How Prepared Is Your Business for the Unexpected?
Originally published: August 2026 | Last reviewed/revised: August 2026
Running a business involves accepting risk. Customers, employees, property, technology, suppliers, weather, contracts, finances and countless other factors can create the possibility of loss or disruption.
You can’t eliminate every risk, nor should you necessarily try. Good risk management starts with recognizing what could go wrong, considering the potential consequences, and deciding what, if anything, should be done about it.
This assessment is designed to get you thinking about some of the risks that can affect almost any business. There are no “right” answers, and a Yes or No by itself doesn’t tell you whether your business is well protected. “Not Sure” can be a particularly useful answer because it may identify something you haven’t considered before.
For each question, select:
Yes | No | Not Sure
1. Have you identified the events that could seriously disrupt or threaten your business?
Consider more than fires, hurricanes and other physical disasters. A cyberattack, lawsuit, death or disability of a key person, loss of a major customer or supplier, equipment failure, utility outage, employee problem or financial fraud could also have a significant effect.
Why it matters:
It’s difficult to manage a risk you haven’t identified. Simply asking “What could seriously hurt this business?” is one of the most useful risk management exercises an owner can undertake.
Something to consider:
Periodically make a list of events that could cause significant financial loss or disrupt your operations. Consider both how likely they are and how serious the consequences could be.
2. Do you have a plan for continuing operations after a serious disruption?
Think about what would happen if you couldn’t use your premises, computer systems, critical equipment, normal suppliers or other resources you depend upon.
Why it matters:
Surviving the event itself may only be the beginning. A business can suffer substantial financial damage while trying to recover.
Something to consider:
Identify the functions your business must restore first, who will be responsible for them, what alternatives are available and what resources would be needed.
3. Do you know how long your business could financially survive a significant interruption in revenue?
Consider payroll, rent or mortgage payments, debt payments, taxes, utilities and other expenses that may continue even when revenue has slowed or stopped.
Why it matters:
A profitable business can still fail because of a cash-flow crisis.
Something to consider:
Estimate your continuing expenses and available financial resources under several scenarios, such as being unable to operate normally for 30, 60, 90 days or longer. Business income and extra expense insurance may be one part of the solution, but financial reserves and continuity planning can be equally important.
4. Could your business continue if you or another key person were unexpectedly unavailable for an extended period?
Consider who controls bank accounts, passwords, customer relationships, vendor relationships, technical knowledge, licenses and important business decisions.
Why it matters:
In many small businesses, essential knowledge and authority are concentrated in one or two people.
Something to consider:
Identify key-person dependencies and determine what information, authority and procedures someone else would need to keep the business operating.
5. Are important business records and data protected and recoverable?
Consider accounting records, customer information, contracts, employee records, tax information, operational data and other information your business depends upon.
Why it matters:
Losing information can be as disruptive as losing physical property.
Something to consider:
Maintain appropriate backups, protect sensitive information, limit access where appropriate and periodically test whether backed-up information can actually be restored.
6. Have you considered how dependent your business is on technology?
Think about email, phones, websites, cloud services, payment processing, accounting software, online banking, scheduling systems, artificial intelligence tools and specialized applications.
Why it matters:
Even a business that doesn’t consider itself a “technology business” may be unable to operate without technology.
Something to consider:
Identify your most critical systems and determine what alternatives exist if they become unavailable. Cybersecurity controls, backup procedures, contingency planning and cyber insurance can all play roles in managing this risk.
7. Have you considered what would happen if an important customer, supplier, service provider, or other business you depend on suddenly couldn’t operate or no longer did business with you?
Consider major customers, suppliers, manufacturers, distributors, cloud providers, payment processors, utilities and other organizations that are important to your operations or revenue. Also consider whether your business depends indirectly on a major employer, institution, attraction, venue or other “anchor” business in your area.
Why it matters:
Your business can suffer a serious financial loss because of something that happens somewhere else. The loss of a major customer can reduce revenue immediately. A disruption involving an important supplier can prevent you from operating. And the closure, relocation or prolonged shutdown of a major local employer or institution can affect businesses throughout the surrounding community.
Something to consider:
Identify the outside organizations that have the greatest influence on your ability to operate or generate revenue. Consider what would happen if one became unavailable, significantly reduced its activity, or disappeared altogether. Where practical, reduce the risk by developing alternate suppliers, diversifying your customer base, or planning for other sources of revenue.
8. Do you regularly evaluate the physical property your business depends upon?
Consider buildings, inventory, equipment, furniture, computers, tools, property in transit and property belonging to others.
Why it matters:
Property values and operations change. Inflation, new equipment, renovations, additional inventory and changes in replacement costs can make old assumptions obsolete.
Something to consider:
Periodically inventory important property and consider what it would cost to repair or replace it today, not what it originally cost.
9. Have you considered how your business could cause injury, property damage or financial harm to someone else?
Think about customers visiting your premises, work performed away from your location, products you sell, advice you provide, vehicles used in business and work performed by employees or contractors.
Why it matters:
Liability doesn’t arise only from accidents at your premises. It can result from what your business does, sells, recommends or fails to do.
