Risk management: what organisations can learn from large companies?

Size is not the whole story, however. The survey also identifies Leaders, defined as organisations reporting a very well-structured approach across all stages of the risk management process. Organisations of different sizes are represented within this group. This suggests that while organisational size is often associated with greater risk management maturity, it is not the sole determining factor.

The more structured practices seen in larger organisations can nevertheless provide valuable lessons for organisations of any size. The aim is not to replicate enterprise-scale structures, systems or dedicated functions, but to adopt the disciplines that make them effective: clear responsibilities, consistent follow-up, regular reassessment and the integration of risk into decision-making. These disciplines are equally relevant to smaller and less complex organisations.

Where larger organisations stand out

Larger organisations must coordinate a greater number of functions, locations and interdependencies. They are also more likely to face extensive regulatory requirements and manage larger, more complex supplier networks. Together, these factors increase the complexity of their operating environment.

A structured approach is therefore essential, but it does not remove the challenges organisations face. Large organisations report broadly similar challenges to those identified across the wider survey sample, reflecting the complexity of their operations, supply chains and stakeholder relationships.

The survey also shows that large organisations tend to address a broader range of risks and are somewhat more likely to use customised systems rather than relying solely on standard productivity tools. Greater structure is often necessary to maintain oversight and control, and their approach reflects a higher level of risk management maturity.

What others can learn

One important observation is the need to follow risks through the entire management cycle. The survey shows that organisations are generally stronger at identifying and assessing risks than at managing, reassessing, monitoring and reporting on them. This appears to apply regardless of organisational size. However, identifying a risk is only the beginning. Responsibilities need to be clearly defined, and actions must be identified, implemented and followed up. Their effectiveness must then be evaluated and monitored over time.

Formal ownership is another area worth considering. Large organisations are somewhat more likely to have a dedicated risk management function. It is also noteworthy that Leaders do not differ substantially in who formally owns risk management, highlighting that assigning risk management responsibilities to dedicated functions is only part of the picture. The findings suggest that maturity depends less on where responsibility formally sits and more on how risk management is structured, embedded and linked to a consistent process.

Smaller organisations do not need to replicate enterprise-scale risk management structures. However, lower complexity does not necessarily mean lower exposure to risk. A smaller company may be heavily dependent on a limited number of customers, suppliers, systems or key employees, while also having less capacity to absorb a significant disruption. Its approach should therefore be proportionate to its risks and complexity, while remaining sufficiently structured to ensure clear responsibilities, timely action and consistent follow-up. Management system standards can provide a common structure and language that can be adapted to the organisation’s size and context.

Larger and more complex organisations are also more likely to use digital risk management tools to support coordination, traceability, monitoring and visibility across multiple risks, owners and locations. However, the survey suggests that more mature organisations do not necessarily replace familiar tools with sophisticated platforms. Leaders are more likely to combine office tools with internally developed or customised systems, pointing to the value of using different tools where they are most effective. Technology alone does not create maturity. The value it delivers depends on clear processes, competent people and consistent follow-up.

Finding the right level of structure

While larger organisations may require extensive monitoring across sites, suppliers and business functions, smaller organisations can often achieve consistency with simpler processes and shorter lines of communication. Simplicity can be an advantage, provided that responsibilities are clear and risks are followed systematically.

What matters is that risks are followed consistently from identification through treatment, reassessment and monitoring, with clear ownership and visibility throughout the process. The opportunity for smaller organisations is not to copy the complexity of larger companies, but to learn from the consistency of their approach.

Applying the same core disciplines at a scale proportionate to the organisation’s risks, resources and operations can strengthen both resilience and control.