Managing Business Risk: A Practical Guide for Small Firms

For nine years, Sunita’s printing firm in Leicester did most of its work for one retail chain. It was reliable, profitable and easy. Then the chain was bought, a new procurement team arrived, and the contract went to a national supplier with six weeks’ notice. Nothing was wrong with her service. Sixty per cent of her turnover simply vanished. Managing business risk sounds like something for big companies with compliance departments, but small firms feel it far harder, because one shock can be the whole story. The good news is that the fixes are mostly cheap.

Risk	Cheap first step
One customer is most of your sales	Set a target to cap any customer at a share you could survive losing
Everything depends on you	Write down how things are done; consider key person cover
Cyber attack or data loss	Two-factor login, tested backups, staff awareness
A single supplier	Identify a second source before you need it
Staff injury claim	Employers’ liability insurance — compulsory, £5m minimum
Cash shock	A reserve covering a few months of fixed costs

A one-page risk register is enough

Forget complex frameworks. Take one sheet of paper and list everything that could seriously hurt the business: losing a big customer, falling ill, a fire, a data breach, a key supplier going bust, a large unpaid invoice. For each, score two things from one to five: how likely it is, and how bad it would be. Multiply them. Anything scoring high gets a named action and a date. That is a risk register, and for most small firms it takes an hour. Sunita had never written hers down, which is why the one risk that scored highest — a single customer worth sixty per cent — felt like good fortune rather than danger. Review the page every six months, or whenever something big changes.

When one customer is too much of the business

Customer concentration is the risk small firms most often mistake for success. A big client is steady, pays well and saves you selling. But if losing them would end the business, you have handed your future to their procurement department. Set yourself a limit — many owners aim to keep any single customer below a quarter or a third of turnover — and treat growth elsewhere as protection, not just ambition. Contracts help too: notice periods, minimum volumes and clear payment terms buy time if things change, which is where the basics of business contracts earn their keep. A big customer paying late is its own danger, so keep a close eye on your cash flow forecast.

The key person problem

In most small firms the biggest single risk is the owner. If you were off for three months, who would quote jobs, pay suppliers or know the banking passwords? Start by writing down how the important things are done, and make sure at least one other trusted person can reach the accounts and records. Key person insurance can pay the business a lump sum if someone vital dies or becomes seriously ill, buying time to recruit or wind down properly. If there is more than one owner, the question of what happens to a share on death or illness belongs in a proper partnership or shareholders’ agreement, and longer term in succession planning.

Insurance, including the one you must have

Insurance moves risks you cannot afford onto someone who can. One policy is not optional: once you employ anyone, employers’ liability insurance is compulsory in most cases, with at least £5 million of cover. Going without can bring fines of up to £2,500 for every day you are uninsured, and £1,000 for not producing the certificate when an inspector asks. Beyond that, think about public liability if customers visit or you work on their premises, professional indemnity if you give advice, and business interruption cover, which pays when a fire or flood stops you trading. Review policies every year, because cover that fitted three years ago may not fit now, and pair it with sensible health and safety arrangements.

Cyber risk is now an everyday risk

The government’s Cyber Security Breaches Survey found that 43% of UK businesses reported a breach or attack in the previous twelve months, including 42% of micro businesses and 46% of small ones. Most attacks are not sophisticated: a convincing email, a reused password, a fake invoice with changed bank details. The defences are cheap — two-factor login on email and banking, automatic updates, backups you have actually tested, and a rule that any change to payment details is confirmed by phone. Our guides to business fraud and scams and data protection cover the details. If you supply larger firms, expect questions: the “failure to prevent fraud” offence that began on 1 September 2025 applies to large organisations, and many now check their suppliers.

Suppliers and the supply chain

A single supplier for something you cannot trade without is a single point of failure. It does not have to go bust to hurt you; a price rise, a shortage or a delivery problem can do the same. Identify your critical inputs and find at least one alternative before you need it, even if you rarely use them. Keep a small buffer of essential stock where it makes sense. Check the financial health of important suppliers the way you would check a customer. The aim is not to spread orders thinly for the sake of it, but to make sure one phone call from a supplier cannot stop your business for a month.

Legal and reputation risks

Some of the most damaging risks never appear on an insurance schedule. A contract signed without reading the liability clause can make you responsible for losses far bigger than the job was worth. A dispute with a customer handled badly online can cost more than the refund would have. Staff issues handled without a written process can end in a tribunal. None of these needs a lawyer on retainer. Use standard terms you understand, read any contract that limits or extends your liability before signing, keep written records of complaints and how you resolved them, and put basic employment policies in place before you need them. Reputation is built slowly and lost quickly, so treat a public complaint as a chance to show how you put things right.

Cash is the cheapest insurance of all

Almost every risk on your list becomes survivable if there is money in the bank while you fix it. A reserve covering a few months of fixed costs — rent, wages, loans, essential software — turns a lost customer from a crisis into a hard quarter. Build it steadily from profit rather than all at once, keep it in a separate account so it does not quietly become working capital, and agree with yourself what it is for. If a downturn does arrive, our guide to trading through a downturn covers what to cut and what to protect.

How Sunita rebuilt

It took her eighteen months. She let two part-time roles go, used her small reserve to cover the gap, and spent every spare hour winning smaller clients. Today no customer is more than a fifth of her turnover, she has a second paper supplier, and her risk register lives on one page pinned by her desk. She says the lost contract was the worst thing that happened to the business and the most useful. Managing business risk is not about predicting every disaster. It is about making sure no single one can finish you, and doing the cheap things before you need them.

Frequently asked questions

What is business risk management?

It means identifying what could seriously harm your business, judging how likely and damaging each risk is, and taking practical steps to reduce or transfer it.

Is employers’ liability insurance compulsory?

Yes, for most businesses with employees. Cover must be at least £5 million, and going without can bring fines of up to £2,500 per day.

What are the biggest risks for small businesses?

Common ones are depending on one customer or supplier, relying on one key person, cash flow problems, cyber attacks and uninsured accidents.

How do I create a risk register?

List the main risks, score each for likelihood and impact from one to five, multiply the scores, and give the highest ones an action and a date.

Does the failure to prevent fraud offence apply to small businesses?

It applies directly to large organisations from 1 September 2025, but small suppliers to large firms may be asked about their fraud controls.

How much cash reserve should a small business keep?

Many owners aim for a few months of fixed costs such as rent, wages and loan repayments, kept in a separate account.

This article is general information, not legal, insurance or financial advice. Insurance needs and legal duties depend on your business. Speak to an insurance broker or adviser about the cover that fits your situation.