Enterprise risk management for scale-ups: a proportionate UK framework

The macro evidence is plain. The Insolvency Service reports that 23,938 company insolvencies were registered in England and Wales in 2025, similar to 2024 and 5% lower than in 2023, which saw the highest annual number since 1993. The series is far above the 14,057 recorded in 2021. A level of failure this high is not an unusual period; it is the working environment in which scale-ups raise capital, hire and sign customer contracts.

Businesses themselves report broad concern. The Office for National Statistics found that 65% of businesses reported having some form of concern for their business in April 2025, with falling demand the most reported main concern at 17%. The WEF Global Risks Report 2026 draws on an annual survey of over 1,300 global leaders, and half of its respondents expect the next two years to be turbulent or stormy. Few leaders expect calm.

For a Chief Risk Officer, the implication is that risk is not an occasional agenda item. It affects the cost of capital, supplier terms and customer confidence every quarter. Fast growth magnifies it, because cash needs, hiring commitments and fixed costs rise before revenue is secured. Informal judgement, which works in a small team, becomes inconsistent as decisions are spread across more people and sites.

The first action is to ask a plain question of the leadership team: which three events would most damage our plan in the next 18 months, and what would we do about each? If the answers differ between executives, or nobody owns the response, the business has found its starting point. The register should be built from those answers, not from a generic list.

It helps to separate three kinds of pressure. Market pressure, such as falling demand, shows up in revenue. Financial pressure, such as tighter credit, shows up in cash. Operational pressure, such as supplier failure or a systems outage, shows up in delivery. Scale-ups often track the first closely and the third hardly at all. A register that covers all three, with an owner for each, gives the leadership team a more balanced view of what could stop the plan.

What to do: this month, ask each executive to write the three events most likely to derail the plan, without conferring. Compare the lists. The differences reveal where the team does not share a picture of the business, and the overlaps give a first draft of the register. The exercise takes under an hour and often changes the next board agenda.

The Allianz Risk Barometer 2026 places cyber incidents first for the fifth year running, at 42% of responses globally. Artificial intelligence jumps from tenth to second, at 32%, and business interruption is third at 29%. The same survey finds just 3% of respondents view their supply chains as very resilient. These are the topics boards discuss, and they are also the ones most likely to interrupt a growth plan.

The difficulty is quantification. Aon's 2025 Global Risk Management Survey, drawing on 2,941 decision makers, found that only 13% say they have quantified their cyber exposure, only 14% track their exposure to the top 10 risks and only 19% use analytics to evaluate the value of their insurance programmes. Geopolitical volatility entered Aon's top 10 at number 9, rising 12 places since 2023. Companies know the headline risks but lack numbers to prioritise them.

For a scale-up, the implication is that a heat map built on opinion will not be enough once a lender or insurer asks for evidence. Even a rough estimate of the cost of a week without a core system, or the loss from the failure of the largest supplier, changes the conversation. Numbers allow risk to be compared with the price of mitigation, which is what a chief financial officer needs.

The action is to quantify the top five risks to the nearest order of magnitude within one quarter. Use ranges rather than false precision, record the assumptions and review them when circumstances change. Then compare each with the cost of controls and insurance. This turns a discussion of fear into a discussion of money, and it quickly shows which risks deserve attention.

Remember that the ONS series reflects reported concern, not realised loss, and that insolvency statistics capture failures across all company sizes. They are context, not a forecast for your sector. Use them to calibrate seriousness, then rely on your own data, such as customer payment days, order cover and covenant headroom, for the specific indicators that tell you whether your business is drifting towards stress before it becomes visible.

What to do: pick the cyber and continuity risks and build a one-page quantification for each: scenario, probable duration, cost range, current controls and what a further control would cost. Share it with your broker or insurer, who may offer data or benchmarks. A short document with numbers earns more attention from a board than a long presentation without them.

The Cyber Security Breaches Survey 2025 provides UK-specific evidence of how exposure rises with size. Just over four in ten businesses (43%) reported a cyber breach or attack, but the figure was 67% for medium and 74% for large businesses. Growing firms therefore face the higher rates before they have built larger-company governance. The risk is concentrated at exactly the stage when a scale-up has the most to lose.

