Operational risk in small companies: where to start

In a small company, risk is rarely abstract: it is a person who leaves, a single supplier, a password only one person knows, a file with no backup. Managing risk means putting those dependencies in writing before they materialize.

Start with dependencies, not with theory

A useful first list comes from answering four questions about each critical process.

• Which person is indispensable, and what happens if they are away for two weeks?
• Which supplier or system has no immediate alternative?
• What information would be lost irrecoverably, and how much work would it take to rebuild?
• Which failure would have contractual or legal consequences?

A shared scale, however simple

You do not need a quantitative model. A three- or five-level scale for likelihood and impact, applied consistently by everyone, is enough. The value is not the precision of the number but the ability to compare risks and prioritize in a common language.

Controls that actually exist

A control is real when it has an owner, a frequency and evidence. "Review orders carefully" is not a control; "the operations lead checks the unconfirmed order list every Friday and records the result" is. If a control leaves no trace, it cannot be verified and, in practice, it does not exist.

Logging incidents is half the work

Without an incident log, the risk conversation depends on memory and on the most recent scare. A simple log — date, affected process, apparent cause, consequence — turns perception into evidence and shows where control investment belongs.

Proportionality

The cost of a control should be proportionate to the exposure. A small company does not need corporate control machinery, but it does need to know which risks it has consciously decided to accept. That documented decision is the entire difference between accepting a risk and ignoring it.