A restaurant owner I spoke to recently described the moment her business stopped. A fire in the kitchen forced the restaurant to close overnight. The damage was serious, but the bigger shock came afterwards: she discovered the business was not insured for the loss of turnover while the doors remained shut.
It was a reminder of how quickly a small business can be knocked off course.
Around the same time I heard about a small nursery grower whose irrigation water had been contaminated with a poisonous substance. Much of the stock was destroyed, wiping out months of work. The details came to me from an insider in the horticultural industry.
These incidents unfolded against a backdrop of larger corporate shocks. This week a fire broke out at the Twin Saver toilet paper plant in Paarden Eiland in Cape Town. And in the corporate world the once-powerful Tongaat Hulett group has been forced into business rescue after fraudulent transactions came to light.
Different industries, different circumstances — but the same lesson: business risk rarely arrives with warning.
There are just so many risks for business, but I want to focus on the small and medium ones. What are the ways that a small or medium business can actually mitigate risk?
The first thing to understand is that you cannot fix what you have not identified. Many small business owners are so busy working in their businesses that they never take a step back to look at what could actually shut them down.
A simple way to start is to gather your team, if you have one, or just block out an hour with a notebook, and list everything that could go wrong. Think about the fires, the contamination, the fraud. Think about a key supplier going under, a vehicle breaking down, or a staff member leaving suddenly.
You can use a basic SWOT analysis to spot weaknesses and external threats, or just keep a running list. The goal is simply to know what your risks are so you can do something about them before they happen.
Once you know what the risks are, you need to build some basic defences, especially when it comes to money. The fraud case at Tongaat Hulett shows what can happen when controls are weak, and while your business might be smaller, the principle is the same. You should never have one person handling money from start to finish. If the same person approves an invoice and enters it into the system, that is a risk. If the same person opens the post, counts the cash, and does the banking, that is a risk. Simple things like requiring two people to sign off on payments or reconciling your bank statements yourself every month can catch problems early. Also keep control of who has keys, alarm codes, and passwords, and make sure you remove access immediately when someone leaves.
Insurance is your financial safety net, and the restaurant owner who was not covered for turnover loss is a classic example of a gap that can sink a business. You need to speak to a broker who can actually come and look at your premises and understand what you do. Do not just buy the cheapest policy online. For South African small businesses, you generally need property insurance to cover your building, equipment, and stock against fire or theft.
You should consider business interruption insurance, which is what that restaurant owner lacked, because it pays your ongoing expenses like rent and salaries while you are closed after a fire. If you sell products or serve food, you need public liability or product liability insurance in case something you sell harms a customer. And given the risks in South Africa, you should make sure you have SASRIA cover for damage from civil unrest.
Beyond insurance, you need a plan for how you would actually keep operating during a crisis. This is called a business continuity plan, and it does not have to be a thick document full of jargon. It just needs to answer a few basic questions. If your premises burn down, where will you work from? If your water is contaminated like that nursery, where will you get clean water or alternative stock? If there is load-shedding and you have no power, do you have a generator or an inverter? If your data is held for ransom, is it backed up in the cloud? You also need to know who will call the staff, who will call the customers, and who will call the insurer. Write it down on one page and test it once a year. Run a drill. Make sure the backup actually restores and that everyone knows what they are supposed to do.
You also need a financial cushion. This is hard when money is tight, but it is essential. Try to build up an emergency fund that would cover at least three months of your operating expenses. That means rent, salaries, and your regular bills. If you have that buffer, you can survive a few months of disrupted trade while you sort out insurance claims or find new premises. Without it, even a short closure can force you to close for good. Review your financial goals regularly, maybe weekly or monthly, so you spot problems before they become disasters.
Finally, you need to bring your staff into this. If you are the only person thinking about risk, you are going to miss things. Train your people on the basics. Teach them what fraud looks like, such as unusual transactions or pressure to bypass normal checks. Create a simple way for them to report concerns confidentially, whether that is speaking to you directly or sending an email. And remember that while you want to trust your team, trust is not a control. You can trust someone completely and still have checks in place. That is not being paranoid, it is being responsible.
Most businesses that put these pieces in place do not just survive the fires and the frauds, they come out stronger on the other side.
