It is increasingly concerning how many businesses do not consider risk management as part of their business plan and ongoing development. It is good practice for all companies to have some level of risk identification in place as well as management processes that will aid avoidance, minimise impact and maintain business continuity.

Growing businesses are particularly susceptible to risk and should review their risk environment and assessment/management plan on at least an annual basis. This should be in line with the business objectives and highlight any changes in process, activities, target customers, recruitment, new products/services etc.  

The risk environment can change considerably as a company grows, as can its risk appetite. For example, larger premises or perhaps moving to a multitenant site create a whole new set of risks. A larger site means more staff who whilst usually being a company’s greatest asset, are often also their greatest risk. A broader customer base increases reliance on stock, suppliers, contractors and other service providers as well as litigation or the likelihood of a disgruntled client providing negative feedback in a social domain, which can be devastating in the modern business world. More customers could potentially result in reduced service or product standards which is a risk in itself.

Ultimately, larger businesses are a more attractive target for criminals as the rewards for a successful crime are interpreted as bigger. The transmission of such an incident could impact any of the above factors.

Similarly, the risk appetite of businesses will likely change as they grow. A small business cannot tolerate much risk and one incident could potentially have massively damaging effects. Larger companies can endure more risk and as such, their appetite will increase as they grow. However, this should be a measured and considered risk and not a reckless one. 

In many growing companies, risk management or security is often not a priority and financing a marketing campaign or a tangible piece of equipment is more preferable as a clear outcome and benefit to the business can been seen. Investing in risk identification and associated reduction activities from the outset is however important, and a key element of a business plan. A sound basis can be built upon as the company subsequently grows and risk identification becomes clearer as new services, premises and staff are introduced.