Security Risk Assessment for Small Business: A Step by Step Guide

A security risk assessment for a small business is a structured look at what you need to protect, what could realistically go wrong, how likely and how damaging each threat is, and which affordable steps reduce the biggest risks first. You can do a useful first pass yourself in a few hours with the steps below. Bring in an independent consultant when the stakes are higher, the findings are unclear, or an insurer, landlord or client wants a documented review.

Why does a small business need a security risk assessment?

Small businesses rarely have a security manager, so security decisions get made one purchase at a time: a camera after a break in, a lock after a key goes missing. A security risk assessment replaces guesswork with priorities. It tells you where your money will do the most good and where you can safely do nothing.

It also gives you a record. If something happens, a documented security risk assessment and follow up shows that you took reasonable steps to protect employees and customers. That can matter to insurers, landlords and, in some cases, courts.

How do you do a security risk assessment step by step?

1. List what you are protecting. People first (employees, customers, visitors), then cash, inventory, equipment, vehicles, records, customer and payment data, and your reputation.
2. Identify realistic threats. Think about your actual location and business: burglary, shoplifting, robbery, employee theft, vandalism, an angry customer, domestic violence spilling into the workplace, fraud, fire or severe weather.
3. Walk the site. Look at it the way an intruder would, once during business hours and once after dark. Check doors, windows, the back entrance, the parking lot, lighting and where cash and valuables sit.
4. Review how people work. Who has keys or codes? How is cash counted and deposited? Who opens and closes, and are they alone? What happens when an employee leaves?
5. Rate each risk. Score likelihood and impact on a simple 1 to 3 scale. Multiply them or plot them on a grid.
6. Choose controls. For each high risk, pick measures that reduce likelihood, impact or both, starting with the cheapest effective option.
7. Assign owners and dates. Every fix needs one person responsible and a target date, or it will not happen.
8. Review and update. Revisit the security risk assessment at least yearly and after any incident, lease change, renovation or new line of business.

How do you rate and prioritize risks?

A simple likelihood and impact grid is enough for most small business security risk assessments. You are not trying to be precise. You are trying to rank.

Here is how that looks in practice. A neighborhood cafe might rate after hours burglary as medium likelihood and medium impact, a robbery during the evening cash count as low likelihood but high impact, and petty theft from the tip jar as high likelihood but low impact. Burglary prevention becomes a medium priority, but the evening cash count still needs a plan, such as two people and a drop safe, because the harm to staff would be the greatest. The tip jar can simply be moved out of reach.

Pay special attention to the bottom right corner. Workplace violence or a serious fire may be unlikely for your business, but the consequences are severe enough that you still need a basic plan, training and a way to call for help.

Which low cost controls make the biggest difference?

Procedures and people

• Key and code control: keep a list of who has what, collect keys when people leave, and change codes regularly
• Opening and closing routines, ideally with two people when cash or isolation is a concern
• Cash handling: keep minimal cash in the register, use a drop safe, and vary deposit times and routes
• Clear guidance for staff on handling an angry customer and when to call 911
• Background checks appropriate to the role, applied consistently and within the law

Physical measures

• Solid doors and frames with quality locks, especially at the rear entrance
• Lighting at entrances, the parking area and the back of the building
• Clear sightlines from the counter to the door and the street, using CPTED principles such as low shelving and trimmed landscaping
• An intrusion alarm that is actually monitored and tested
• Cameras placed to identify faces at entrances and cover the register, with someone responsible for checking that recording works

Information and continuity

• Strong passwords and multifactor authentication on email, banking and payment systems
• Backups of key records stored somewhere other than the shop or office
• An emergency contact list and a simple plan for fire, severe weather and a medical emergency

When should you hire a professional?

A do it yourself security risk assessment is a good start, but an outside expert sees things owners walk past every day. Consider a consultant when:

• You have had a serious incident, such as a robbery, assault or repeated break ins
• You handle significant cash, pharmaceuticals, firearms, jewelry or sensitive data
• An insurer, landlord, franchisor or major client requires a documented assessment
• You are opening a new location or renovating and want security built in from the start
• You have employee or customer conflict that worries you

For an outside security risk assessment, choose someone independent who does not sell the equipment they recommend. Some police departments also offer free premises surveys, which can be a helpful starting point. For more on what a full review covers, see what a security vulnerability assessment is.

How much does a professional security risk assessment cost?

For a single small location, published price guides from security firms put a basic security risk assessment at roughly $1,500 to $5,000, with consultant hourly rates commonly quoted between $150 and $350. Larger or multi site businesses pay more. The same guides caution that a cheap or free “assessment” is often just a camera count or a sales call.

Our physical security assessment cost guide explains what drives the price and what a good report should include. If threats from people are your main concern, our workplace violence prevention cost guide covers training and plan development.

The free federal resources from the Cybersecurity and Infrastructure Security Agency (CISA) are also worth a look for both physical and cyber basics.