risk managment for small business

Most small-business owners treat risk management as paperwork for big companies with legal departments. Li argues the opposite: a five-person firm has less slack, so one uninsured event can end it. This book suits founders, sole traders, and family-business owners who want a practical, low-cost system rather than corporate jargon. Read it before you need it, not after.

1. 1Chapter 1

   Risk management is survival, not bureaucracy

   Li opens with a small bakery that floods after a storm. The owner assumed disaster relief would cover the damage and carried no flood insurance because the bank never asked for it. Repairs eat the cash reserve, the ovens sit idle for two months, and regular customers drift to a competitor that stayed open. Within a year the bakery closes. Li uses the closure to show that the owner never sat down to list what could go wrong, so no one ever decided whether flood cover was worth the premium.

   The idea

   Small firms skip risk management because it sounds corporate, yet they are the ones with the thinnest cushion. A large company absorbs a bad quarter; a small one can be ended by a single uninsured event. Li reframes the exercise as a short, honest conversation with yourself about what would actually close your doors. The surprise is how cheap most protections are compared with the cost of the loss they prevent.

   Try this: Write down the three events that would most likely force you to close within a year, and price what each would cost you.

2. 2Chapter 2

   Build a risk register you will actually use

   Li describes a hardware store owner who kept risk knowledge entirely in her head. When she fell ill for six weeks, no one else knew which supplier was unreliable or which machine was due for service, and orders slipped. After recovering, she spent one evening listing every risk she could think of in a spreadsheet, scoring each for likelihood and impact, and naming who would handle it. The register now lives in a shared folder, and the store has since swapped two failing suppliers before they caused a stockout.

   The idea

   A risk register is nothing more exotic than a list: what could go wrong, how likely, how bad, who owns it. Its power comes from being written down where others can see it, because knowledge locked in one head disappears exactly when it is needed most. Li stresses scoring honestly rather than precisely; a rough ranking that gets updated beats a perfect model nobody maintains.

   Try this: Open a spreadsheet tonight and list ten risks with a likelihood score, an impact score, and an owner for each.

3. 3Chapter 3

   Cash flow is the risk that kills first

   A landscaping firm wins its biggest contract and buys a second truck and extra equipment on credit to handle it. The client pays on ninety-day terms, payroll is due monthly, and by week six the owner cannot meet wages and borrows at high interest to bridge the gap. Li shows how the firm's most profitable year nearly became its last because growth consumed cash faster than invoices returned it. The owner survives by renegotiating terms and selling the second truck, then builds a buffer sized to cover payroll through the longest expected payment delay.

   The idea

   Profitable businesses fail every day because money arrives later than it leaves, and growth makes this worse, not better. Li treats cash-flow timing as a risk to be measured like any other: how long can you cover wages and rent if your largest customer pays late? The counterintuitive move is refusing or repricing deals whose payment terms would stretch you past your buffer, since a contract that bankrupts you is worse than no contract.

   Try this: Calculate how many weeks you could cover payroll and rent if every customer paid late, then set a minimum buffer to reach that number.

4. 4Chapter 4

   Insurance: buy for catastrophes, not for comfort

   Li profiles a café owner who insured every small thing: plate glass, signage, minor equipment. A kitchen fire then closes the business for four months, and she discovers her policy pays to replace the fryer but not the lost income while the doors are shut. She drains her savings, keeps paying two staff out of pocket, and reopens heavily indebted. Li contrasts her with a rival café across town that carried business-interruption cover and reopened on schedule after a similar fire, its payroll and rent paid by the insurer.

   The idea

   The common mistake is insuring against small, affordable losses while leaving the business-ending ones bare. Li's rule is to spend premium dollars where a single event could sink you: interruption of income, liability claims, and total loss of premises. Small, frequent losses are better absorbed from cash flow, and over-insuring them wastes money you will want when a real crisis hits.

   Try this: Read your policy tonight and answer one question: if you closed for three months tomorrow, what would the insurer actually pay?

5. 5Chapter 5

   Never let one supplier sink you

   A small furniture maker sources all its timber from a single mill because the price is unbeatable. The mill suffers an industrial accident and shuts for a season, and the maker, with no alternative source, misses delivery dates for its largest retail client, which cancels the account. Li then describes a competitor that pays slightly more to split orders between two mills and keeps three weeks of key materials in stock. When the same mill goes down, that competitor absorbs the orders and gains the lost client permanently.

   The idea

   Single points of failure feel efficient right up to the day they fail, and small businesses choose them more often than they admit. Li's advice is to identify anything you cannot operate without, whether a supplier, a machine, or one key employee, and build a backup: a second source, spare stock, or cross-training. The cost of redundancy is real but small next to the cost of losing your best customer.

   Try this: Pick your single most critical supplier and find one alternative you could order from within a week if they vanished tomorrow.

6. 6Chapter 6

   People risk: the business that lives in one head

   Li tells of a bookkeeping practice where one senior employee holds every client relationship, every password, and every filing convention. She resigns with a month's notice, and the practice spends the following year losing clients who felt the service had changed and reconstructing records nobody else could read. Li contrasts this with a rival firm that requires every client to have two named contacts and keeps procedures documented in a shared manual. When one of its staff departs, the handover takes two weeks and no client notices.

   The idea

   Key-person risk is the quietest threat in a small business because it looks like loyalty until the day it leaves. Li argues that documentation and cross-training are not bureaucracy but insurance against the loss of irreplaceable people. The uncomfortable test is simple: if your most important person resigned today, what would break? Whatever you cannot answer is where your documentation should start.