Something to consider:
Look at your operations from the perspective of a customer, visitor or other third party. Ask how your activities could cause them harm and what can reasonably be done to prevent it.
10. Do you have procedures for selecting, training and supervising employees and others who perform work on behalf of your business?
Consider employees, temporary workers, independent contractors and subcontractors where applicable.
Why it matters:
People create both value and risk. Injuries, poor workmanship, unsafe practices, harassment, theft and other problems can create significant consequences for a business.
Something to consider:
Use appropriate hiring practices, clearly communicate expectations, provide necessary training, document important employment matters and periodically review workplace safety.
11. Do you understand the important contracts your business signs and the responsibilities you accept under them?
Consider leases, customer agreements, vendor contracts, subcontractor agreements and other contracts.
Why it matters:
A contract can create obligations that wouldn’t otherwise exist or shift responsibility for certain losses from one party to another. Insurance requirements in a contract don’t necessarily mean that your insurance automatically satisfies them.
Something to consider:
Read contracts before signing them and pay particular attention to indemnification, insurance requirements, additional insured provisions, waivers and limitations of liability. Legal review may be appropriate for significant agreements.
12. Do you have controls designed to reduce the possibility of theft, fraud or unauthorized financial transactions?
Consider employee theft, check fraud, fraudulent invoices, wire-transfer fraud, social engineering and unauthorized access to bank accounts.
Why it matters:
Not every loss comes from an accident or natural disaster. A business can suffer a substantial financial loss because someone inside or outside the organization deliberately deceives it.
Something to consider:
Separate financial responsibilities when practical, require independent verification of unusual payment requests, control access to financial accounts and periodically review transactions. Commercial crime insurance and, in appropriate circumstances, fidelity or employee dishonesty bonds can provide financial protection against certain losses, but they shouldn’t substitute for sound internal controls.
13. Have you considered how severe weather or other natural events could affect your business even if your property isn’t physically damaged?
Consider hurricanes, flooding, excessive rainfall, wind, wildfire, extreme temperatures and other events relevant to where you operate.
Why it matters:
Weather can cause lost revenue, canceled events, inaccessible premises, supply-chain problems and other financial losses without necessarily causing direct physical damage to your property.
Something to consider:
Emergency planning, alternate operating arrangements, traditional insurance and, for certain measurable events, parametric insurance may provide different ways of managing weather-related financial risk.
14. Do you periodically review how your business has changed?
Consider changes in revenue, payroll, employees, locations, products, services, equipment, vehicles, customers, contracts and geographic reach.
Why it matters:
Risk isn’t static. A risk management or insurance program that made sense three years ago may no longer reflect what the business does today.
Something to consider:
At least annually, and whenever the business changes significantly, ask what is different and whether those changes have created new risks or changed existing ones.
15. Have you considered how your business would pay for a significant loss?
Not every risk can or should be eliminated, transferred or insured. Some losses will ultimately be retained by the business, whether intentionally through deductibles or other decisions, or because transferring the risk through insurance isn’t practical or possible.
Why it matters:
Identifying a risk is only part of managing it. A business also needs to consider where the money would come from if a significant loss actually occurred. Even an insured loss may require the business to absorb deductibles, excluded or limited losses, expenses that exceed policy limits, or costs incurred while waiting for an insurance claim to be resolved.
Something to consider:
Consider how your business would finance losses of different sizes. Resources might include current cash flow, financial reserves, available credit, insurance, self-insurance or a combination of these methods.
For significant risks, consider not only how likely a loss is to occur, but how large the loss could be and whether the business has the financial resources to absorb the portion it retains.
The objective isn’t necessarily to insure every possible loss. It’s to make conscious decisions about which risks the business can afford to retain, which should be reduced or transferred, and how the financial consequences will be handled if a loss occurs.
What Did You Learn?
This isn’t a test, and there is no passing score.
A series of Yes answers doesn’t establish that your business is adequately protected. Likewise, No answers don’t necessarily mean you’re doing something wrong. Businesses differ considerably in their operations, resources and tolerance for risk.
Pay particular attention to your Not Sure answers.
They may be the most useful answers in the assessment because they identify subjects worth thinking about further.
Consider asking yourself three questions about any issue that caught your attention:
- What could happen?
- What would the financial or operational consequences be?
- Am I comfortable with how we’re handling that risk today?
The answer doesn’t always involve insurance. A risk may be avoided, reduced, retained, transferred, insured, or addressed using several of these methods.
The purpose of this assessment is simply to help you make those decisions consciously rather than discover an unrecognized risk after a loss occurs.
Explore Other Business Risks
Overall Business Risk Readiness is intentionally broad. Other assessments in the Plapp Insurance Services Business Risk Self-Assessment Series examine individual areas of risk in greater detail.
Return to the Business Risk Self-Assessment Series directory to see currently available assessments and additional topics as they are added.
Important Information
Please keep in mind that this assessment does not:
- Identify every risk your business faces.
- Determine whether your current insurance is adequate.
- Recommend particular insurance policies or limits.
- Replace professional insurance, legal, accounting, safety, IT or other advice.
It is designed to help you ask better questions.
