Security budgets and attention are limited, so the real question is never “can we fix everything?” but “what should we fix first?” A risk assessment answers that question. Despite the formal reputation, a useful one for a small team can be completed in an afternoon with a spreadsheet and a few honest conversations.

What Risk Actually Means

In security, risk is the combination of how likely something bad is to happen and how much damage it would do if it did. A threat is something that could cause harm, such as a phishing email or a failed disk. A vulnerability is a weakness that lets the threat succeed, such as an account with no second factor. An asset is whatever you stand to lose: data, systems, money, reputation or time.

Keeping these four words straight prevents a common mistake, which is treating every scary headline as equally urgent. A dramatic threat against an asset you do not have is not your risk. A boring threat against your most important asset often is.

Step One: List What Matters

Start with assets, not threats. Ask what the team could not operate without, and what would be most harmful if lost, leaked or altered. Typical answers include customer records, financial data, the email system, the file server, source code or design files, and the website.

Write each asset down with a one-line note on why it matters and who owns it. Aim for ten to fifteen items. More than that and the exercise becomes tedious; fewer and you are probably grouping too coarsely.

Step Two: Name Realistic Threats

For each asset, ask what could plausibly go wrong. Draw on general categories rather than imagination:

• Credentials stolen through phishing or reuse
• Malware, including ransomware
• Accidental deletion or sharing
• Lost or stolen devices
• Hardware failure or provider outage
• Misconfigured access or storage
• A departing employee or contractor retaining access

You do not need exotic scenarios. The everyday causes dominate for most small organizations.

Step Three: Rate Likelihood and Impact

Use a simple three-level scale, low, medium and high, for both measures. Resist the urge to invent percentages or dollar figures; precision you do not have only creates false confidence. Rate likelihood by asking how easily it could happen given your current controls, and impact by asking how badly it would hurt operations, customers and legal obligations.

Then combine the two. A common approach is a grid where high likelihood and high impact sits at the top of your list, and low on both sits at the bottom.

A Sample Risk Grid

Risk	Likelihood	Impact	Priority
Phished email password, no second factor	High	High	Fix first
Ransomware with untested backups	Medium	High	Fix first
Lost laptop without encryption	Medium	Medium	Fix soon
Accidental sharing of a customer folder	Medium	Medium	Fix soon
Short outage at the web host	Low	Medium	Monitor
Defacement of a rarely used test site	Low	Low	Accept

The ratings in this table are illustrative. Your own will differ depending on your systems, data and habits.

Step Four: Decide What to Do About Each Risk

For every risk, choose one of four responses:

1. Reduce it by adding or improving a control, such as enabling multi-factor authentication.
2. Transfer it by shifting some of the financial burden, for example through insurance or a managed service. Check the actual terms with a qualified professional, since coverage varies widely.
3. Avoid it by stopping the risky activity or retiring the system.
4. Accept it consciously, with a named person agreeing and a date to revisit.

Acceptance is legitimate, but it must be a decision rather than an oversight. Writing it down is what makes the difference.

A Realistic Example

Picture a hypothetical eight-person bookkeeping firm. In a ninety-minute session the owner and the IT contractor list their assets: client financial files, the email system, the accounting software and the office laptops. Rating the threats, they find that the highest-priority item is an email account protected only by a password, because it is both easy to attack and gives access to nearly everything. The second is a backup disk that sits plugged into the same server it protects, which would be lost together with the server in a ransomware event. They decide to enable a second factor on email within the week and to move to a backup copy kept separately from the server, with a test restore. The low-rated items go on the list for next quarter. Nothing here required special software, only a structured conversation.

Making the Assessment Repeatable

Store the results in a risk register, which is just a table with the asset, threat, rating, chosen response, owner and review date. Update it when something material changes: a new system, a new supplier, a move to remote work, or an incident. Review the whole register at least once a year.

Involve more than one person, since people who use a system daily know about workarounds that never appear in documentation. Where you hold regulated or sensitive data, requirements vary by jurisdiction, so consult a qualified professional about what formal assessments you may be obliged to perform.

Frequently Asked Questions

How often should a small team repeat a risk assessment? At least once a year, and whenever something significant changes, such as adopting a new system, onboarding a major supplier or experiencing an incident.

Do we need special software? No. A spreadsheet is enough to begin with. Dedicated tools can help later if the register grows, but the thinking matters far more than the tooling.

Should we use numbers instead of low, medium and high? For most small teams, simple levels are better, because you rarely have reliable data to support precise figures. Numbers can suggest accuracy that does not exist.

Who should take part? The person who runs your systems, someone who understands the business priorities, and ideally a representative of the people who use the systems every day.

What is the difference between a risk assessment and a vulnerability scan? A scan is a technical check for known weaknesses in specific systems. A risk assessment is a broader judgment about what matters, what threatens it and what to do first. Scan results are one useful input to an assessment.

Next Step

Block ninety minutes this week, list your ten most important assets, and rate the top three threats to each. Choose one high-priority risk and assign an owner and a date for dealing with it.