Risk Management for Mid Sized Firms: Quantify, Own, Review
Risk is not a register updated once a year. It is a way of seeing the business. A practical framework for boards and founders who want fewer surprises.
Large companies have risk committees, chief risk officers and frameworks that run to hundreds of pages. Mid sized firms usually have a spreadsheet someone updated for the auditors. Yet mid sized firms often carry the most concentrated risks: a single client worth a third of revenue, a key contract with no protection, a founder who holds every relationship.
Good risk management for a firm of this size is not about volume. It is about three disciplines.
Quantify in money, not adjectives
Most risk registers describe likelihood and impact as high, medium or low. Those words cannot be compared, prioritised or budgeted against. Every material risk should carry an estimate in money: what would this cost if it happened, and how likely is it over the next twelve months?
The estimates will be rough. Rough numbers still allow a board to see that one risk is worth ten times another, which colour coding never does.
Assign ownership to a person
A risk owned by a department is owned by nobody. Each material exposure needs a named individual with the authority to act on it, a clear statement of what the company has decided to do about it, whether to accept, transfer, reduce or eliminate, and a date when it will next be reviewed.
Review on a rhythm the business already has
Risk frameworks fail when they add a new meeting. They succeed when they attach to a meeting that already happens: the monthly leadership review, the quarterly board. Ten minutes on the five largest exposures, with early warning indicators showing whether each is moving, is worth more than an annual offsite.
What belongs in the framework
- A risk appetite statement: what the firm is willing to lose and what it is not.
- An assessment covering operational, financial, regulatory, technology and reputational exposures.
- A control map showing which controls address which risks and who operates them.
- Early warning indicators for the largest exposures.
- A board reporting template that fits on one page.
Connecting to compliance and audit
Risk sets the priorities. Compliance and internal audit verify that controls operate. Running these as one joined up programme rather than three separate exercises reduces duplicated effort and produces a coherent story for investors and regulators.
The business impact
Firms with a working risk framework make decisions faster, not slower, because leadership knows which exposures are acceptable and which are not. They negotiate better with insurers and lenders. And they experience fewer of the surprises that turn a good year into a difficult one. The framework takes three to six weeks to build. Its value shows up in the years when nothing goes wrong, which is exactly the point.
Apply this to your business
Talk it through with the people who wrote it.
Tell us the decision behind your question and we will tell you honestly whether we are the right fit.
