🧭 Dojo Compass
Module: Finance, Risk Management and Long-Term Resilience
Focus Area: Risk Management
Key Article Point
Many entrepreneurs assume that risk management is something only large corporations can afford. In reality, every business manages risk—either deliberately or accidentally. This article introduces a practical framework for building a Lean But Effective (LBE) risk management function that strengthens decision-making while avoiding unnecessary bureaucracy. The Business Warrior’s Dojo LBE framework is set forth here.
🎯 Key Challenge
Imagine two companies with twenty employees.
The first has no formal approach to risk.
Salespeople negotiate contracts independently.
Finance monitors cash flow only when payroll approaches.
Cybersecurity consists of hoping nothing bad happens.
No one owns supplier risk.
No one regularly asks what could go wrong.
The second company has no Chief Risk Officer, no committee, and no elaborate governance manual.
Instead, fifteen minutes every Monday morning are devoted to reviewing the firm’s most important risks.
The management team maintains a one-page risk register.
Each major risk has an owner.
Simple contingency plans exist.
External specialists can be contacted immediately if required.
Which company is likely to survive a major disruption?
The answer is obvious.
Ironically, both companies may have almost identical organizational structures.
The difference is not organizational complexity.
It is organizational capability.
This illustrates one of the central insights of the Lean But Effective Organizational Framework:
Every company requires risk management.
Not every company requires a Risk Management Department.
Like finance, legal, or human resources, risk management is an essential organizational function whose form should evolve with the size, complexity, and needs of the business. The challenge for SMEs is therefore not whether to build a risk management capability, but how to build one that is proportionate, practical, and sustainable. This reflects the LBE principle that organizational design should focus on delivering essential functions through the minimum effective form.
🥋 Dojo Solution
Rather than asking:
“Should we create a risk management department?”
SMEs should ask:
“What is the lightest organizational form capable of managing our most important risks effectively?”
This shift changes everything.
Instead of building bureaucracy, firms build capability.
The objective is not to eliminate every conceivable risk. That is impossible.
The objective is to identify the relatively small number of risks capable of materially damaging the business and develop repeatable practices that reduce either their probability or their impact.
This approach follows several LBE principles:
Function Before Form
Risk management is an essential function regardless of organizational size.
Minimum Effective Form
Early-stage companies may assign risk ownership to founders or senior managers.
Growing firms may create cross-functional risk responsibilities.
Only larger organizations may eventually require dedicated risk teams.
Embedded Rather Than Bureaucratic
Risk management should occur during normal business operations—not inside isolated compliance functions.
Salespeople manage commercial risk.
Finance manages liquidity risk.
Operations manage delivery risk.
Legal manages contractual risk.
Everyone contributes.
Technology Amplified
Modern AI tools can help identify emerging risks, stress-test assumptions, summarize regulatory developments, monitor industry news, and generate scenario analyses at a fraction of the historical cost.
🏗️ Putting It into Practice
Step 1. Identify Your Critical Risks
Avoid attempting to catalogue hundreds of risks.
Instead identify the ten to twenty risks capable of seriously affecting the company.
For many SMEs these fall into categories such as:
- Revenue risk
- Customer concentration
- Cash flow
- Product quality
- Operational disruption
- Cybersecurity
- Key employee dependency
- Litigation
- Regulatory compliance
- Reputation
The goal is clarity rather than completeness.
Step 2. Assign Ownership
Every major risk requires an owner.
Ownership does not necessarily mean solving every problem.
It means continuously asking:
“Has this risk changed?”
“Do we need to act?”
For example:
- CFO → liquidity
- Head of Sales → client concentration
- CTO → cybersecurity
- Founder → strategic risks
Ownership creates accountability.
Step 3. Monitor Continuously
Risk monitoring need not involve lengthy meetings.
Many SMEs could review their risk dashboard in fifteen minutes each week.
Questions include:
- Has probability increased?
- Has impact changed?
- Are new risks emerging?
- Have existing controls weakened?
Simple routines performed consistently outperform elaborate systems that nobody follows.
Step 4. Prepare Responses Before They Are Needed
Risk plans should answer one question:
“If this happens tomorrow morning, what do we do first?”
For example:
Major client leaves.
Immediate actions:
- Reduce discretionary spending.
- Contact replacement prospects.
- Reforecast cash flow.
- Communicate internally.
Cyberattack.
Immediate actions:
- Disconnect affected systems.
- Contact cybersecurity adviser.
- Notify customers where necessary.
- Activate recovery plan.
Preparation dramatically reduces panic.
Step 5. Extend Your Resource Field
One weakness of many SMEs is assuming that only internal employees manage risk.
A Lean But Effective organization builds an external capability network.
Examples include:
- external lawyers
- accountants
- cybersecurity consultants
- insurance brokers
- specialist recruiters
- crisis communications advisers
- industry experts
These resources need not become permanent employees.
They simply need to be available when required.
Step 6. Stress-Test Your Assumptions
Perhaps the most overlooked aspect of risk management is questioning whether today’s risk list still reflects tomorrow’s business.
Markets evolve.
Technology changes.
Competitors emerge.
Customer expectations shift.
Several inexpensive approaches can strengthen this process:
- Ask AI to identify risks commonly affecting similar businesses.
- Review industry news weekly.
- Monitor leading indicators rather than waiting for problems.
- Periodically invite an external adviser to challenge assumptions.
Fresh perspectives often reveal blind spots.
📌 Key Takeaways
- Every company requires a risk management function even if it has no risk management department.
- Risk management should follow the Lean But Effective principle of minimum necessary organizational complexity.
- Focus first on the relatively small number of risks capable of materially affecting the business.
- Assign clear ownership to every major risk.
- Embed risk awareness into everyday work rather than isolated compliance activities.
- Build contingency plans before they become necessary.
- Extend risk capability through trusted external advisers and AI-assisted analysis.
- Continually review and adapt the firm’s risk profile as the business evolves.
🌿 Reflection
Entrepreneurs often associate risk management with caution.
In reality, effective risk management enables courage.
Organizations that understand their risks clearly can pursue ambitious strategies with greater confidence because they know where their vulnerabilities lie and how they intend to respond if circumstances change.
The purpose of a Lean But Effective risk management function is therefore not to slow the organization down.
It is to make bold action more sustainable.
As with every element of the LBE Framework, the objective is not additional bureaucracy but greater organizational capability. A business that consistently manages its most important risks without unnecessary complexity is better positioned to grow, adapt, and compete over the long term.
⚔️ Dojo Mission
This week, create a one-page Risk Action Plan.
Identify your company’s ten most significant risks.
Assign an owner to each one.
Write a one-sentence response describing what your business would do if that risk materialized tomorrow.
Then ask one final question inspired by the Lean But Effective Framework:
“Is this the simplest risk management system capable of protecting our business?”
If the answer is yes, you are already building an organizational capability that many larger companies still struggle to achieve.
Leave a Reply