A risk assessment identifies and prioritizes the financial, operational and compliance risks facing your business — concentration risk in customers or suppliers, control gaps, regulatory exposure, or market and currency risk — so leadership can address the risks that actually matter most, rather than reacting to whichever one surfaces first. It's often run as a precursor to internal audit planning, board risk reporting, or as part of due diligence.

A structured identification and prioritization of the financial, operational and compliance risks facing a business, used to guide risk management, controls and internal audit focus.

Who needs it?
Boards and leadership teams wanting a clear risk picture, businesses preparing for investment or sale, and companies wanting to prioritize internal audit or control investment where risk is highest.

- A clear, prioritized view of the risks that actually matter most

- Better-targeted internal audit and control investment

- Board-level risk reporting that satisfies governance expectations

- Early identification of concentration, regulatory or operational exposure

1. Identify the business's key financial, operational and compliance risk areas

2. Assess likelihood and potential impact of each identified risk

3. Prioritize risks and map them against existing controls

4. Deliver a risk register and recommendations for mitigation

Cost Factor ~ Based on business complexity, number of risk areas assessed, and depth of analysis (high-level review vs detailed quantitative assessment).

Timeline ~ A standard risk assessment typically takes 2–3 weeks.

1. How is a risk assessment different from an internal audit?
A risk assessment identifies and prioritizes what could go wrong across the business, while internal audit tests whether specific controls actually work — a risk assessment often comes first and shapes where internal audit focuses its testing. Many engagements combine both in sequence.

Common areas include customer or supplier concentration, cash flow and liquidity risk, regulatory and licensing compliance, key-person dependency, and cybersecurity/data risk, alongside standard financial control risks. We scope the specific areas most relevant to your industry and business model.

3. How often should a business risk assessment be updated?
An annual refresh is typical for most businesses, though significant changes — rapid growth, a new market, a major new customer or regulatory change — usually warrant an earlier update. We recommend revisiting the risk register whenever the business changes materially.