Risk and Resilience in Your Business

Running a business can be risky.  There are so many things that can impact your performance, and profit.  Potentially destroying all that you worked so hard to build. Some of these things are impossible to plan for, but lots of potential risks can be mitigated by identification and planning.

Businesses need to be resilient.  Able to absorb shocks, adapt, and recover from disruptions—whether they’re internal or external.

I can not cover all risks in this document, but here are a few examples.

The Risk and Resilience cycle for small businesses

1. Identify Risks – What could go wrong?
2. Assess Impact – How likely is it, and how severe could it be?
3. Mitigate – What can you do to reduce the risk?
4. Plan Response – How will you react if it happens?
5. Review and Adapt – Risks evolve, so your plans must evolve too.

Benefits of Building Resilience

• Reduce downtime in a crisis
• Maintain customer trust and loyalty
• Have fewer regulatory breaches or fines
• Improve financial stability
• Make better decisions under pressure

Financial

Many, if not all of the risks we will explore will have a financial impact, but there are also overriding financial themes.

Cash Flow is crucial for business success.  If you run out of cash you will not be able to pay wages, suppliers or taxes.

Bad debt –  Sometimes customers will not pay your invoices, either on time or sometimes at all.  This is for one of two reasons:

• Unable – they are in a cash flow crisis of their own or in some cases, have gone into liquidation
• Unwilling – There may be a dispute over the quality of the work you have provided.

Numbers being out of date or inaccurate – To make good business decisions we need good data, so if our bookkeeping

• Isn’t up to date
• Isn’t  correct
• Or, we don’t know how to interpret them

We can end up making decisions that do not add value to the business

Forecasting – if we are only looking at historic numbers, we can not plan.  If we do not plan we could risk

• Not hitting our targets
• Not being as profitable as we could be
• Running out of cash

To mitigate financial risks we should:

1. Have up to date accurate data in our bookkeeping software
2. Analyse and interpret this data to make good business decisions
3. Forecast using this data, to ensure we maximize our potential and we don’t run out of money
4. Use targets as an early warning system, and where appropriate, take mitigating actions when results deviate from the plan.

People based risks

One of the biggest risks I see business owners take (especially small business owners and startups), is to do everything for themselves.  This saves money in the short term, but the risk of doing things yourself, that you are not the best person to do include: growth, quality and even compliance.

• Inefficient use of time – tasks outside of our expertise take longer and mean we are not focused on growth opportunities as our attention is spread to thin
• Mistakes – without the proper knowledge we could end up facing fines
• Legal and regulatory non-compliance – breaches can lead to penalties, legal action or reputational damage
• Poor Quality Output – customers may perceive your brand as unprofessional or unreliable
• Burnout and Stress – taking on too many roles increases workload and stress
• Bottlenecks and lack of scalability – difficulty scaling or selling

This risk becomes even more pronounced if everything relies on the business owner, as what would happen if the business owner should fall ill or even die.  New start business owners often make all the decisions and keep most of the key data in their heads.    The risks of this for the business are catastrophic.

Shared Ownership can be an answer to this, but brings with it, its own risks.

• Disputes between owners
• Unequal effort or contribution
• Exit or death of a shareholder
• Deadlock in decision making
• Access to information or power
• Financial disagreements
• Family and friendship strain

The best way to mitigate these risks is in a robust shareholders/partnership agreement.

Reliance of key personnel.  This could be the owner, or one of the shareholders, or another key member of the organization.

Whether it’s the owner or founder, or a highly skilled employee, if the business has a heavy reliance on one particular person, then there is a high risk to the business.

• Illness
• Death
• Resignation

The impact on the business could be:

• Operational disruption – no one else knows how to do it
• Loss of clients – if the relationship is with one person
• Loss of knowledge – if only that person understands the systems or can make decisions
• Reputation and client confidence – if only one person knows how to do it
• Legal and compliance – if only one person understands the rules or deadlines

You can mitigate this risk by training up other team members, documenting information and processes.  You should also consider key person insurance.

If you are looking for an investor or lender, and over reliance on one person will often be seen as a red flag, meaning you won’t get the investment or you will suffer higher risk premiums.

