Risk management for SMEs: risks and opportunities

Risk management for SMEs means describing possible developments so that management can decide and act. A coloured matrix is only an aid. Without an understandable description, a responsible person and a verifiable action, even a carefully calculated score is of little use. This guide shows a simple organisational start. The scales and procedures suggested are business practice, not legal or normative requirements.

What the law and the standard require

Code of Obligations. The risk assessment is expressly mentioned in the management report. Companies that are legally required to have an ordinary audit must prepare a management report under Art. 961 CO, point 3. Under Art. 961c CO, para. 2, point 2, it must provide information on, among other things, the performance of a risk assessment. What is required is therefore a statement that, and how, a risk assessment was carried out; the law prescribes no particular method or matrix here. Art. 961d CO, para. 1 allows the management report to be dispensed with in certain circumstances, for example where the company prepares its accounts under a recognised accounting standard. Whether your company must be audited ordinarily by law is best clarified with your fiduciary or auditor; the thresholds are in Art. 727 CO.

ISO 9001. The 6th edition, ISO 9001:2026, has applied since 16 September 2026 and replaces the 2015 edition. Anyone building a quality management system on ISO 9001 determines, in substance, the risks and opportunities that must be addressed so that the management system achieves its intended results, plans actions for them and evaluates their effectiveness. According to a Swiss certification body, the 2026 edition distinguishes risks and opportunities more clearly and considers the actions for dealing with each separately. In the 2015 edition the topic was in clause 6.1; according to the Auditing Practices Group of ISO and IAF there was no particular requirement there on how to document the results. A matrix, scores or a register are therefore one option, not an expressly prescribed form. Check clause numbers and documentation requirements in the original 2026 edition; certified companies switch within the transition period set by their certification body.

For most SMEs this yields no fixed catalogue. What matters is that you know your important risks and opportunities, that someone is responsible for them and that you record decisions traceably.

Describing risks and opportunities concretely

Start with one important process: which service must succeed reliably, and what could impair it? Describe cause, possible event and possible consequence. “Supplier” is not a sufficiently described risk. “A single approved spare part is available from only one supplier; if its delivery fails, promised repairs cannot be carried out” provides a basis for decisions.

Record existing safeguards. Perhaps there is a minimum stock or an alternative technical solution. Without these details, different people assess the same situation differently: one thinks of the unprotected process, another of the process with all existing controls.

An opportunity describes a possible favourable development and the conditions for using it. The same starting point can contain both: a new technology opens up an additional service but requires new skills. Keep benefit and uncertainty traceable instead of showing an opportunity through a negative sign in a risk list.

Give each entry a limited scope. The failure of one particular spare part is something different from a general interruption of procurement. Entries that are too broad often lead to actions whose effect nobody can check. This also applies to financial risks: a possible liquidity shortfall can only be managed if inflows and outflows are planned ahead, as the guide to cash flow planning for SMEs shows.

Agreeing a common assessment

First determine the purpose of the assessment: do you want to show where discussion is needed, allocate resources or decide which risks need escalation? Then define a few understandable levels for likelihood and impact. Each level needs a business description, ideally with examples from your daily work.

Ordinal levels do not represent exact probabilities. A rating of “three” is not automatically a measured occurrence rate. If you multiply two level values, the result is a ranking aid within your model. No precise expected monetary loss can be derived from it.

The following table shows a four-level matrix as a practical example. Each cell shows the product of likelihood and impact; the thresholds are freely chosen: yellow from 5, red from 9.

Agree explicitly how particularly severe consequences are to be handled. A rare but serious development may need attention even if its product of level values remains comparatively small: in the example, “likelihood 1, impact 4” is only 4 and therefore in the green range. Document such decision rules alongside the matrix.

Assess opportunities with suitable questions: how realistic is it to use them, what benefit could be achieved and what has to happen for that? Avoid a seemingly uniform score where the underlying meanings differ. Describing the decision matters more than the comparability of each individual number.

Setting actions and responsibility

Choose deliberately between different responses. You can change a process, introduce additional protection, reduce dependencies or accept a remaining risk with reasons. Each decision must fit your own authority and the significance of the consequences. A minimum stock in the warehouse is an example of protection; the guide to stock management describes how to set one.

An action should show which cause or consequence it influences. “Check alternative supplier” needs a result: for example a documented technical approval or a reasoned rejection. Making contact alone does not change the ability to deliver. Set responsibility, objective and an agreed deadline.

For an opportunity, the action can be a limited trial. Define in advance which observation supports continuing and when you will stop. This turns a general idea into a verifiable decision without presenting an expected benefit as already achieved.