Governance indicators are weak. Board-level responsibility for cyber security fell to 27% of businesses in 2025, from 38% in 2021. Only 29% conduct risk assessments, in line with 31% in 2024, and just 14% review the risks posed by their immediate suppliers. Formal policies are more common, at 59% against 51% in 2024, and incident response plans are held by 53% of medium and 75% of large businesses. Paper policy has outpaced practice.

The implication is that a scale-up with a board-level owner, an annual risk assessment and a supplier review is already ahead of most UK peers. That is encouraging, because these steps are inexpensive. It is also a warning: counterparties increasingly ask for evidence, and the absence of a documented assessment can delay contracts, financing and insurance renewals. Good practice is both protective and commercially useful.

The action is to assign each of the top risks to a named executive with a deputy, and to make supplier risk review part of onboarding for critical suppliers. Define critical in a sentence, for example any supplier whose failure would stop delivery for more than a week. Start with ten suppliers, review them annually and extend the list only when the process is working.

A useful discipline is to pair each quantified risk with a mitigation cost and a residual estimate. If a supplier failure could cost a given amount and dual sourcing costs a fraction of it, the decision is straightforward. If mitigation costs more than the exposure, the sensible response may be to accept the risk and insure part of it. Writing both numbers down makes the trade-off visible to the board and to the finance director.

What to do: write down who in the business reviews supplier risk, how often and with what criteria. If the answer is nobody, nominate an owner for the ten most critical suppliers. Review their financial health, concentration and continuity plans once a year, and add a trigger for any change in credit rating, ownership or delivery performance that would prompt an immediate conversation.

The Financial Reporting Council's 2024 UK Corporate Governance Code applies to financial years starting on or after 1 January 2025, except for Provision 29, which commences one year later, on or after 1 January 2026. Provision 29 requires the board to monitor the risk management and internal control framework, to review its effectiveness at least annually, and to include a declaration of effectiveness of the material controls as at the balance sheet date.

The Code applies directly to companies with a premium listing, but its direction matters beyond them. Investors, lenders and acquirers in the private market increasingly use listed-company standards as a reference point. A scale-up planning a funding round, a sale or a listing will be asked what its material controls are, who tests them and what the board does with the results. Answering well is easier if the framework already exists.

The Code also stresses proportionality. The FRC expects reporting on material controls to be concise, which is a useful principle for smaller companies. A concise statement requires a clear definition of material, a short list of controls that matter and evidence of testing. Longer lists do not signal strength; they usually indicate that the company has not decided what matters.

The action is to define your own material controls as if a declaration were due. Start with those protecting cash, revenue recognition, customer data, regulatory compliance and delivery. For each, name the owner, the test and the last result. Present the list to the audit or risk committee, and agree which controls require independent testing. This is a modest exercise that creates lasting value in diligence.

There is also a lesson in the supply chain figure. When only 3% of Allianz respondents regard their supply chains as very resilient, resilience is the norm to beat rather than a given. Customers will increasingly ask suppliers about continuity. A scale-up that can show a tested plan, an alternative source for each critical input and a recovery time objective gains a commercial advantage in tenders that ask the question.

What to do: draft a half-page control statement for your business as if a Provision 29 style declaration were required. List the material controls, the owner and last test for each, and the issues found. Do not publish it. Use it with your finance director to see how much of the framework is evidenced and how much relies on assumption.

PwC's Global Risk Survey 2023, based on 3,910 responses from business and risk leaders, is dated but remains one of the few studies to link risk practices to results. It found 91% of organisations confident they can balance growth ambitions with managing risk effectively. Yet just 7% had invested across the board in more strategic and proactive enterprise-wide resilience. Confidence therefore runs well ahead of capability.

PwC identified a top-performing 5% of organisations, which it called Risk Pioneers. They were 2.7x more likely to use advanced and predictive risk management capabilities. Alignment on appetite also differed: only 22% of overall respondents said their own risk appetite matched that of their CEO and board, against 32% of Risk Pioneers. The survey is an older edition, so treat the figures as indicative, but the direction is credible.

The implication for a growing company is that gaps rarely come from missing frameworks. They come from misalignment: executives who assume the board shares their appetite, or boards that assume management has priced a risk that no one has examined. Appetite statements and trigger points are inexpensive ways to close the distance. They give management permission to act, and they give the board a basis for challenge.

The action is to hold a short appetite workshop with the executive team and one or two directors. Agree, in plain language, how much volatility in cash, margin or service the business will tolerate in the next year, and which risks it will not accept. Record the statements on one page. Revisit them at each board meeting where a major decision is taken, so they influence behaviour and are not filed away.

