate two things: how likely it is, and how bad it would be. A simple scale of low, medium, and high works fine. You’re not looking for mathematical precision. You’re trying to separate the risks that deserve attention now from the ones that can wait.
The goal of rating isn’t a perfect number. It’s a useful conversation about priorities.
Decide what to do and write it down
This is the step many assessments skip. Every risk needs a decision, and there are really only four options: reduce it by adding or improving a control, accept it knowingly, avoid it by changing what you do, or transfer part of it, for example through insurance.
Accepting a risk is perfectly legitimate, as long as it’s a deliberate choice made by the right person and recorded, not something that just happened by neglect. For risks you decide to reduce, assign an owner and a date. A risk without an owner is just a worry.
Make it a living document
A risk register that gets updated once a year is a snapshot. A risk register that gets a short review each quarter, and whenever something significant changes, is a management tool. New product launches, new regions, new types of data, and incidents are all reasons to revisit it.
It also pays off during audits. Frameworks like ISO 27001 expect a documented, repeatable risk process, and showing that yours is actually used, not just written, is far more convincing than a polished document from last spring.
Risk assessment isn’t about predicting the future perfectly. It’s about making your decisions deliberately instead of by accident. Start with a short list, keep it honest, and revisit it regularly. That alone puts you ahead of many companies with much larger budgets.
Need help building a risk process that fits your team? Book a call with FEHA