Controls can check whether a safeguard works in daily operation. Linking risk and internal control system prevents the risk list from being detached from daily business. A control does, however, need a clear object of inspection and evidence, not merely a recurring calendar entry.

Practical example: Muster Service AG

Muster Service AG is a fictitious company. For repairs it needs a particular spare part. The team describes a possible supply interruption and uses the four-level scale from the table above, with yellow from 5 and red from 9. This scale illustrates the procedure and is not a recommendation for every sector.

The team rates likelihood at level three and impact also at level three. Three times three gives nine, so the risk is in the red range. The meaning of level three is recorded in words: there were repeated delays, and affected repairs could not be carried out as promised.

As an action, a second source of supply is technically checked. The responsible person documents sample testing, delivery terms and availability. After successful approval the original part remains usable, but the business has an alternative that has actually been checked. A mere supplier address would not have demonstrated this result.

At the reassessment the team assigns the likelihood of an uncontrolled supply interruption to level two; the possible impact stays at level three. Two times three gives six, so the risk moves from red to yellow. This is a changed assessment within the same model, not a measured risk reduction by a given percentage. Arithmetically the score fell by three points, from nine to six.

The company also identifies an opportunity: with the alternative, further types of repair might become possible. It plans a separate technical trial for this. The team does not offset the hoped-for additional benefit against the existing supply risk. Both decisions remain visible with their own conditions.

Reassessment and remaining uncertainty

Review entries when there are significant changes and at points agreed in the business. Suitable occasions are new supply routes, changed work equipment or recurring faults. A rigid interval alone may miss relevant developments between two meetings.

The reassessment should show what has changed: new observations, an effective action or a changed starting situation. Do not overwrite the earlier reasoning without comment. A history helps to place decisions later and to avoid unjustified all-clears.

Record remaining uncertainty explicitly. If a trial took place only under favourable conditions, the effect under high utilisation is still open. Management can ask for additional observation or accept a limited residual risk with reasons. What matters is that this decision is visible.

For larger adjustments, structured change management supports implementation. Check there also for affected documents, training and interfaces. A new process can reduce one risk and at the same time create new dependencies elsewhere.

Data protection as a concrete risk topic

For personal data, Art. 8 DSG, para. 1 contains an express risk-based standard: controllers and processors ensure, through suitable technical and organisational measures, data security appropriate to the risk. This statement concerns data security; it does not create a general obligation for every SME to use exactly the matrix shown here.

As a practical application you might consider, for example, unauthorised access to complaint data. Describe the type of data, existing access restrictions, possible event and consequences. One action could be a review of existing permissions. Whether it is sufficient depends on the specific processing context.

Under Art. 6 DSG, para. 2, the processing of personal data must be proportionate; under para. 3 it may only be collected for a specific, recognisable purpose and processed only in a way compatible with that purpose. The risk register itself should therefore also contain no unnecessary personal details. Describe the organisational weakness instead of attributing unsecured personal characteristics to employees.

Checklist

• Cause, possible event and consequence are understandable.
• Scope and existing safeguards are stated.
• Each assessment level is explained in business terms.
• Scores are used as a ranking aid, not as a measured value.
• Thresholds for yellow and red are set and justified.
• Particularly severe consequences receive a deliberate decision.
• Actions have responsible persons and verifiable results.
• Reassessments state the occasion and the changed basis.
• Opportunities are pursued with their own conditions.
• Whether a management report with a statement on the risk assessment is needed has been clarified with the fiduciary or auditor.

Sources

• Code of Obligations (OR, SR 220), Art. 727, Art. 961 point 3, Art. 961c, para. 2, point 2 and Art. 961d, para. 1, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
• Federal Act on Data Protection (DSG, SR 235.1), Art. 6, paras. 2 and 3, Art. 8, para. 1, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
• ISO/IAF Auditing Practices Group, Guidance on Risk Based Thinking, document of 13 January 2016, accessed on 27.10.2026. The paper refers to ISO 9001:2015, reflects the view of the working group and is not endorsed by ISO as a standard.
• ISO: ISO 9001:2026 (Edition 6), published on 16 September 2026; accessed on 27.10.2026. The text of the standard is protected by copyright and is reproduced here only in substance.
• SNV: SN EN ISO 9001:2026, valid since 16 September 2026, replaces the 2015 edition (in German); accessed on 27.10.2026.
• SQS: ISO 9001:2026 revision of the standard – all information, accessed on 27.10.2026.

The scales, thresholds and procedures in the practical example are editorial practical aids. They do not reproduce ISO standard text and do not demonstrate conformity for certification.

This guide does not replace legal or tax advice. Information as at 27 October 2026.