5 Steps to Help Small & Medium-Sized Enterprises Manage Strategic Risk

Small & Medium-Sized Enterprises (SMEs) are the heartbeat of UK business, bridging the gap between the smallest start-up and the largest multi-national corporation. They operate in every sector and every discipline, and in today's volatile world they are more exposed to global events than ever before.

The UK Government defines SMEs as:

The latest business population estimates from the Department for Business and Trade confirm just how dominant SMEs remain in the UK private sector.

At the start of 2025:

• there were estimated to be 5.69 million UK private sector businesses,
• 1.42 million of these had employees and 4.27 million had no employees,
• therefore, 75% of businesses did not employ anyone aside from the owner(s),
• there were 5.64 million small businesses (with 0 to 49 employees), 99.2% of the total business population,
• there were 38,435 medium-sized businesses (with 50 to 249 employees), 0.7% of the total business population,
• a further 8,335 businesses were large businesses (with 250 or more employees), 0.1% of the total business population.

Department for Business and Trade Business Population Estimates for the UK and Regions 2025 – 2nd October 2025

UK SMEs are a hotbed of innovation and creativity, driving larger companies to stay ahead of the competitive curve. However, the pace of day-to-day business often leaves them task-driven and inward-focused - understandably so, given the pressure to keep operations running and revenue flowing.

Unfortunately, this means that many SMEs do not consider the strategic risks to their organisations - risks that are still over the horizon but could have a catastrophic effect on their supply chains, revenue and profits, or even pose an existential threat to the business. The COVID pandemic was a prime example, closing an estimated 6.5% of the sector, equivalent to 389,600 businesses.

The world has not settled down since. The war in Ukraine is now in its fifth year and continues to unsettle energy and commodity markets. Conflict in the Middle East keeps disrupting shipping through the Red Sea, adding cost and delay to supply chains far beyond the region. US tariffs on steel, aluminium, cars and a wide range of other goods are reshaping the economics of exporting to America, while escalating US-China tension over semiconductors and technology is forcing even small suppliers to think harder about where their components come from. None of these are distant, abstract risks - they are exactly the kind of spark that can reach an SME’s supply chain, customer base or balance sheet within weeks.

I have previously used the analogy with our clients, when discussing strategic risk management, of detecting and stamping out small sparks now, rather than having to deal with a major fire later; the difference in resources required to deal with them and the damage each will do is enormous.

So, how can SMEs spot and manage the spark of a strategic risk? Here are 5 simple steps that may help:

• Raise your vision – Be more outward looking when it comes to your business and what your business relies on. For example, if your business relies on the fossil fuel industry, consider whether you may be the target of action by environmentalist groups and potentially suffer reputational, financial or operational damage. Equally, if you import components from, or export goods to, a single overseas market, ask what a new tariff, export control or conflict in that region would do to your margins.
• Make use of the internet and social media – The usual caveats aside, there is a lot of free data on the internet that could help you identify an incident or trend that could ultimately affect your business. Follow as many international news feeds as you can, to get a more holistic view of world events, as well as more specific sector or industry commentators. Make use of tailor-made news alerts offered by some news feeds, to reduce the volume of articles you need to read. Social media feeds such as X or Telegram often pick up on events and trends before the major news outlets, so they are worth monitoring - but cross-check anything significant, as state-backed disinformation and AI-generated fakes are now a routine feature of these platforms. Again, use filters, unless you particularly like cat videos!
• Start a strategic risk register – Once you have identified strategic risks to your business, document them in a strategic risk register, detail how the risks could affect your business in terms of reputation, financial loss, legal action and operational disruption and then set out how you are going to manage the risks.
• Think outside the box when managing strategic risk – Whilst I’m not advocating reinventing the wheel, don’t limit yourself with accepted thinking around managing risk, it’s your business and no one knows it like you do. There may be new technologies or new partnerships that you can forge to share or manage risks together.
• Regularly review strategic risks – Set up a recurring meeting to regularly review the strategic risks you have identified and the measures you have in place to manage them. The strategic risk register can be used as both the agenda for the meeting and the action tracker for your risk management measures.

Through our Virtual Head of Security service, we have helped clients to implement simple and effective strategic risk management processes, they have seen enormous benefit from understanding potential risks and building them into their planning for the future of their businesses, whilst still being able to manage the day-to-day running of their operations.

We hope you found this article useful and of value to your organisation. If you need any further information on this subject or our Virtual Head of Security service, please reach out to me at AHNA Group - sc@ahnagroup.com.