Executives often ask whether there is a simple way to at least roughly assess the risks of a new business line, a major investment or a growth strategy — without complex maths or a large team of analysts. There is. It is a risk map: a visual description of a limited number of the company's main threats that fits on a few pages and shows what to do about each one, by when and who is responsible for the result.

What a risk map is

A risk map is a table with the impact of a risk (severity of consequences) on one axis and its likelihood or frequency on the other. Each significant risk is placed in its own cell. As a result, management sees the whole picture at once: which threats are critical, which should be monitored and which are acceptable for now.

Building a map is part of systematic risk management. Professional consultants use interviews, questionnaires, industry reviews, analysis of documents and financial statements, and numerical models. But a company can produce a basic map on its own. The general principles of this work are described, for example, in the Russian national standard GOST R ISO 31000 "Risk management. Principles and guidelines".

Step 1. Train the coordinators

At least one or two employees should understand the basics of risk management. They will lead the working group, keep the discussion on track and translate the views of different departments into a common language. A short introductory course of a few days is usually enough. If a topic requires specialist expertise, a subject-matter expert is invited into the group. The main rule: do not leave the work to amateurs.

Step 2. Define the scope

First decide what exactly you are assessing: the whole company, a single division, a specific project or a strategy. The scope can be broad or narrow, but you need a balance between coverage, depth of data and usefulness of the result. Sometimes one overall map for a group is less useful than separate maps for each business — and sometimes the opposite is true. Decide on your goals and on the availability and cost of information, and only then set the scope.

Step 3. Build the team

The make-up of the working group is a key success factor. When the work is done in-house, the "consultant" is the collective experience of the company's managers. In practice, a group of six to ten people works well. For a strategic risk map it usually includes the chief executive, the finance director and the heads of legal, internal control, IT, strategic planning and, if there is one, risk management. If a single business line is analysed, the group is formed from the managers of that line and related departments.

Step 4. Identify and describe scenarios

The group holds a structured brainstorming session: what events could prevent the company from achieving its goals? For each scenario, three elements are recorded:

  • the object at risk — what exactly is vulnerable: property, cash flow, reputation, key staff, data;
  • the risk factor — what could trigger a negative event: fire, an accident, staff error, a client claim, a supplier failure, a cyberattack;
  • the consequences — the nature and approximate scale of the losses.

Similar scenarios that lead to the same consequences are merged. The many small risks that employees usually name should be grouped — otherwise the map turns into an endless list.

Step 5. Assess likelihood and impact

For each scenario the group agrees on two ratings. Impact can be described in qualitative levels, for example: catastrophic, critical, significant, minor. Likelihood can be rated on a scale from "almost impossible" to "almost certain". A company may also use quantitative estimates, but that requires data and much more time. A qualitative scale is usually enough for a first map.

Step 6. Draw the risk tolerance line

A line is drawn on the map separating acceptable risks from unacceptable ones. Everything above and to the right of the line requires action now. Risks below and to the left are tolerable for the time being, but that does not mean they can be forgotten. Where the line lies depends on the company's risk appetite: how much loss it can absorb without threatening the business. Even a rough estimate of potential damage helps to draw this line deliberately.

Step 7. Draw up an action plan

Each unacceptable risk needs a plan: which measures will reduce the likelihood or severity of losses, which indicators will count as success, by what date and who is responsible. Usually one of the following strategies, or a combination, is chosen:

  • avoid — abandon the operation or change the project;
  • reduce — prevention, safety systems, training, redundancy, contractor control;
  • transfer — insurance, contractual terms with counterparties;
  • accept — consciously retain the risk and set aside a reserve.

It is important to weigh the cost of measures against their benefit: excessive risk reduction can strip a business of its profitability.

Where insurance fits in

A risk map clearly shows which threats it makes sense to transfer to an insurer. As a rule, these are events with severe consequences and low likelihood: fire and natural disasters, equipment breakdown, liability to third parties, claims against executives. Suitable solutions include commercial property insurance, general liability insurance, directors' and officers' liability insurance (D&O) and cyber insurance. Frequent small losses are usually cheaper to cover from own funds or through a deductible.

A risk map is a process, not a picture

Risk management does not end when the map is built — it only begins. A business changes: new lines and new threats appear, old ones lose relevance. The map should be reviewed on schedule — usually once a year or in line with seasonal cycles — and also outside the schedule whenever there are signs of events that could seriously affect the company.

Regular work with the map brings together those who write the strategy and those who deal with clients every day and see real market dynamics. That is why a risk map is useful not only for protection: it helps test strategies, choose directions for growth and make decisions based on a shared understanding of risk.

If you need insurance for the risks you have decided to transfer, Polis Re specialists can help you request offers from insurance companies — submit a request or browse the programmes in the Business insurance section.