Column 1: List your threats. List all of the threats that have the potential to harm your business, but don’t be concerned with putting them in any order yet. Leave out any threats that have a zero chance of occurring. For example, if you live in Oklahoma, there is a zero chance of being hit by a hurricane. Though some events may not seem likely, they should still be listed. For example, many people would not list an earthquake unless they had a facility in California, but earthquakes have occurred in all 50 states.

Column 2: Estimate probability. Indicate the likelihood of the threat occurring, with 1 being least likely and 5 being most probable. For example, if you live in southern Florida, you would rank a hurricane as a 5, or most probable. However, if you live on the New Jersey shore, you might rank a hurricane as a 2 or a 3.

Column 3: Assess the potential human impact. Evaluate the potential for death or injury. The lowest impact would be scored a 1 and the highest a 5. For example, the potential human impact of a tornado might be a 4 or 5.

Column 4: Assess the potential property impact. Evaluate the potential for damage to property. Consider impact to buildings, equipment, machinery, computers, inventory, and furniture and fixtures. When rating from 1 to 5, consider also the costs to clean or repair the items, the costs to set up a temporary replacement, and your costs (as well as your ability) to replace the damaged items.

Column 5: Assess the potential business impact. Evaluate the potential overall business impact of an event. Will you lose revenue, customers, or market share? When rating from 1 to 5, consider the length of business interruption; the extent of the business impacted (number of departments/functions); the ability of employees to come to work; customers’ abilities to reach your business or place an order; interruption of manufacturing supplies; interruption of distribution methods; potential breach of contracts; potential for penalties, fines, or legal actions; and potential for reputational damage.

Column 6: Assess the potential infrastructure impact. Rate the potential for the loss of infrastructure supporting your business from 1 to 5. Consider the impact of the loss of telephone systems, Internet, power (electric or natural gas), water supply, and roads and bridges.

Column 7: Evaluate the availability of internal resources. Assess the availability and quality of your internal resources to respond to an event. When rating from 1 to 5, consider the availability of cash, training of personnel, availability of equipment, and ability to quickly respond.

Column 8: Evaluate the availability of external resources. Assess the availability and quality of your external resources to respond to an event. When rating from 1 to 5, consider mutual aid agreements; availability of alternate suppliers; availability of alternate distribution methods; and availability of local, state, or federal emergency response.

Column 9: Estimate the restoration time. For each event, consider the length of time it will take you to restore your operations to normal. A rating of 1 may mean minutes and a rating of 5 may be months or years. For example, if your business is a bank, a power outage may be ranked a 1 in restoration time if you have a generator and have tested its ability to bring power back to normal.

Column 10: Total. After completing your assessments, add the scores for each event and enter a total in Column 10. The lower the score, the better. Then sort the list so that the highest-scoring events are listed first.