One practical way to use the survey is to compare it with your own cost structure. If most of your costs are people and software, your exposure to a cyber incident or a platform outage is higher than your exposure to commodity prices. If you depend on a single logistics partner, your continuity exposure is higher than your cyber exposure. Surveys rank risks for the average firm; your register should rank them for yours.

What to do: run an appetite exercise at the next board meeting using three real decisions from the last year. Ask whether the board would make the same decision again, and what risk it was accepting. The differences between executives and directors show where appetite statements are needed, and the decisions give the statements a concrete reference.

A framework for a scaling business can be built from five parts: objectives, a register, appetite, controls and reporting. Objectives come first because risks are defined by what could stop the plan. The register lists ten to fifteen risks, each with a cause, an impact range, an owner and a response. Appetite statements set tolerances. Controls are linked to risks, and reporting gives the board a short quarterly view.

Common standards such as ISO 31000 and the COSO enterprise risk management framework offer more detail, but a scale-up does not need every element. Adopt the vocabulary, such as inherent and residual risk, and use it consistently. Avoid scoring systems that imply false accuracy. Many teams find that a three-point scale for likelihood and impact, with ranges tied to money, is clearer than a five-by-five grid.

Ownership is the decisive feature. A risk owner is an executive who can change the outcome, not a risk team member who records it. Owners should be able to describe their risk in two sentences, say what the current control does and indicate the next action. If an owner cannot do so, the risk is probably too broad, or not yet understood, and should be broken down.

The action is to build the first register in a half-day session, circulate it, and test it with the board after one month. Remove any item that nobody can link to a strategic objective. Add new risks only when a decision requires them. Treat the register as a working document with a date of last review on the front page.

Smaller companies sometimes assume the Code is irrelevant and ignore its guidance on risk and internal control. That is a missed opportunity, because the Code and associated FRC guidance describe good practice in plain language. Reading the sections on risk management and internal control, and noting where your company already complies, produces a useful gap list at no cost and prepares the ground for investors who ask the question.

What to do: after the first register is built, test it by looking back. Take the three biggest surprises of the past two years and ask whether the register would have listed them. If not, identify why: a blind spot in a function, a dependence on one person or an outside event. Adjust the process to widen its field of view.

The test of ERM is whether it changes decisions. Three decision types benefit first. Investment decisions, such as a new site or hire, can use downside ranges to set stage gates. Commercial decisions, such as accepting a large customer, can use concentration limits. Operational decisions, such as dual sourcing a component, can use disruption cost estimates. In each case the register supplies the criteria.

Rhythm matters more than volume. A quarterly cycle works for most scale-ups: update the register, review key indicators, discuss the top five risks at the board and record decisions. Between cycles, triggers fire escalation, for example a customer representing more than a set share of revenue, or a critical supplier's financial deterioration. Triggers convert risk from a topic into an action.

Link risk reporting to the plan. Show each risk beside the objective it affects, the owner, the current status and the decision requested. Boards respond better to this format than to heat maps, because it connects directly to their agenda. Where a risk requires investment, bring a costed option, so the board can decide rather than just note.

Finally, measure the function. Useful indicators include the proportion of major decisions that cite the register, time to escalate a trigger, the number of incidents that were on the register beforehand and the cost of near misses. If incidents regularly arise from risks nobody listed, the process is not scanning widely enough, and the register should be refreshed with outside perspectives.

The PwC findings also suggest a role for the Chief Risk Officer that is wider than monitoring. Risk Pioneers are more likely to use risk insight to create opportunities, not only to avoid losses. For a scaling business that might mean entering a market earlier because the risks have been analysed, or offering a more resilient service as a selling point. Position the function as an adviser on bold moves, not only a guardian against loss.

What to do: set three indicators for the function and report them quarterly: the proportion of board decisions that referenced the register, the time between a trigger firing and an executive response, and the number of loss events that were not on the register. These show whether risk management is influencing behaviour, which is the only outcome that matters.

Karter McKinley helps leadership teams design and embed proportionate risk frameworks as part of broader strategy and transformation work: building the register with executives, framing appetite for the board and connecting risk reporting to the business plan. We work alongside your internal audit, legal and insurance advisers, who retain responsibility for assurance opinions and regulated advice.