Risk management: what organisations can learn from large companies?

Size is not the whole story, however. The survey also identifies Leaders – organisations reporting a very well-structured approach across all stages of the risk-management process – and companies of different sizes are represented among them. This suggests that organisational size is associated with greater risk-management maturity, while not being the only determining factor.

However, the more structured practices seen in larger organisations can offer useful lessons for organisations of any size. The lesson is not to copy enterprise-scale structures, systems or dedicated functions, but to adopt the disciplines that make them effective: clear responsibilities, consistent follow-up, regular reassessment and integration of risk into decision-making. These disciplines can be equally important in smaller, less complex organisations.

Where larger organisations stand out

Larger organisations have to coordinate more functions, locations and interdependencies. They may have more regulatory demands and suppliers to manage. All this increases the complexity of their business environment.
 
A structured approach is therefore essential, but it does not eliminate the challenges companies face. Large organisations report broadly similar challenges to the overall sample, which may reflect the complexity of their operations and supply chains.

The survey also shows that large organisations tend to cover a broader range of risks and are somewhat more likely to use customised systems rather than relying on standard productivity tools alone. Greater structure is essential to maintaining control, and their actions reflect greater maturity.

What others can learn

One thing to note is the importance of following risks through the full management cycle. The survey shows that, overall, organisations are stronger at identifying and assessing risks than at managing, reassessing, monitoring and reporting them. This seems to apply regardless of organisational size. However, identifying a risk is only the start. Responsibilities need to be clear, and actions need to be identified, implemented and followed up. Their effectiveness must then be evaluated and monitored over time.

Formal ownership is another area. Large organisations are somewhat more likely to have a dedicated risk-management function. It is worth noting that Leaders do not differ substantially in who formally owns risk management, which underscores the importance of allocating risk-management responsibilities to dedicated functions. The lesson is that maturity depends less on where responsibility formally sits than on how it is structured, embedded and connected to a structured process.

Smaller organisations do not need to replicate enterprise-scale risk-management structures. However, lower complexity does not necessarily mean lower exposure. A smaller company may be highly dependent on a limited number of customers, suppliers, systems or key employees and may have less capacity to absorb a major disruption. Its approach should therefore be proportionate to its risks and complexity, but still sufficiently structured to ensure clear responsibilities, timely action and consistent follow-up. Management system standards can provide a common structure and language that can be adapted to the organisation’s size and context. 

Moreover, larger and more complex organisations rely more often on digital risk-management tools to support coordination, traceability, monitoring and visibility across multiple risks, owners and locations. However, the survey suggests that more mature organisations do not necessarily replace familiar tools with sophisticated platforms. Leaders are more likely to combine office tools with internally developed or customised systems, pointing to the value of using different tools where they are most effective. It is important to note that technology does not create maturity by itself. The value derived depends on clear processes, competent people and consistent follow-up.

Finding the right level of structure

While larger organisations may require extensive monitoring across sites, suppliers and business functions, smaller organisations can often achieve consistency with simpler processes and shorter lines of communication. Simplicity can be an advantage, provided that responsibilities are clear and risks are followed systematically.

What matters is that risks are followed consistently from identification through treatment, reassessment and monitoring, with clear ownership and visibility throughout the process. The opportunity for smaller organisations is not to copy the complexity of larger companies, but to learn from the consistency of their approach.

Applying the same core disciplines at a scale proportionate to the organisation’s risks, resources and operations can strengthen both resilience and control.