   Try this: Choose the one process that would hurt most if the person who runs it left, and write down how it works this week.

7. 7Chapter 7

   Reputation moves faster than you can respond

   A food truck gets a complaint about food safety posted online on a Friday night. The owner ignores it over the weekend, and by Monday it is shared across local community groups and the lunch queue has thinned. Li contrasts this with another operator who, facing a similar complaint, replies publicly within hours, invites the customer back, and posts a photo of the health inspection result. The complaint fades; the visible response earns more goodwill than the original criticism cost.

   The idea

   In a small business, reputation risk is local and fast: a handful of bad reviews or one viral complaint can empty a room within days. Li's counsel is to prepare a response before you need one, deciding who speaks, how fast, and in what tone. Speed and honesty beat polish; a prompt, human reply costs nothing and often converts critics, while silence reads as guilt.

   Try this: Draft your response plan now: who replies to a public complaint, within how many hours, and what the first message says.

8. 8Chapter 8

   Legal and compliance risks hide in plain sight

   Li describes a growing online retailer that hires its first five employees using a template contract found online. A dispute over unpaid overtime reaches a tribunal, and the retailer learns its contracts miss clauses required in its jurisdiction, turning a small claim into a costly settlement plus back pay. Li contrasts a competitor that pays for a one-hour legal review of its contracts and a yearly compliance check, catching the same issue before hiring. The review costs a fraction of the settlement and becomes standard practice before every expansion.

   The idea

   Compliance failures rarely come from deliberate rule-breaking; they come from copied templates, outdated assumptions, and growth into activities the old setup never covered. Li recommends treating legal review as cheap maintenance rather than an emergency expense, especially at predictable trigger points: first hires, new locations, new products, and crossing thresholds that change your obligations. An hour of expert time before the fact beats months of dispute after it.

   Try this: List the dates your contracts, licences, and registrations expire, and set reminders to review each before renewal.

9. 9Chapter 9

   Cyber risk is not just for big targets

   A two-person design studio assumes attackers ignore businesses its size until a phishing email captures the owner's email password. The attacker sends invoices from her account to her own clients, redirecting payments to a lookalike bank account, and two clients pay before anyone notices. Recovery consumes weeks: new credentials, awkward calls to clients, and money that is never fully recovered. Li walks through the studio's rebuild: multi-factor authentication on every account, a verbal confirmation rule for any change of payment details, and automatic backups tested by actually restoring from them.

   The idea

   Small firms are attractive targets precisely because they expect nothing to happen and invest nothing in prevention. Li's core protections are unglamorous and cheap: multi-factor authentication, tested backups, and a human checkpoint for payment changes, since most small-business breaches exploit trust and routine rather than sophisticated code. The backup rule matters most: an untested backup is a hope, not a plan.

   Try this: Turn on multi-factor authentication for your email and banking today, and call one client to agree a rule for verifying payment changes.

10. 10Chapter 10

    Plan the crisis before it plans you

    Li compares two small hotels after a regional power outage. The first improvises: staff are unsure whether to send guests away, no one can find the contact list for the utility, and reviews mention confusion. The second has a one-page plan taped inside the office door: who decides, how guests are informed, which numbers to call, and what to refund. Its staff follow steps written in calmer times, guests are updated within the hour, and several later praise the handling online. Li notes the plan took one afternoon to write.

    The idea

    A crisis plan is not a binder; it is one page that answers who decides, who speaks, who is called, and what customers are told. Its value comes from being written when nobody is panicking, because decisions made under stress are slower and worse. Li suggests walking your team through the plan once, so the first time they read it is not mid-crisis.

    Try this: Write a one-page crisis plan this week covering who decides, who calls whom, and what customers hear in the first hour.

11. 11Chapter 11

    Review on a rhythm or the register rots

    Li revisits the hardware store owner from earlier in the book, whose first register was full of risks that no longer applied two years on: suppliers she had dropped, machines she had sold, and nothing about the online sales channel she had since opened. A near-miss stockout prompts her to put a recurring reminder in her calendar to review the register each quarter. At each review she deletes stale entries, adds new ones, and re-scores anything that has changed. The register becomes a living document the staff consult rather than a file nobody opens.

    The idea

    Risk management fails not at the start but at the maintenance stage, when the register becomes a snapshot of a business that no longer exists. Li's fix is rhythm: a fixed review date, a short agenda, and permission to delete anything stale. New risks usually arrive with change, so every new product, supplier, or channel is the natural trigger to ask what could now go wrong.

    Try this: Put a recurring quarterly reminder in your calendar to review your risk register, and hold the first one this month.

12. 12Chapter 12

    Risk-taking is the point; recklessness is not

    Li closes with the story of a small adventure-tour operator deciding whether to add a new activity that would double its seasonal revenue. Rather than deciding on gut feel, the owner scores the risks, buys the extra liability cover, trains two guides, and sets a condition: if bookings in the first season fall below a set number, the activity is dropped. The launch succeeds, but Li's point is that the operator was prepared to walk away, and that discipline is what made the bet safe enough to take.

    The idea

    The goal of risk management is not to eliminate risk, which would also eliminate growth, but to take risks deliberately, with eyes open and exits planned. Li distinguishes risks you choose, priced and bounded, from risks that choose you, unnoticed and unbounded. Small businesses usually outperform big ones at this because decisions are fast; the discipline is simply to name the bet before placing it.

    Try this: For your next big decision, write down in advance the condition under which you would reverse it, and honour it.

Founders, sole traders, and family-business owners who have never written down what could sink them. Also valuable for managers of small teams who want a low-cost, practical system rather than corporate risk frameworks.

FAQ