The Complete Guide to Risk Management for Kenyan SMEs

Every SME already manages risk. The question is whether it is managed on purpose. Most owner-managers carry the register in their head: a large customer who pays late, a single supplier of a critical input, a cashier who also reconciles, a USD invoice with no hedge, a van with no spare, a password shared on WhatsApp. That mental list works until the week two of those risks arrive together.

This guide turns the mental list into a small, living system. It is written for Kenyan firms that will not hire a chief risk officer, but will lose sleep over payroll, tax, and stock. Insurance is one tool inside the system; the companion piece is Business Insurance in Kenya. Cash and credit mechanics link to working capital and accounts receivable.

Key Insight: Risk management is not about predicting the future. It is about pre-deciding your response to the losses you cannot afford. If a risk is neither reduced by process, transferred by contract or insurance, nor buffered by cash, you have silently chosen to accept it. Acceptance is valid only when it is conscious.

The SME Risk Map

Use seven domains. Most failures sit at the intersections (for example currency plus customer concentration).

Sector colour:

• Exporters and importers lean currency + logistics (hedging, import finance).
• Tender-led firms lean guarantee cash lock and payment delay (AGPO cash flow, guarantees).
• Retailers lean stock, theft, and pricing (inventory discipline once published; retail dashboard).

Build a One-Page Risk Register

Keep it ugly and used. Columns that matter:

$\text{Score} = \text{Likelihood} \times \text{Impact}$

Impact anchors for a typical SME (adjust to your size):

Score the residual risk after existing controls, not the nightmare version with zero process.

Example rows (illustrative distributor)

Anything scoring 12+ deserves a named owner and a dated action, not a hope.

Treatment Options (In Order)

flowchart TD
  A["Identify risk"] --> B["Can we avoid it<br/>and still run the business?"]
  B -->|Yes| C["Avoid:<br/>stop the activity"]
  B -->|No| D["Can process reduce<br/>likelihood or impact?"]
  D -->|Yes| E["Reduce:<br/>controls, backups, limits"]
  D -->|No| F["Can contract or insurance<br/>transfer it economically?"]
  F -->|Yes| G["Transfer"]
  F -->|No| H["Accept consciously<br/>+ cash buffer"]
  E --> I["Residual score<br/>still OK?"]
  G --> I
  I -->|No| J["Reduce exposure size<br/>or exit"]
  I -->|Yes| K["Monitor on rhythm"]
  H --> K

Avoid. Do not enter contracts you cannot fund (AGPO working-capital gap is a classic avoid-or-price decision).

Reduce. Dual control on payments, stock counts, service-level agreements, preventive maintenance, documented SOPs, eTIMS-clean records (eTIMS guide).

Transfer. Insurance (business insurance guide), contractual risk allocation, sometimes banking instruments.

Accept. Only with a buffer: cash in an MMF, undrawn headroom you actually understand, and a written trigger for escalation.

Domain Playbooks

1. Financial and liquidity risk

• Know cash cover days and the cash conversion cycle (working capital cycle).
• Match facility type to need (SME finance handbook); do not fund machines on perpetual overdraft.
• Keep tax and statutory payments inside the operating plan; surprise compliance hits are liquidity events.
• Read statements the way a lender would (financial statements, ratios).

2. Credit risk (customers)

• Credit application, limit, and stop-supply rules beat optimism.
• Age receivables weekly; escalate at 30/60/90.
• Concentration: any buyer above ~25-30% of sales needs a deliberate plan.
• Invoice finance and factoring are tools, not substitutes for collection culture (accounts receivable).

3. Currency risk

• Measure natural hedges first (USD revenue vs USD cost).
• Policy example: hedge or pre-buy cover when net exposure exceeds a set KES amount or % of monthly gross profit.
• Detail in USD/KES hedging; fee and spread leakage in fees and FX spreads.

4. Operational risk

• Single points of failure: one machine, one vehicle, one password, one person who "knows how the file works".
• Quality and delivery failures become financial through returns, penalties, and reputation.
• Document processes enough that a deputy can run them for two weeks.

5. People risk

• Segregation of duties on cash, stock, and payments.
• Leave and rotation for cashiers and storekeepers.
• Key-person map: who, if absent 30 days, stops revenue or compliance.
• Personal protection for owners remains part of enterprise survival (insurance stack).

6. Cyber and payments fraud

Kenyan SMEs lose more to business email compromise and changed-bank-detail fraud than to cinematic hacks.

Minimum controls:

• Verify supplier bank changes on a known phone number, not the email thread.
• Dual release on payments above a threshold.
• Unique logins; no shared "company" passwords on WhatsApp.
• Out-of-band confirmation for large or first-time beneficiaries.

7. Supply chain risk

• Identify sole-source inputs and dual-source where margin allows.
• Buffer stock is a financial decision, not only an operations one (inventory).
• Logistics partners need backup lanes for critical routes; agri and cold-chain lessons appear in agri export supply chain and Zindua logistics.

The Operating Rhythm

If the firm is two people, the "committee" is still a 30-minute calendar block. Unscheduled worry is not a control system.

Scenario Tests Worth Running

Write the answer in one page each:

1. Top customer pays 60 days late. What stops first: tax, salaries, suppliers, or loan instalments?
2. KES moves 5% against you over an import cycle. Does pricing absorb it?
3. Founder offline 30 days. Who signs, who collects, who knows the passwords?
4. Warehouse incident. What is insured, what is excess, what is the restart plan?
5. Key supplier fails. Alternate source, lead time, and margin hit?

If you cannot answer, the risk is unmanaged regardless of how confident the culture feels.

Risk Factors (Of Risk Management Itself)

• Paper theatres: beautiful registers never opened.
• Over-control: so many approvals that the business cannot trade.
• Insurance as superstition: buying certificates without reading warranties.
• Optimism bias after good years: scores drift down without evidence.
• This guide is education, not a certification, audit opinion, or legal compliance programme.

Decision Framework: 30-Day Stand-Up Plan

Week 1: List top 10 risks; score them; pick owners.

Week 2: Install payment dual-control and bank-detail verification.

Week 3: Fix the single highest credit or liquidity score (limit, deposit, facility match, or collection blitz).

Week 4: Align insurance to the register (business insurance); diary the quarterly review.

Then stop. Do not build a bureaucracy. Raise the quality of the top five risks before expanding the list.

Bengula View

The desk's position is that SME risk management fails when it tries to imitate banks and multinationals. You do not need 40 policies. You need honest scoring, a few non-negotiable controls, sized insurance, and a calendar.

We weigh liquidity, concentration, fraud, and key-person risks above exotic narratives. We treat currency as an operating risk for traders, not a macro hobby. And we treat insurance as transfer after process, not as a substitute for process.

If you want the finance facility map that sits under many of these risks, use the SME finance handbook. If you want help turning a mental list into a one-page register and banking structure, use services or book a session.

Sources and Further Reading

• Bengula Inc: Business Insurance in Kenya, Working Capital Cycle, Accounts Receivable, Hedging USD/KES, Fees and FX Spreads, SME Finance Handbook, Bank Guarantees, AGPO Tender Cash Flow, Insurance Stack.

General business education for Kenyan SMEs, not legal, insurance, or risk-consultancy advice for a specific firm. Adapt thresholds to your size and sector, and obtain professional advice for material exposures.