River
Y CombinatorBacked by Y Combinator
Log InStart Free
FREE TEMPLATE

Business Risk Assessment Template

Three documents and four sheets that price every risk against the policy that would actually respond, and the layer the client keeps.

Edit with AIDownload (.docx + .csv)

Free download  ·  No account needed

What you get

Pack of 7 files: 3 documents, 4 spreadsheets

Business Risk Assessment Template
  • How a Retained Layer Is TypedDocument
  • Risk AssessmentDocument
  • Treatment RecommendationsDocument
  • Risk RegisterSpreadsheet
  • Coverage RegisterSpreadsheet
  • Control CoverageSpreadsheet
  • Gap AnalysisSpreadsheet
RiverBusiness Risk Assessment Template

Risk Assessment  ·  Rowan Provision Co.  ·  two plants, six policies  ·  assessed 14 Sep, renewal 31 Dec

Sorted on what the client keeps, not on probability times impact

RiskScoreRetainedWhere the transfer stopped
Listeria recall on a co-packed retail brand10  #4$5,400,000Sublimit. $1,000,000 for recall inside the liability aggregate
Ransomware stops the ERP and plant scheduling20  #1$2,900,000Contingent. The cyber application warranted a second factor on all remote access
Freezer bank failure at Fresno12  #2$1,250,000Contingent. Alarm monitoring contract lapsed 14 March
Ammonia release at Fresno5  #8$1,100,000Excess of limit. $3,100,000 against $2,000,000
Meal-break class action at Reno12  #3$800,000Excess of limit. $1,800,000 against $1,000,000
Sole-source pectin supplier fails9  #5$740,000No policy. Contingent business interruption was never bought
At-fault injury on the Reno delivery route8  #7$500,000Layer gap. Umbrella attaches at $1m, auto renewed at $500k
Loss of the manager holding the retort schedule9  #6$420,000No policy. Key person is not on the schedule

$18,210,000 of severity, $13,110,000 of it retained. Seven of the eight rows change rank between the two orders, and not one risk is transferred down to its own deductible.

Search this and every result hands you the same grid. Probability times impact on a three by three or a five by five, an owner column, a status column, and a response picked from avoid, reduce, transfer, accept. Three of those four are decisions the assessment makes. Transfer is not: the client bought it years ago, and the declarations page states its size to the dollar. Not one page in the result set opens a policy.

So this pack sorts on retained exposure instead. Retained is the deductible, plus anything above the limit that applies, plus any layer between two policies nobody insured. Add the whole severity while a condition the policy imposes goes unmet. That last term is not housekeeping. California treats a policy provision importing an intention to do something that materially affects the risk as a warranty, and violating a material provision entitles the other party to rescind.

Rowan Provision Co., a two-plant food manufacturer, arrived with eight risks worth $18,210,000 of severity and six policies carrying $15,500,000 of limits. Retained came out at $13,110,000, and not one of the eight risks was transferred down to its own deductible. Seven changed rank. The three cheapest repairs cost $34,000 between them and removed $3,700,000, and none was a control project. Score the client against a reusable rubric with the diagnostic assessment pack, or find where the operation loses money with the cost and margin diagnostic.

Six policies, eight risks, and the five reasons the transfer stopped

The Coverage Register, the Risk Register, the Control Coverage sheet, and the Gap Analysis.

Business Risk Assessment Template
RiverCoverage Register

Coverage Register

Read off the declarations pages and the endorsement schedule. A certificate names the aggregate and never names a sublimit.

PolicyCoverRetentionLimitSublimits inside it
PKG-9920Property$50,000$5,000,000None
PKG-9920General liability$100,000$2,000,000Recall expense $1,000,000, pollution $500,000
CYB-4471Cyber and network interruption$250,000$2,000,000Dependent business interruption $500,000
EPL-2210Employment practices$150,000$1,000,000Wage and hour defence $250,000
AUT-3315Commercial auto liability$0$500,000None. Renewed down on 1 Jan
UMB-0088Umbrella, attaches at $1,000,000$0$5,000,000Requires underlying auto at $1,000,000

The last two rows are the finding. The umbrella expects $1,000,000 underneath it and the auto policy now pays to $500,000, so the layer between them belongs to Rowan. Both certificates read as current, which is why nine months went by without anybody noticing.

