SMEs: off the radar

The business continuity industry never tires of pointing out that 80% of
businesses that suffer a disaster go under within 18 months. And given that most
businesses are small or medium-sized, and that SMEs are the ones with the fewest
resources and reserves, they are the ones that suffer the most from business

While that depressing DTI statistic may or may not be confused with the fact
that many small businesses disappear anyway, the Home Office estimates that one
in five businesses suffer a major disruption every five years.

Throw in terrorism, employment tribunals, computer hackers and viruses,
global warming, health and safety issues, disasters such as Buncefield and
scares such as avian flu, and risk is apparently everywhere. Companies selling
risk assessment services, business continuity plans, backup facilities and the
rest vigorously make hay while the disaster sun shines.

Not surprisingly, the results of a poll at the end of last year by the ICAEW
show that 73% of small and medium-sized businesses discuss how to handle general
business risk more than once a year. And that, of course, means a lot of
companies don’t spend a lot of time scrutinising risk.

Even where discussion and risk assessment are regularly undertaken, the
resulting plans of action may be skimpier than advisable. Most smaller
businesses have tightly stretched managements that are too involved in the
everyday (first-tier) risks of managing employees, technology, sales and public
relations to worry about what would happen if a major customer or supplier went
bust, the local petrol station blew up, or its workforce went down with avian

That statistic of one in five businesses suffering disruption every five
years is one that many SMEs feel is comfortably remote. In fact, when asked to
give examples of SMEs that had suffered as a consequence of failing to carry out
risk assessments, consultants were hard pressed to name names.

Clive Lewis head of SME issues at the ICAEW, says: ‘Because there is little
demand for risk assessment, many smaller accountants don’t offer the service to
their clients. This is a shame. Companies should discuss second and third-tier
risk twice a year so that the problems and solutions are at least on the radar.
But companies feel they have better ways of spending their time. After all, if
half your workforce goes down with avian flu, would it make much difference
whether you had discussed it or not? However, many of the risks covering fire,
safety, security and business continuity are having to be addressed because
insurers [see box] are demanding it.’

Understandably, unless they have experienced serious incidents, many
companies underestimate the costs of disruption and overestimate how much their
standard insurance policies will cover.

David Viles, Deloitte partner involved with the internal audit and risk
management practice, says: ‘My feeling is that the Big Four are not seeing any
real demand from SMEs for risk assessment work in health or safety or any other
area. On the whole, our higher rates will mean that if SMEs are looking for this
kind of advice they will go to specific niche players.’

Gale Chadwick, a director of BDO Stoy Hayward, says: ‘Small company directors
feel they have all the answers in their head. However, if they don’t look at
risks in a structured way, then they not only get shocks but the fire fighting
will take much longer. There have been several cases of smaller companies being
hit by big compensation claims because they did not take their display screen
assessment seriously, injuries resulted and big claims followed. Risk in the
form of changing regulation is changing all the time. One company I know faced a
big fine because it was not disposing of its waste properly.”

Michael Snyder, senior partner of Kingston Smith, which acquired specialist
consultancy HR Insight nine months ago, says: ‘The whole business of employment
risk is something that worries companies of all sizes and they do value
specialist advice. A minority of employees play the system and many companies
cannot afford their own HR departments and need outsourced help. Across the
board we are seeing far more recognition of risk of all types from our clients
and more discussion about regulatory issues, loss of major customers and
suppliers, terrorism and the environment. The very small companies, the one-man
bands who live from hand to mouth, don’t have time.’

The ICAEW research calculated that, on average, small companies spent £44,000
and medium-sized companies £150,000 on risk management a year. This figure
includes the costs of insurance, management and staff time, security and
internal and external audits. However, around 40% of SMEs spend less than 0.5%
of company turnover on risk management.

Phillip Keown, partner in Grant Thornton’s risk management services practice,
says: ‘The nearest we get to giving risk assessment to SMEs is in the workshops
we give for executive and non-executive directors. Here we make them discuss
what risks would blow their business objectives off-course. These discussions
certainly open eyes. Our presence helps them prioritise but the real problem is
getting smaller companies to do something afterwards and embed risk management
into their everyday business practices.’

Insurers grow uneasy

Between 2003 and 2005 claims on business interruption insurance have risen
from £90m to £267m.Small wonder then that insurance companies have become very
involved with risk management within SMEs.

Accountant-trained Gerald Williams, now a director of Fitzgerald Consulting
and one-time president of the Chartered Institute of Loss Adjusting, says the
phenomenon of rising payouts is particularly odd at a time of increased
investment in technology and telecoms, together with a rapid expansion of the
regulatory environment.

Williams believes there are two main reasons why business interruptions are
creating substantial losses. First, the lack of appreciation by management of
the need for detailed risk analysis and catastrophe planning by experienced

Too often it is clear, he says that planning for the unexpected or ‘dry runs’
has been disregarded, either as unnecessary or uneconomical, and predatorial
competitors ignored in favour of a misplaced belief in customer loyalty.

The second reason, he says, is a lack of investment in staff welfare and
training, leading to poor ‘housekeeping’ and human error, with devastating

Related reading