Free business resources · Australia
Your small-business website risk worksheet
Give yourself a clear picture of your website before deciding what to change. Work through these questions with the person who builds or manages it. “We have not checked yet” is a useful answer.
No answers are collected on this page. Download the text template and complete it in your own files. Store completed records securely; they may contain sensitive business information.
Download the blank worksheet (.txt)1. Describe the service
Record the site address, purpose, assessment date, owner and version. List forms, accounts, payments, uploads, comments, messages, recommendations, AI and connected suppliers.
2. Identify who could be affected
Consider customers, staff, people mentioned in content, and children who may use the service. Record what you know and what remains uncertain. Do not collect identity documents simply to complete this worksheet.
3. Describe the possible harm
Write a concrete scenario: what could happen, through which feature, and to whom? Consider unwanted contact, harmful content, impersonation, exposed information and unsafe AI responses where relevant.
4. Check controls and evidence
Record the existing safeguard and evidence that it works: a tested report route, moderation procedure, permission setting or data-deletion process. A policy page alone does not prove day-to-day practice.
5. Prioritise and assign action
Describe likelihood and impact in words, explain your reasoning, record uncertainty and name an owner with a target date. Do not let an overall score conceal a serious issue.
6. Review and keep the record
Record remaining risk, approval, review date and triggers such as new messaging, uploads, AI or a changed audience. Confirm any legal review and record-retention requirements against the applicable law.
An example of a useful risk entry
Illustrative example: a business adds public customer comments.
- Possible harm
- A commenter publishes another person’s contact details.
- Existing control
- Comments require approval before publication.
- Evidence to obtain
- Test the approval setting and confirm who checks submissions during leave.
- Next action
- Document escalation and removal steps, assign a backup reviewer and retest.
- Remaining uncertainty
- The team has not yet tested attachments or embedded links.
This is an example of reasoning, not a rating of your website.
What the finished record should contain
A service summary, people affected, feature inventory, separate risk entries, evidence references, unresolved questions, actions, owners, dates and review history. Keep observations, client statements and assumptions distinguishable.
Our template is an original preparation aid. It is not the government’s prescribed form and does not reproduce eSafety’s assessment tools. Explore eSafety’s own learning tools ↗
Use your browser’s Print command if you prefer a paper copy of this guide.