Business is about taking calculated risks. But how do you actually calculate them?
Here's a version any founder can do themselves. For a deeper assessment done automatically, there's also a free tool.
First, identify your risks
Before you can score risks, you need to know what they are. That starts with understanding your business context: maturity stage, regulatory exposure, financial stability, and more.
We wrote a full framework for this: How to identify the risks that actually matter
Risk Score = Likelihood × Impact
Multiply two numbers, get a score. Both on a 1 to 5 scale. That gives you a score from 1 to 25.
Likelihood: How likely is this risk to materialize in the next 12 months? Not ever. Not theoretically. In the next year, given what you know today.
| Score | Label | Probability |
|---|---|---|
| 1 | Rare | 0 to 10% chance |
| 2 | Unlikely | 10 to 30% chance |
| 3 | Possible | 30 to 50% chance |
| 4 | Likely | 50 to 80% chance |
| 5 | Almost Certain | 80 to 100% chance |
Impact: If this risk hits, how much does it hurt? Revenue loss, cash drain, operational disruption, reputational damage. Translate it to business impact.
| Score | Label | Business Impact |
|---|---|---|
| 1 | Negligible | Less than 5% revenue impact or under $50k cost |
| 2 | Minor | 5 to 10% revenue impact or $50k to $250k cost |
| 3 | Moderate | 10 to 25% revenue impact or $250k to $1M cost |
| 4 | Major | 25 to 50% revenue impact or $1M to $5M cost |
| 5 | Catastrophic | Over 50% revenue impact or over $5M cost, potential business failure |
Multiply and compare:
- Almost certain (5) × Negligible (1) = 5. A nuisance to manage.
- Rare (1) × Catastrophic (5) = 5. A low-probability event to prepare for.
- Likely (4) × Major (4) = 16. The kind that should keep you up at night.
The math is simple. The value is in forcing yourself to quantify what usually stays vague.
Then prioritize
Once you have scores, you need to act on them. Not every risk deserves the same attention.
| Level | Score | Action Required |
|---|---|---|
| Critical | 20 to 25 | Immediate action required. These are existential. |
| High | 12 to 19 | Senior management attention needed. Requires a plan and ownership. |
| Medium | 6 to 11 | Active monitoring and mitigation planning. Have a response ready. |
| Low | 1 to 5 | Accept or monitor periodically. Not worth your energy. |
Critical risks need a response now. Not next quarter. Assign an owner, define actions, set a timeline. If you have more than two or three critical risks, revisit your scoring or take a hard look at the business.
High risks need a plan. Someone owns it. There's a mitigation strategy. You're reviewing it regularly.
Medium risks get monitored. You know they exist. You've thought about what you'd do if they escalate. But they're not consuming your time today.
Low risks get accepted. Write them down, acknowledge them, move on. Don't spend energy on risks that don't matter while ignoring the ones that do.
The trap is focusing on risks that feel manageable while avoiding the uncomfortable ones. Scores help you see past that.
Why this works
Think like a CEO, not an auditor. The question isn't "are we compliant with everything?" It's "what could derail our execution, growth, or survival?" This framework keeps you focused on what actually matters.
Get it out of your head. Once a risk is written down and scored, it becomes something you can discuss, monitor, and revisit. It's no longer just a vague worry. It's a decision you're actively managing.
The goal isn't zero risk
The goal is knowing which risks deserve your attention and which ones you're consciously accepting.
Every founder carries risk. The good ones know exactly which risks they're carrying and why.
Get your free business risk assessment
Want to put this into practice right now? Try the Siqnalis Risk Assessment tool. Just enter your company name and URL, and get your business risks identified, scored, and prioritized automatically.
Free startup risk assessment. No signup required. Results in 15 minutes.