Customer/Client based Risks

When assessing a customer base, risk is mostly a matter of concentration.  With a well-diversified customer/client base, losing one client wouldn’t seriously harm the business.

You should also consider the type of customer, when looking at diversification.  If all your customers/clients are in the same industry, or geographically close, then this could also have an impact on risk.

Length of contract, can also have an impact on risk.  Lower risk businesses would have a customer base which has:

• Repeat business and retainers
• Written contracts, estimates or proposals – these are powerful tools when mitigating risk associated with non-payment and disputes.
• Predictable payments terms which are say 30 days (rather than longer payment terms)

One of the biggest risks associated with clients, on a small business, is nonpayment.  Bad debt can have a devastating impact on cash flow.

To reduce risk:

• Credit check all new clients, and repeat this regularly.
• Set credit limits, and enforce them
• Have a robust credit control process and follow it
• Have written, signed agreements before you start work
• Keep payment terms as low as you can
• Have a diverse client base.

Supplier based Risks

If you are reliant on a key supplier, or suppliers, this can also be risky.  All the risks you face in your business, they could also face, and any one of these could mean that you do not receive the key goods or services you need to trade.

You must also consider risks associated with:

• Price increases or unfavorable terms
• Quality control issues
• A suppliers financial stability
• Geographical risks, especially if your supplier is overseas.  You may need to consider trade restrictions, war or weather on your supply.

Again, the best way to mitigate risk is to diversify, and to have robust contracts in place.

Product Based Risk

If your business produces and sells products, then there are a number of product specific risks you need to consider, including:

• Quality or performance – could lead to returns, and refunds but also reputational impact
• Safety – could it cause injury or damage to property
• Regulatory non-compliance – lots of safety standards to comply with
• Intellectual Property (IP) infringement – or in fact protection of your own IP
• Copyright or patent – will someone copy your product
• Change in market demand – could lead to product write offs

You could end up with refunds, recalls or legal claims.  Or, the risk could be reputational, with poor reviews and bad publicity. It is really important to do testing, get certification, have risk assessments and take out relevant insurances to mitigate some of this risk.

Regulatory Risk

These are some of the most significant threats faced by small businesses, because non-compliance can lead to fines, investigations, reputational damage and even closure.  Small businesses often lack the dedicated compliance staff of their larger counterparts, putting them at greater risk.

Often industry/sector specific but also cover things like:

• Data Protection – handling personal data (customers, employees and suppliers)
• Employment Law – covering things like unfair dismissal, discrimination, wages and health and safety
• Health and Safety – in the workplace for employees, customers, suppliers or other people coming onto your premises.
• Tax Compliance – VAT, PAYE, Corporation Tax and self-assessment filings
• Environmental Regulations – waste, emissions etc
• Product safety standards
• Customer protection – misleading advertising, unfair terms etc
• Corporate Governance & Company Law – breaches of the Companies Act

As a small business owner, there is so much that you don’t know.  It is always advisable to use professional advisors, to utilize their specialist knowledge, especially in the area of regulatory compliance.  But undertaking relevant training, having clear policies, procedures and contracts, and undertaking risk assessments, will also help reduce risks.

Cyber Security Risks

Many small business owners could believe that they are too small to be attacked, however:

• Lack of dedicated cyber-security staff
• Less mature governance
• Increasing use of cloud service
• Remote working

All add to the threat to SMB owners.

These risks could be under any of the following categories:

• Phishing/social engineering – employees are tricked into giving up credentials, or clicking malicious links
• Ransomware & double-extortion – data is encrypted and threats made to release data
• Entry via a supplier – The supplier is hacked, and then used to access the often weaker links of the SMB
• Insider threats, weak access controls & credentials – not using 2FA (multi-factor authentication is an easy win for hackers, along with was passwords and re-used credentials.
• Remote working – home networks and personal devices could be the weak link in the chain

Acts of God – Flood, Fire etc

What is your back up plan, if there is a fire or flood in the office, do you have a disaster recovery plan, so that you can keep working?

Whilst you may have insurances in place to replace the office, its furniture and fittings.  Do you have risk assessments in place to ensure you are not taking risks with anyone who might be in those commercial premises, and how do you maintain the same level of service whilst the business is being disrupted.