Risk Management Without a Risk Department

The four questions

For each risk: what could happen, how likely is it, what would it cost, and what would you do about it.

That is the whole framework. Everything else in corporate risk management is elaboration on those four.

The risks that actually close small UAE businesses

Not the exotic ones. These four.

Losing one customer. If a single customer is more than about 30% of revenue, this is your largest risk and it is quantifiable today.

Running out of cash while profitable. Growth, slow collection or stock consuming more cash than the business generates.

Losing the owner. Everything depends on one person who holds the relationships, approves the payments and knows how pricing works. If they are unavailable for a month, what stops?

Internal loss. One person controlling both the record and the money. Rarely planned for and reasonably common.

Work through those four before considering anything else.

The one-page process

List no more than ten risks. If you list forty, nobody reads it.

For each, one line on likelihood, one on cost, one on what you are doing about it, a name and a date.

Review it every six months and when something significant changes.

Deciding what to do about each

Four options, and picking deliberately is the point.

Avoid. Stop doing the thing. Rarely available, sometimes right.

Reduce. Add a control. Most risks land here.

Transfer. Insurance or a contract term. Read what is actually covered.

Accept. Deliberately, in writing, with a note of why. Accepting a risk knowingly is a legitimate decision. Not noticing it is not.

The mistake that makes this useless

Producing the register and filing it.

The register is not the output. The actions with names and dates are. A register with no action column is a document about worrying.

The check nobody runs

Ask what you would do if your accounting system were unavailable for a week. Or your main supplier stopped. Or your largest customer paid 90 days late.

Not what you would feel. What you would actually do, on Monday.

Most owners find they have no answer, and that is more useful than any scoring matrix.

Where the financial risks show up first

In your numbers, months before they become a crisis.

Customer concentration is in your revenue analysis. Cash risk is in a 13-week forecast. Margin risk is in gross margin by month. Internal loss risk is visible in who can approve what.

Someone looking at those monthly sees most of this coming.

Where we fit

We produce the analysis behind the financial risks and run control reviews on the internal loss side. Send your management accounts and revenue by customer.