RiverRisk Register

Risk Register

Sixteen figures, sixteen named records. A likelihood is a count from a log, not a show of hands.

RefLikelihood read fromSeverity read fromPSev
R-01Two credential-phishing incidents in 18 months of security records18 days of the FY25 gross margin run rate4$2.9m
R-02One hold-and-release in 24 months of QA deviation recordsThe largest co-pack customer’s 2025 purchase order value2$6.4m
R-03Three compressor faults in the 12-month maintenance logHighest single-day Fresno freezer value in the warehouse system3$1.25m
R-0441 unsigned meal-waiver forms in the Reno personnel files214 non-exempt employees against the payroll register lookback3$1.8m
R-05Two allocation notices from the pectin supplier since MarchEleven weeks of the affected lines at standard margin3$740k
R-06No release in nine years of injury and illness recordsThe reserve a carrier set on a comparable 2019 release1$3.1m
R-07One name on 22 of 31 retort schedule change recordsSix weeks of retort downtime at standard margin3$420k
R-08Two at-fault collisions in 36 months of the fleet logThe carrier’s own reserve on the 2024 Reno claim2$1.6m

R-06 is why the evidence column earns its width. Nine years without an ammonia release is a real reading, and it is what drops the risk to last place on a score. The severity behind it is $3,100,000 and the limit is $2,000,000, so it comes back fourth once the retention is worked out.

RiverControl Coverage

Control Coverage

Seven conditions the six policies impose. Three unmet, two partial, two met, and 108 days to the renewal.

RefWhat the policy requiresWhat is happeningGatesStatus
C-01A second factor on all remote accessThe Reno line-controller vendor arrives on a shared passwordR-01Unmet
C-02Refrigeration alarms monitored to a central stationContract lapsed 14 March, alarms still sound locallyR-03Unmet
C-04Underlying auto liability of $1,000,000Auto renewed at $500,000 on 1 JanuaryR-08Unmet
C-05Complaint procedure issued to every employeeIssued in English, Spanish version not distributed at RenoR-04Partial
C-07Backups held offline and restore-testedOffline, last proven restore 11 months agoR-01Partial
C-03Recall plan tested in the last 24 monthsTabletop test 9 February with an attendance recordR-02Met
C-06Ammonia detection tested to the written procedureQuarterly tests logged, last 22 AugustR-06Met

C-01 and C-02 are not control gaps. They are terms of contracts Rowan has already paid for, so while they stay open the two risks they gate carry their whole severity rather than their deductible. That is $4,150,000 of retention created by a lapsed monitoring contract and one vendor tunnel.

RiverGap Analysis

Gap Analysis

Retained per risk, typed, with the action that closes it and what the action costs.

RefTypeRetainedActionCostAfter
R-02Sublimit$5,400,000Dedicated recall policy, or a cap in the co-pack agreementRenewalQuote
R-01Contingent$2,900,000Second factor on the vendor tunnel$18,000$900,000
R-03Contingent$1,250,000Reinstate the alarm monitoring contract$9,600$50,000
R-06Excess of limit$1,100,000Board decision on buying the extra limitRenewalQuote
R-04Excess of limit$800,000Higher limit, or cure the 41 unsigned waiversRenewalQuote
R-05No policy$740,000Accept in writing, or qualify a second pectin sourceDecision$740,000
R-08Layer gap$500,000Restore the auto limit to the attachment point$6,400$0
R-07No policy$420,000Accept in writing, or train a second schedulerDecision$420,000

The three rows with a dollar cost remove $3,700,000 for $34,000. That is $109 of retained exposure per dollar spent, and none of the three is a mitigation project. Two of them are Rowan restoring something it has already bought.

Retained by type: sublimit $5,400,000, contingent $4,150,000, excess of limit $1,900,000, no policy $1,160,000, layer gap $500,000. Five subtotals rather than one blended number, because the five need five different actions.

Edit with AI

What's in the pack

01

Coverage Register

One row per policy with its retention, limit, attachment point and every sublimit inside it, plus the page you read each figure from.

02

Risk Register

One row per risk whose likelihood and severity each name the record they came from, so finance can check both in an afternoon.

03

Control Coverage

Every condition the policies impose, checked against what is happening today, with the risk it gates and a date to close it.

