Growth changes a business faster than its controls change. A process that worked comfortably at twenty people starts to strain at eighty. A supplier relationship that was one of several becomes the only one that matters. Nothing announces the shift, and so it usually goes unnoticed until something breaks.
The operational risks that damage growing businesses are rarely exotic. They are ordinary dependencies that were entirely reasonable at one size and quietly stopped being reasonable at the next. Below are five that come up repeatedly, and what can be done about each without disproportionate effort.
1. Concentration you did not choose
Concentration risk is straightforward in principle: too much of something depends on one thing. In practice it accumulates by accident rather than decision.
A supplier who was one of three becomes the only one still quoting competitively. A customer who was 10% of revenue grows into a third of it. A single production line absorbs more volume each year because it is the most efficient. Each individual step is sensible. The cumulative position is one nobody consciously approved.
Concentration appears in more places than most businesses check:
- Customers — revenue share, and how quickly a loss would show up in cash flow
- Suppliers — particularly sole-source components with long qualification lead times
- Sites — one facility carrying a disproportionate share of output or inventory
- Systems — a platform that several critical processes now route through
- Banking and credit — facilities concentrated with a single institution
What to do. List your top five in each category and ask one question of each: if this disappeared for a month, what would happen? You are not trying to eliminate concentration — that is often uneconomic — but to know where it sits, so it becomes an accepted position rather than an unexamined one.
2. Key-person dependency
In most growing businesses there is at least one person who is genuinely irreplaceable. They hold the supplier relationships, know the undocumented workaround, or are the only one who understands why a process runs the way it does.
This is not a criticism of that person. It is usually a consequence of the business having grown around their capability. But it means a resignation, illness or extended absence produces a disruption out of all proportion to a single headcount.
The signal to watch for is not seniority. It is singularity: tasks only one person can perform, decisions only one person can make, relationships only one person holds.
What to do. Identify roles where a two-week absence would cause material disruption. For each, pick the cheapest meaningful mitigation — usually documenting the critical process, introducing a second named contact to key relationships, or cross-training one colleague on the highest-risk task. Full redundancy is rarely justified. Removing single points of failure usually is.
3. Process that lives in people's heads
Early-stage businesses run on shared context. Everyone knows how things work because everyone was there when the way of working was invented. That is efficient, and it scales badly.
The failure is gradual. New joiners learn by observation, so variations creep in. Nobody can say definitively what the correct process is, because there is no authoritative version. Quality becomes inconsistent in ways that are hard to trace, and errors get attributed to individuals when the real cause is ambiguity.
What to do. Resist the urge to document everything — that produces a manual nobody reads. Start with processes that are high-consequence if done wrong, performed by several people, or performed rarely enough that nobody is fluent. A one-page checklist that is used beats a thirty-page procedure that is filed. This is the same proportionality principle that governs sensible risk frameworks more generally.
4. Third parties nobody is accountable for
Most businesses depend on more external parties than they realise: logistics providers, contract manufacturers, IT and cloud services, payroll processors, outsourced compliance support, agencies. Each was engaged by someone, at some point, for a good reason.
The gap is that after onboarding, ownership often evaporates. Nobody is formally responsible for monitoring performance, reviewing the contract, or asking what happens if that provider fails. The dependency is real and continuing; the oversight is not.
Two specific blind spots are worth naming:
- Fourth-party risk. Your provider's own critical dependencies are effectively yours. A logistics partner reliant on a single subcontractor passes that exposure through to you.
- Data and access. Third parties frequently hold data or system access that would be treated far more carefully in-house. Where personal data is involved, your obligations do not transfer with the processing. {{ADD SOURCE: applicable Indian data protection obligations for third-party processors}}
What to do. Build a single list of external parties, what each does, who owns the relationship, and what would happen if they stopped. Most businesses find the list is longer than expected and that several entries have no owner at all. Assigning owners is usually the highest-value hour in the exercise.
5. Controls the business has outgrown
Financial and operational controls are typically designed for the size the business was when they were introduced — often when the founder could see most transactions personally.
As volume grows, informal oversight stops working, but the formal controls are rarely revisited. Approval thresholds set years ago now wave through significant spend. Segregation of duties that was impossible at ten people is now achievable but has not been implemented. Reconciliations that were manageable weekly now lag.
The awkward feature of control gaps is that they produce no symptoms until they do.
What to do. Review approval thresholds against current transaction sizes, check whether the person who initiates a payment is still the person who approves it, and confirm reconciliations are actually happening on schedule rather than in principle. For businesses in regulated sectors, recognised standards such as ISO 31000 set out principles for structuring this kind of review, and sector regulators may impose specific requirements. {{ADD SOURCE: ISO 31000 official reference page}} {{ADD SOURCE: relevant Indian sector regulator guidance on internal controls}}
The common thread
None of these five is a failure of competence. Each is a consequence of a business growing faster than the assumptions it was built on.
They also share a diagnostic: all five are invisible from inside day-to-day operations, because that is precisely where the assumptions feel normal. A periodic step back tends to surface them more reliably than continuous monitoring does.
If you want a structured way to work through this, our approach to risk assessment sets out how we map exposure and prioritise what matters, and our operational risk advisory services cover process reviews, supplier dependency assessment and single points of failure.
For a faster starting point, our free two-minute risk health check covers several of these areas and gives an indicative view of where to look first.
Or start smaller still: pick the item above that made you least comfortable and spend an hour establishing the facts. If the answer is reassuring, you have lost an hour. If it is not, you have found something worth knowing while you still have time to act.
{{ADD SOURCE: any Indian-context operational risk research or industry data worth citing}}