a) The first step is to identify the events which could cause a loss or disruption to the business. There are general risks as well as risks specific to the business
b) Those events should then be analysed to ascertain the likelihood of their occurring and how serious the result would be if they did occur. Start by assessing each event as ‘very likely’, ‘moderately likely’ or ‘very unlikely. Prioritise them by putting a value on each one (e.g. the replacement cost of a critical piece of machinery; or, in the case of potential bad debts, the total value of amounts owed by customers).
c) Attend the most likely and the most expensive events first.
d) For each possible event, develop procedures commensurate with the level of risk the business is willing to accept.
e) Once a procedure is put in place, it should be monitored to ensure it is properly implemented and is effective.
