Most London SMEs add technology faster than they add the controls needed to run it safely. A business that grows from ten staff to forty typically acquires new laptops, cloud subscriptions, shared drives and remote access without a matching review of who owns each risk. For a director, the consequences appear as lost working days, unplanned spend and client questions that cannot be answered quickly. This article sets out a practical framework for IT risk management London SME owners can apply as headcount grows.
Table of Contents
- Quick Takeaways
- Why IT Risk Changes as Headcount Grows
- Building a Practical IT Risk Register
- Scoring Likelihood and Impact
- Controls for the Highest-Ranked Risks
- Restoring Service After an Incident
- Who Should Own IT Risk
- Governance, Reporting and Ownership
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Assign an owner to every risk | Each entry on the register needs a named person, whether an internal manager or an external provider, who is accountable for the control. |
| Inventory devices and accounts first | Unmanaged laptops, shared mailboxes and dormant user accounts are common blind spots as headcount rises. |
| Score risks on a simple 1 to 5 scale | Multiplying likelihood by business impact ranks work without specialist software. |
| Enforce multi-factor authentication | A second verification step on email and cloud accounts closes a common route into SME systems. |
| Test restores, not only backups | A backup that has never been restored is an assumption rather than a control. |
| Review the register each quarter | New hires, new clients and new systems each change the risk profile and should trigger an update. |
Why IT Risk Changes as Headcount Grows
Risk management is often treated as a concern for large corporations, yet smaller businesses can be more exposed to disruption. SMEs typically hold fewer financial reserves and operate with smaller teams, so a single failed server, lost laptop or compromised mailbox can absorb a disproportionate share of time and cash.
IT risk does not grow in a straight line with headcount. Each new starter adds devices, logins, software licences and data access rights, and each departure can leave accounts active. The gap between the number of accounts and the number of people who actually use them is often the first sign that controls have fallen behind growth.
Growth also changes the type of risk. A ten-person firm may rely on an informal arrangement, such as one colleague who manages passwords. At forty staff, that arrangement becomes a single point of failure, and client contracts can begin to request evidence of security controls.
Building a Practical IT Risk Register
Start with an inventory of assets and accounts
A risk register is only as reliable as the asset inventory behind it. For a London SME, the inventory should list every device, every user account, every shared mailbox and every cloud subscription, including Microsoft 365, Azure, AWS and Google Cloud where these are in use. It should also record where client and financial data is stored.
Many organisations discover during this exercise that subscriptions were bought by individual teams and never reviewed. Unused licences continue to renew, and accounts linked to former staff remain active. Each discovery becomes a register entry with a named owner and a deadline.
Columns that make the register usable
A register does not need specialist software. A spreadsheet with seven columns is sufficient: asset or process, risk description, likelihood, business impact, current control, owner and review date. Short, specific descriptions make the document easier to review at board level.
Pro tip: Record the business process affected by each risk, such as invoicing or client onboarding, not only the technical component. Directors set priorities faster when they can see what stops if a system fails.
Scoring Likelihood and Impact
Scoring turns a list of concerns into a ranked set of priorities. A five-point scale for likelihood and a five-point scale for business impact is sufficient for most SMEs. Multiplying the two scores produces a figure between 1 and 25 that can be compared across the register.
Impact should be defined in business terms. A score of five might mean that a failure stops client invoicing for more than one working day, or that personal data is exposed and must be reported. Defining these thresholds in advance avoids debate about whether an issue is urgent.
Consider a Microsoft 365 administrator account without multi-factor authentication that still belongs to a former supplier. The likelihood score may be moderate, but the impact is high because the account can access mail and files. Such an entry should move to the top of the register regardless of how minor it appears in daily work.
Risks rated by business consequence rather than technical severity tend to receive funding and attention sooner.
Controls for the Highest-Ranked Risks
Once risks are ranked, controls should address the highest entries first. Guidance from Lockton, summarising an ABI report, proposes nine measures to improve SME cyber hygiene. These include keeping software updated, backing up data, educating staff, enforcing strong passwords with multi-factor authentication, and managing user access.
Controls should be written as observable tasks. “Multi-factor authentication enabled for all administrator accounts, checked monthly” is actionable, whereas “improve security” is not. Each control should name the person who performs it and the evidence that proves it.
Supplier access deserves particular attention. Many SMEs grant remote access to external contractors and never remove it. The supply chain measure in the ABI list therefore belongs on every register.
Pro tip: Review administrator accounts every month and remove any that are no longer required. Administrator access is frequently left unchanged after staff move roles or leave.
Restoring Service After an Incident
Prevention reduces the likelihood of an incident but cannot remove it. The impact is determined by how quickly the business can resume work. A written incident plan should name who makes decisions, who contacts clients and staff, and which systems are restored first.
Backups need to be proven. A quarterly restore of a sample file, mailbox and server image confirms that the backup is complete and that staff know how to request recovery. Measured recovery time should be recorded in the register so the board can judge whether expectations are realistic.
Plans also need rehearsal. A short tabletop exercise with the leadership team, based on a realistic scenario such as ransomware on the file server, exposes communication gaps before a real event does.
Who Should Own IT Risk
Ownership determines whether a register is maintained. Three models are common among London SMEs, and each carries different trade-offs in cost, accountability and coverage.
| Approach | Typical Strengths | Typical Limitations |
|---|---|---|
| Internal IT hire | Full-time knowledge of the business and direct access to staff | Single point of failure, limited out-of-hours cover and reliance on one person’s skills |
| Break-fix support contract | Low fixed commitment, with payment mainly when a problem occurs | Little proactive monitoring, so risks often surface only after disruption |
| Outsourced IT department with defined service levels | Structured monitoring, maintenance, documented controls and agreed response times | Requires clear scope and regular reporting so that the service matches the register |
A single internal hire rarely covers security, cloud administration, helpdesk and reporting for a growing firm. An outsourced IT department, such as the model offered by iTO.London, can provide that coverage with measurable service levels. The director still owns the risk decisions, and the register should state which tasks sit with the provider and which remain internal.
Governance, Reporting and Ownership
Governance turns the register into a routine. The UK government has consulted on a Cyber Governance Code of Practice, which reflects an expectation that cyber and technology risk is a matter for leadership rather than technical staff alone. Directors of SMEs can apply the same principle without a formal code.
A one-page report each quarter is usually sufficient. It should show the top five risks by score, control changes since the last review, incidents and near misses, and any decisions required from the board. Keeping the format consistent allows trends to be seen over time.
A 2023 study on information security suggests a pressing need to evolve IT risk-management frameworks. Directors should also record in writing who may accept residual risk. Where that answer is unclear, the register is incomplete.
Frequently Asked Questions
How often should an SME update its IT risk register?
A register should be reviewed at least quarterly and after any material change, such as a new client contract, a senior hire, a new cloud system or a security incident.
What is the difference between IT risk and cyber risk?
IT risk covers all technology that supports operations, including hardware, software, data and suppliers. Cyber risk refers to threats from malicious activity against those systems, so it is one category within the wider IT risk register.
Does a small business need a formal framework?
A formal standard is not required. A documented register with owners, scores and review dates provides evidence of control and supports decisions when conditions change.
Which risk should a London SME address first?
Accounts with administrator privileges and no multi-factor authentication usually rank highest, because they combine a common attack route with broad access to data and systems.
Can an outsourced IT provider take over IT risk management?
A provider can operate many controls, including monitoring, patching, backups and helpdesk support, and report against agreed service levels. Accountability for risk acceptance and business decisions remains with the leadership team.
If you have managed IT risk through a period of rapid growth, we would value your perspective on which controls proved most useful in practice.