A method of analyzing and presenting a series of risk factors associated with the operation of a business, such as a bank. Quantifiable risk factors are identified. Ranges of acceptable and unacceptable values for the factors are selected and arranged to each factor. Each risk factor has an immediacy value, or risk tolerance, assigned to it. A business is evaluated by measuring the actual values for each factor found in the business, comparing the actual values to the user-defined acceptable value ranges for each factor and creating a report identifying unacceptable valued risk factors and their immediacy value to the business. The measuring, evaluating and reporting may be automated using a computer, or portions can be done manually.