The multiple is a risk score
Two businesses with identical earnings sell at different multiples, and the gap is almost entirely explained by how much risk the buyer believes they are inheriting. Everything in this guide is therefore commercial rather than administrative — it is the work that separates a three times business from a four times one.
Nobody buys a risk register. They buy the absence of the things a risk register would have caught.
Most owners already manage risk continuously — they just do it in their heads and call it running the business. The value comes from writing it down, because knowledge held by one person is exactly the risk a buyer is worried about.
A register that fits on one page
Enterprise risk frameworks fail in small businesses because they demand more maintenance than anyone will give them. A one-page register reviewed quarterly beats a forty-page policy reviewed never.
| Column | What goes in it |
|---|---|
| Risk | One sentence, specific. Not 'competition' but 'our largest customer's contract ends in March' |
| Likelihood | High, medium, low. Precision here is false |
| Impact | In dollars or days if you can, otherwise high/medium/low |
| Current control | What already reduces it. Often nothing, and that is the finding |
| Action | One thing, with an owner and a date |
A register listing thirty risks with no priority produces no action. Multiply likelihood by impact, sort, and work the top five. The rest are recorded so you know they exist. This is the difference between a register that changes behaviour and one that documents inertia.
The six categories that matter
1. Concentration
Customer, supplier, employee and channel. A single customer above roughly a third of revenue is the most commonly discounted risk in small business M&A. Supplier concentration gets less attention and can be worse — a sole source with no contract, on terms the owner negotiated personally.
2. Key person
Usually the owner, sometimes a technician or a salesperson. The test is not whether the business runs without them today. It is whether it demonstrably has — for a fortnight, last year, without anything breaking.
3. Operational
Single points of failure in equipment, premises, systems and process. Ask what stops if any one thing fails on a Monday morning, and how long it stays stopped.
4. Financial
Cash conversion, covenant headroom, receivable ageing, and whether growth is funded. A profitable business that cannot fund its own growth is carrying a risk it may not have named.
5. Legal and compliance
Contracts that are unassignable or expired, licences, employment classification, data handling, and unresolved disputes. These rarely reduce earnings and frequently stop transactions.
6. External
Market shift, regulation, technology, and the small number of macro exposures that genuinely reach a business of your size. Most external risk is not actionable, which is itself worth recording.
| Category | The question to ask | Common finding |
|---|---|---|
| Concentration | What share does the largest account hold? | Nobody has measured it recently |
| Key person | What happens if this person leaves on Friday? | No documented handover exists |
| Operational | What single failure stops us? | One machine, one system, one supplier |
| Financial | How many days of cash do we hold? | Fewer than assumed |
| Legal | Which contracts survive a change of control? | Nobody has read the assignment clauses |
| External | What would we do if the top risk happened? | No plan, because it seems unlikely |
Four responses, and choosing between them
Every identified risk gets one of four responses. Naming which one you have chosen is more useful than the choice itself, because it makes an implicit acceptance explicit.
The fourth is accept — decide the cost of mitigation exceeds the exposure and carry it knowingly. That is a legitimate answer, and writing it down is what distinguishes a decision from an oversight.
A policy pays after the event; it does not stop it. Business interruption cover does not retain the customer you lost while you were closed, and key person cover does not replace the person. Insurance belongs in the plan, but a business relying on it as its only response to an operational risk has not managed the risk.
The cover to check, and the gaps that recur
| Cover | What it does | Common gap |
|---|---|---|
| General liability | Third-party injury and property damage | Limits unchanged as the business grew |
| Property | Buildings, equipment, inventory | Insured at cost, not replacement value |
| Business interruption | Lost income while you cannot trade | Indemnity period too short to matter |
| Professional liability | Errors in advice or service | Absent entirely in service businesses |
| Cyber | Breach response, ransomware, liability | Assumed to be covered elsewhere; usually not |
| Key person life | Cash on the death of a critical person | Never reviewed after the loan it secured |
| Employment practices | Claims by employees | Frequently excluded from the general policy |
Whether your property cover is replacement cost or actual cash value — the latter deducts depreciation and can leave a large shortfall on equipment. And whether your business interruption indemnity period is long enough to rebuild revenue rather than merely reopen. Both are cheap to correct and expensive to discover.
Continuity planning, at a size that gets used
A continuity plan for a small business does not need to be a document. It needs to be four things somebody other than the owner could find and follow.
- A contact list — staff, key customers, suppliers, insurer, bank, attorney, accountant. Printed as well as digital, because the digital copy may be the thing that is unavailable.
- Credentials access — a password manager with emergency access granted to a second person. This single item resolves a large share of key-person risk.
- The critical processes, written down. Not everything: the three where a mistake costs the most.
- A restoration order — what gets brought back first, and who decides.
- Tested backups. An untested backup is a belief, not a control. Restore one this quarter.
Every item above appears on a buyer's diligence checklist. A business that produces them within a day signals competence across everything else, and diligence proceeds faster and with fewer price adjustments. The work is worth doing on its own terms; the transaction benefit is genuinely a bonus.