Business Risk Assessment Template
Three documents and four sheets that price every risk against the policy that would actually respond, and the layer the client keeps.
Free download · No account needed
Risk Assessment · Rowan Provision Co. · two plants, six policies · assessed 14 Sep, renewal 31 Dec
Sorted on what the client keeps, not on probability times impact
| Risk | Score | Retained | Where the transfer stopped |
|---|---|---|---|
| Listeria recall on a co-packed retail brand | 10 #4 | $5,400,000 | Sublimit. $1,000,000 for recall inside the liability aggregate |
| Ransomware stops the ERP and plant scheduling | 20 #1 | $2,900,000 | Contingent. The cyber application warranted a second factor on all remote access |
| Freezer bank failure at Fresno | 12 #2 | $1,250,000 | Contingent. Alarm monitoring contract lapsed 14 March |
| Ammonia release at Fresno | 5 #8 | $1,100,000 | Excess of limit. $3,100,000 against $2,000,000 |
| Meal-break class action at Reno | 12 #3 | $800,000 | Excess of limit. $1,800,000 against $1,000,000 |
| Sole-source pectin supplier fails | 9 #5 | $740,000 | No policy. Contingent business interruption was never bought |
| At-fault injury on the Reno delivery route | 8 #7 | $500,000 | Layer gap. Umbrella attaches at $1m, auto renewed at $500k |
| Loss of the manager holding the retort schedule | 9 #6 | $420,000 | No policy. Key person is not on the schedule |
$18,210,000 of severity, $13,110,000 of it retained. Seven of the eight rows change rank between the two orders, and not one risk is transferred down to its own deductible.
Search this and every result hands you the same grid. Probability times impact on a three by three or a five by five, an owner column, a status column, and a response picked from avoid, reduce, transfer, accept. Three of those four are decisions the assessment makes. Transfer is not: the client bought it years ago, and the declarations page states its size to the dollar. Not one page in the result set opens a policy.
So this pack sorts on retained exposure instead. Retained is the deductible, plus anything above the limit that applies, plus any layer between two policies nobody insured. Add the whole severity while a condition the policy imposes goes unmet. That last term is not housekeeping. California treats a policy provision importing an intention to do something that materially affects the risk as a warranty, and violating a material provision entitles the other party to rescind.
Rowan Provision Co., a two-plant food manufacturer, arrived with eight risks worth $18,210,000 of severity and six policies carrying $15,500,000 of limits. Retained came out at $13,110,000, and not one of the eight risks was transferred down to its own deductible. Seven changed rank. The three cheapest repairs cost $34,000 between them and removed $3,700,000, and none was a control project. Score the client against a reusable rubric with the diagnostic assessment pack, or find where the operation loses money with the operational diagnostic.
What's in the pack
Coverage Register
One row per policy with its retention, limit, attachment point and every sublimit inside it, plus the page you read each figure from.
Risk Register
One row per risk whose likelihood and severity each name the record they came from, so finance can check both in an afternoon.
Control Coverage
Every condition the policies impose, checked against what is happening today, with the risk it gates and a date to close it.
Gap Analysis
Retained exposure per risk with one of five types on it, the action that closes it, and what that action costs.
Risk Assessment
The committee document, opening on retained against severity and the two orderings side by side rather than on a heat map.
Treatment Recommendations
Ranked on exposure removed per dollar, each with a named owner and a date, and the renewal items kept separate from this month's.
How a Retained Layer Is Typed
The five reasons a transfer stops and the different fix each one needs. Level the client first with the maturity model pack.
How to use it
- 1
Open in River, or take it blank
Open the pack in River and send the policies with the incident history, or download the Word documents and CSV sheets and work through them yourself.
- 2
Read the declarations first
Build the coverage register before you score anything, off the declarations and endorsement schedule. Texas states outright that a certificate is not a policy and alters nothing.
- 3
Price each risk against its policy
Name the policy that would respond, the limit that actually applies, what the insurer pays and what the client keeps. Then type the layer they keep.
- 4
Sort on retention, not on score
Rank on retained exposure and show the score rank beside it. Where the two disagree, that gap is the finding, and it is usually most of the register.
Frequently asked questions
Is this template free?
Yes. The zip is Word documents and CSV sheets, no account and no card. Edit with AI is the optional half: the agent reads the policies and the operational records, then prices each risk against the cover that would respond. The rest sit in the template library.
What format are the downloaded files?
Three Word documents and four CSV sheets in one zip, no conversion needed. The sheets carry the columns that do the work: applicable limit, insurer pays, retained, and the type of retention. Open them in Excel, Numbers or Google Sheets.
What does Edit with AI actually do?
It reads the declarations pages, the endorsement schedule and the schedule of underlying insurance, builds the coverage register, then joins each risk to the policy that would respond and works out the retained layer. It comes back with the two orderings and where they disagree.
All I have are certificates of insurance. Is that enough?
No, and the register records which rows came from a certificate so nothing downstream overclaims them. A certificate names the aggregate and never names a sublimit, and the sublimit is usually the number a risk actually meets. Ask for the declarations pages by policy number.
Does this recommend insurance or a broker?
It produces retained figures, the five reasons behind them, and a named owner against each one. That is what a broker needs to quote properly and what a committee needs to decide. Which market to place it in, at what premium, stays their trade. The same discipline applied to software contracts is the IT systems assessment.
Why does a claims-made policy change the answer?
Because cover turns on when the claim arrives rather than when the act happened. California makes a claims-made professional liability policy print that warning on its face page. So for anything arising from work already done, the question is whether the claim lands before renewal.
The client's process documentation is out of date. Does that break it?
No, because likelihoods come from logs rather than from procedures. Maintenance histories, incident records, fleet logs and change records are what carry a count. If the documented process is the gap, that is a current-state mapping job rather than a risk finding.
Price the transfer before you rank the risks
Take the Word documents and CSV sheets blank, or send River the policies and the incident history and get back the retained layer per risk.
Edit with AI