You can feel that the business is fragile somewhere, but you do not yet know where, or how badly. That matters more than it sounds.
Structural risk comes in five shapes that feel identical from the inside and need completely different work: you have never found your fault lines, everything depends on a key person, too much rides on one customer or supplier, you have no plan for a loss, or you have no buffers at all. Building a continuity plan while ignoring the key-person dependence that would trigger the crisis just plans for the wrong thing. This sorts out which one you have, scores each honestly, finds the one holding back the others, and hands you a sequenced plan.
This is a sorting instrument, not a fix. It will not make your business resilient. It tells you where it is fragile and in what order to work, so you spend your energy on the right thing rather than the loudest thing. It takes about forty five to sixty minutes, an honest look at who and what the business depends on, and the willingness to write down the three events that would most damage or end the business.
If a critical risk is imminent right now, a key customer about to leave, a key person departing next week, a supplier failing, that is not something to sequence behind other work. Handle it immediately, then come back and plan the rest. There is a box for it below.
You cannot diagnose fragility you have not laid on the table. Before you score anything, describe plainly who and what the business could not survive losing, where the revenue concentrates, the single points of failure, and whether any plan or buffer exists. The most clarifying question to sit with: what are the three events that would most damage or end this business, and how exposed are you to each right now?
Open the Structural Risk Baseline Snapshot →Now turn the snapshot into a measurable read. Answer each of the fifteen statements below the way it really is, across the five parts of structural risk, so the work becomes something you can score rather than just worry about.
The five sub-domains sit in a dependency order. Risk identification is most upstream, because you cannot reduce, plan for, or fortify against risks you have not found, then key-person risk, then concentration, then continuity planning, and resilience and monitoring is the sustaining layer on top. Your binding constraint is the weakest sub-domain that sits highest in that order. The finding above names it for you; this tool is where you confirm it and write it down in one sentence.
Open the Structural Risk Constraint Map →Turn the scores and the constraint into a written, sequenced plan. Address an imminent critical risk first if you flagged one. Then start with the guide for your binding constraint, add every other sub-domain that came back weak in dependency order, drop any that are already strong, and set a target for each.
Open the Prioritized Resilience Action Plan →Risk work is easy to defer because the danger is not yet visible, which is exactly why it gets fixed only after the shock. The date is the guardrail. Name the first guide, the first concrete action, the date you will start, and what started will look like. Return at reassessment to record how far each sub-domain has moved.
Continue in the Prioritized Resilience Action Plan →Two moments here reach past these pages. If working through the snapshot makes plain that the whole business has been built around one person's head, usually the founder's, notice that, because it is its own risk with its own work. And if a critical risk is genuinely imminent as you read this, treat it as the live emergency it is, not a worksheet, and act today.
You can name your single binding structural risk in one plain sentence. You have a sequenced plan rather than a vague unease about fragility. And you have a dated first action with an owner, with any imminent critical risk flagged for immediate attention.