Notes from the Field

Why documenting threats is not the same as deciding how much risk you are willing to take If you ask most SME leaders whether they "manage risk", the answer is usually yes. There will be a spreadsheet somewhere. A quarterly discussion. Detailed risk assessments with colour codes—green, amber, red. A list of "top risks" reviewed during management meetings. But here's the uncomfortable truth: Documenting risks is not the same as deciding how much risk you are prepared to take.

Why organisations must move beyond whistleblowing and compliance theatre In recent years, the term safeguarding has gained significant traction. Traditionally, it has been associated with the protection of children and young adults in educational settings— ensuring that vulnerable individuals are shielded from harm, abuse, neglect, and exploitation. But safeguarding is no longer confined to schools. Increasingly, it is becoming relevant—and necessary—within corporate workpla

Competence is not a system—and memory is not resilience Ask an SME owner how operational risks are managed, and a familiar answer appears with quiet confidence: “We’re fine. My people are experienced.” It sounds reassuring. It is also one of the most fragile assumptions a business can make. Experience is valuable. It is not a control. Treating it as one is how organisations drift into avoidable failure—slowly, invisibly, and usually without warning. Experience lives in people

And why clarity of authority matters more than completeness of process Most businesses have Standard Operating Procedures. They are written carefully, approved formally, and stored somewhere accessible. They remind staff what should happen, in what order, and who is responsible at each step. On paper, they signal preparedness. And then stress enters the system: An incident occurs. A customer escalates. A staff member is injured. A regulator appears without warning. A parent t