04

Gap Analysis

Retained exposure per risk with one of five types on it, the action that closes it, and what that action costs.

05

Risk Assessment

The committee document, opening on retained against severity and the two orderings side by side rather than on a heat map.

06

Treatment Recommendations

Ranked on exposure removed per dollar, each with a named owner and a date, and the renewal items kept separate from this month's.

07

How a Retained Layer Is Typed

The five reasons a transfer stops and the different fix each one needs. Level the client first with the maturity model pack.

How to use it

  1. 1

    Open in River, or take it blank

    Open the pack in River and send the policies with the incident history, or download the Word documents and CSV sheets and work through them yourself.

  2. 2

    Read the declarations first

    Build the coverage register before you score anything, off the declarations and endorsement schedule. Texas states outright that a certificate is not a policy and alters nothing.

  3. 3

    Price each risk against its policy

    Name the policy that would respond, the limit that actually applies, what the insurer pays and what the client keeps. Then type the layer they keep.

  4. 4

    Sort on retention, not on score

    Rank on retained exposure and show the score rank beside it. Where the two disagree, that gap is the finding, and it is usually most of the register.

Frequently asked questions

Is this template free?

Yes. The zip is Word documents and CSV sheets, no account and no card. Edit with AI is the optional half: the agent reads the policies and the operational records, then prices each risk against the cover that would respond. The rest sit in the template library.

What format are the downloaded files?

Three Word documents and four CSV sheets in one zip, no conversion needed. The sheets carry the columns that do the work: applicable limit, insurer pays, retained, and the type of retention. Open them in Excel, Numbers or Google Sheets.

What does Edit with AI actually do?

It reads the declarations pages, the endorsement schedule and the schedule of underlying insurance, builds the coverage register, then joins each risk to the policy that would respond and works out the retained layer. It comes back with the two orderings and where they disagree.

All I have are certificates of insurance. Is that enough?

No, and the register records which rows came from a certificate so nothing downstream overclaims them. A certificate names the aggregate and never names a sublimit, and the sublimit is usually the number a risk actually meets. Ask for the declarations pages by policy number.

Does this recommend insurance or a broker?

It produces retained figures, the five reasons behind them, and a named owner against each one. That is what a broker needs to quote properly and what a committee needs to decide. Which market to place it in, at what premium, stays their trade. The same discipline applied to software contracts is the IT systems assessment.

Why does a claims-made policy change the answer?

Because cover turns on when the claim arrives rather than when the act happened. California makes a claims-made professional liability policy print that warning on its face page. So for anything arising from work already done, the question is whether the claim lands before renewal.

The client's process documentation is out of date. Does that break it?

No, because likelihoods come from logs rather than from procedures. Maintenance histories, incident records, fleet logs and change records are what carry a count. If the documented process is the gap, that is a current-state mapping job rather than a risk finding.

Sources

  1. California Legislative InformationCalifornia Code, INS 445 (opens in a new tab)
  2. California Legislative InformationCalifornia Code, INS 447 (opens in a new tab)
  3. statutes.capitol.texas.govTexas Constitution and Statutes (opens in a new tab)
  4. California Legislative InformationCalifornia Code, INS 11580.01 (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

Related workspaces

Consulting assessment template

The reusable rubric and the paid assessment that opens a larger engagement.

Operational assessment template

Where the operation loses money, with one kind of value per finding.

Cost reduction diagnostic

Savings that need a decision, kept apart from savings that need a project.

More free templates

5 Whys Template With Worked Examples

Free 5 whys template: a precise problem statement, five whys with evidence, a stop rule, branching for two causes, countermeasures and three examples.

Change Readiness Assessment Template

Free change readiness assessment template in Word and CSV: scores readiness from what happened the client's last three change initiatives, not a self-rating.

Consulting Assessment and Scoring Rubric

Free consulting assessment template in Word and CSV: a rubric with an observable anchor per level, an evidence log, and the blocking anchor per dimension.

Gap Analysis Template and Worked Example

Free gap analysis template: current state with evidence, target state, the gap, impact, priority, action and owner, plus a 1 to 5 scoring guide and an example.

Price the transfer before you rank the risks

Take the Word documents and CSV sheets blank, or send River the policies and the incident history and get back the retained layer per risk.

Edit with AI