Risk Assessment Kit

Most small-company risk assessments fail the same way: every risk scores a three, nothing is comparable, and the spreadsheet dies the day after the audit. The cause is unanchored scales. When "likely" and "serious" mean nothing specific, scores are opinions.

This kit fixes the scales first. Likelihood and impact are anchored to concrete events and pound ranges you tune to your own numbers in five minutes. From there, the forty-scenario library covers the incidents that actually happen to UK small organisations, from phishing and payment fraud to supplier collapse and lost laptops, each with suggested starting scores to react against rather than a blank page.

The worked example is the quiet differentiator: a fictional eight-person consultancy fully assessed, fifteen risks scored, treated and signed, so you calibrate against a finished register instead of guessing. Acceptance rules say who may accept which level of risk, which is the discipline auditors and insurers actually check. Certification schemes, customer questionnaires and insurers all ask for this document. This version is the one you will still be using next year.