Risk assessment tool

This tool is designed to be used in stages. It moves from understanding the decision you are facing, through identifying and assessing risks, to deciding how to proceed and how to monitor risks over time.

You do not need to complete every step in full detail for every situation. The depth of analysis should match the size, complexity and risk level of the deal, partner or market you are assessing.

Make the risk assessment part of regular management conversations, reviews and decisions to ensure continuous input, timely mitigation, and alignment.

Start by clearly describing the decision you are assessing. This helps ensure everyone involved shares the same understanding.

Record:

• a short description of the deal, partner or diversification move
• the target market or region
• the main product or service involved
• the expected size (product) or duration (service)
• where you are in the process (for example, early discussion, draft term sheet, near contract signature or early pilot stage)​

Capture this information at the top of your worksheet or in a short introductory paragraph before the risk table.​

Use the categories below as headings in your worksheet. Add or remove categories to fit your situation, but keep them broad and practical.​

• Counterparty risk (buyer, distributor, agent, supplier)
• Commercial and contract risk (pricing, scope, obligations, performance)
• Payment and financial risk (non‑payment, currency, financing)
• Operational and logistics risk (production, transport, inventory, service delivery)
• Regulatory and compliance risk (export controls, sanctions, product standards, customs)
• Environmental, social and governance (ESG) and Responsible Business Conduct (RBC) risk (labour, environment, human rights, corruption)
• Data and digital risk (data privacy, data localization, cybersecurity)
• Political and country risk (instability, conflict, sudden policy changes)
• Reputation risk (customer complaints, media exposure, partner behaviour)
• Internal capacity and execution risk (management bandwidth, skills, systems)​

Create one row for each specific risk under the most relevant category.​

For each category, identify concrete risks related to your decision. Use clear, specific and concise language.

A simple table structure includes:

• risk category
• specific risk
• what could happen (brief description of the consequence)
• existing information or evidence

Examples:

• Counterparty risk – Buyer has a short operating history – Possible late or non‑payment if cash flow is weak – Limited financial information available
• Regulatory and compliance risk – Product subject to special certification – Shipment could be blocked or delayed – Market requires proof of certification before clearance
• Internal capacity risk – Limited staff to manage a new distributor – Service quality could drop – Existing team already at full load

Focus on risks that could materially affect delivery, payment, compliance, reputation or long‑term strategy.​

For each specific risk, assign qualitative ratings using a simple scale:

• Likelihood: low (L), medium (M), high (H)
• Impact: low, medium, high

You can also convert these to numbers in a spreadsheet (for example, low = 1, medium = 2 and high = 3) to calculate an overall risk score. A simple way to do so is to multiply likelihood by impact (likelihood x impact). This is optional.

Use the ratings to prioritize attention, not to create false precision.​

Tips​

• High-likelihood and high-impact risks usually require strong mitigation or a redesign of the deal
• Low-likelihood but high-impact risks still need attention (for example, sanctions, severe political events or major data breaches)
• Medium risks often require proportionate controls and monitoring, not automatic rejection

Add two more columns to your table:​

• Early warning signs
• Possible mitigations or conditions

For each risk, ask:​

• How would we know this risk is emerging?
• What practical steps could reduce the likelihood or impact?

Examples of mitigations

• Counterparty and payment risks: stronger due diligence, smaller initial order, deposits, secure payment methods, insurance or guarantees, and ensuring control over shipment documents, particularly the bill of lading (title document)

• Operational and logistics risks: backup suppliers or routes, realistic timelines, clear packaging and documentation instructions
• Regulatory risks: written confirmation of requirements, using qualified customs brokers, certifications in place before shipment
• ESG and RBC risks: supplier codes of conduct, contractual commitments, screening and monitoring through reputable tools
• Internal capacity risks: phased rollout, additional staffing, or delaying diversification until key gaps are closed

Avoid naming specific products or providers. Focus on types of controls and questions to ask.​

Add a “Decision notes” column. Use it to summarize your conclusion for each major risk and record your overall decision.​

For each major risk:​

• proceed as planned, with basic monitoring
• proceed with changes to terms or structure, with specific mitigations
• proceed only if certain conditions are met
• do not proceed at this time

For the overall decision, consider:​

• whether the remaining risks fit your risk appetite and capacity
• if there are any clear “no‑go” conditions (for example, sanctions, severe RBC issues or legal barriers)
• whether this decision aligns with your broader export strategy

Record a clear, short conclusion that you can revisit later.​

Suggested table structure

You can recreate this tool in a spreadsheet or document using these columns:​

• Risk category
• Specific risk
• What could happen
• Existing information or evidence
• Likelihood (L / M / H)
• Impact (L / M / H)
• Early warning signs
• Possible mitigations or conditions
• Decision notes
• Follow‑up action 

Examples and tips

• For a first export order to a new buyer, focus on counterparty, payment, logistics, and basic compliance risks. Keep the table short but focused.​
• For diversification into a new market, emphasize country, regulatory, ESG/RBC, channel and internal capacity risks. 

Web‑search‑enabled AI tools can be useful for organizing information and to speed up early research. They should not be used as substitute for official requirements, professional advice or your own due diligence.

AI tools may help you:​

• Assess very recent information that may not yet appear in printed guides or older reports.
• Surface information from foreign‑language sources and summarize it in your preferred language.
• Draft or organize criteria, question sets, comparison tables or summaries that you will then review and refine yourself.

However, AI-generated outputs have important limitations:

• They depend on the quality, scope and interpretation of the underlying sources.
• They may miss nuances, be incomplete or hallucinate details that are not supported by the sources it cites.
• They must always be verified against authoritative sources such as official statistics, current regulations, reputable reports and advice from our trade commissioners or other qualified experts. Do this before using them for decisions.​

You remain responsible for checking that any AI‑generated content you use is accurate, current and appropriate for your business and target market.​

​You can use any general‑purpose AI assistant that searches the web and shows sources clearly, such as:

• Perplexity: Answer engine that grounds responses in current web pages and shows inline citations with clickable sources
• ChatGPT with Search / ChatGPT Search: OpenAI’s search mode that uses live web data and displays linked sources in the answer
• Microsoft Copilot: GPT‑4‑class assistant with Bing grounding; typically shows numbered footnote links to underlying pages
• Claude with browsing: an assistant that can call web search (for example, via Brave) and cite URLs and titles when browsing is used

Using more than one engine for the same question can highlight areas of agreement and disagreement that deserve closer manual checking.​

The sample prompts below are optional. They are intended to help you structure thinking and questions, not to make decisions for you. Always verify outputs using official data, expert advice and your own analysis.

Be sure to edit the information in the brackets before you paste it.​

• Use AI outputs only as a supplement to your own research and judgment.
• Copy any useful questions or signals into your risk assessment worksheet.
• Verify key facts and sensitive points, especially those that impact sales projections or risks, and those involving sanctions, export controls, data, ESG issues or human rights, through official and expert channels.
• Update your decision notes and follow-up actions based on what you confirm.