Managing Business Risks: A One-Page Register for Malaysian SMEs

Risk management in a small business is not a department. It is the habit of asking what would hurt us, how badly, and what we have done about it, then writing the answers down. Owners who skip the writing down rediscover the same risks every year, usually at the worst time. This article gives you a one-page register, works through the six risk families that matter most to Malaysian SMEs, and explains which insurance covers exist for the risks you cannot control.

A risk register that fits on one page

A register is a table with no more than ten rows. For each risk you record a plain description, a likelihood from 1 (unlikely) to 3 (likely), an impact from 1 (annoying) to 3 (threatens the business), the score (likelihood multiplied by impact), an owner, an action and a review date. Scores of 6 or 9 get an action this month; 3 or 4 get an action this quarter; 1 or 2 are watched.

Here is a register for a tuition centre in Subang Jaya with 280 students, eight teachers and one administrator. Every row comes up in real businesses.

Review the register every quarter in a 30-minute meeting. Add new rows and delete the ones that no longer apply.

The six risk families

Cash

Cash risk is the one that closes businesses. Its two drivers are slow collections and fixed costs that do not move when sales do. Keep a 13-week cash forecast and read it weekly, chase every invoice the day it falls overdue, and know which costs you could stop within 30 days. Cash earns one row in the register and a weekly glance.

Compliance

Compliance risk is the easiest to control and the most often neglected, because every deadline is known in advance. For a Sdn Bhd, SSM requires the annual return within 30 days of the anniversary of incorporation, and the financial statements within 30 days after they are circulated to members. On tax, LHDN’s e-Invoice Guideline Version 4.8, published on 30 August 2026, exempts businesses with annual turnover or revenue below RM3 million from e-Invoicing with effect from 1 September 2026; more than 1.1 million businesses qualify, while those at RM3 million and above must issue e-Invoices. The exemption does not apply where a corporate shareholder, holding company or related company has annual turnover of RM3 million or more, so check the guideline if your business sits inside a group. The tuition centre in the example is exempt. Service tax registration is required once taxable services exceed RM500,000 in 12 months for most groups, or RM1.5 million for food and beverage operators, and manufacturers register for sales tax at RM500,000 of taxable goods.

On people, the amended Employment Act 1955 covers all employees regardless of wages from 1 January 2023, with a 45-hour week and a written reply to flexible working requests within 60 days. The minimum wage is RM1,700 a month for every employer since 1 August 2025, with fines of up to RM10,000 per affected employee. Put every date in a shared calendar with a 30-day reminder, and name one person who owns it.

People

Beyond compliance, people risk is dependence: on one salesperson’s relationships, on one technician’s knowledge, on the owner’s signature. The controls are cross-training, written procedures for critical tasks and a second bank signatory. The tuition centre’s lead teacher row is a people risk dressed up as a revenue risk.

Operations

Operational risk is anything that stops you delivering: a single supplier for a critical input, one machine with no service contract, premises on a short lease, a delivery van with no backup. For each, ask how long you could cope and what a ready plan B would cost. A second supplier used for 10% of volume costs a little every month and saves the business once.

Cyber and data

If you hold customer names, phone numbers, identity card numbers or payment details, the Personal Data Protection Act 2010 applies, and the 2024 amendments raised the bar from 1 June 2025. Data controllers must now notify the Personal Data Protection Commissioner of a breach that causes or is likely to cause significant harm within 72 hours, notify affected individuals within seven days, and keep a breach register. Organisations processing larger volumes must appoint a data protection officer; the Commissioner’s guideline sets the trigger at more than 20,000 data subjects, or sensitive personal data of more than 10,000 data subjects, or regular monitoring of personal data. A tuition centre with 280 students sits below the officer threshold but is fully subject to the breach notification rules.

The practical controls are cheap: one login per person, two-factor authentication on email and banking, an encrypted laptop, a backup you have actually restored, and a written note of who calls whom if data goes missing.

Fraud

Fraud comes from outside and inside. Outside, the Ministry of Finance reported that the National Scam Response Centre handled 122,603 calls between its launch in October 2022 and August 2024, with victim losses of RM371 million. Businesses are targeted with fake supplier bank-account changes and urgent payment emails that appear to come from the boss. Inside, the risks are petty cash, unrecorded sales and collusion with suppliers.

Two controls stop most of it. Every new payee, and every change to a supplier’s bank account, is confirmed by a phone call to a number you already had on file. Every payment above a set amount, say RM5,000, needs two approvals. Neither control costs anything.

Insurance available in Malaysia

Insurance is for the rare and severe; controls are for the frequent and small. The General Insurance Association of Malaysia (PIAM) lists the main business covers, and its guidance on property policies notes that a basic fire policy protects buildings and contents against fire, lightning and domestic gas explosion, with flood, storm, riot and other perils available as extensions.

Review cover once a year and whenever the business changes shape: a new branch, higher stock levels, new vehicles, or a switch to selling to companies.

Common mistakes

• Writing a register once for a bank or grant application and never opening it again.
• Scoring every risk as high, so that nothing is prioritised.
• Insuring the premises but not the income that stops when the premises close.
• Treating compliance deadlines as the company secretary’s problem. The company, not the secretary, answers for a late filing.

Key takeaways

• Keep the register to ten rows or fewer, score each risk from 1 to 9, and act this month on anything scoring 6 or above.
• Put every SSM, LHDN, SST and employment deadline in a shared calendar with a 30-day reminder and one named owner.
• Confirm every new payee or changed supplier bank account by phone, and require two approvals on payments above a set amount such as RM5,000.
• Under the amended PDPA, a serious breach must reach the Commissioner within 72 hours and affected individuals within seven days, so write the breach plan before you need it.
• Insure the income that stops when the premises close, not only the premises, and review cover once a year.

How Gusto Style can help

Gold Growth Advisory is a fixed-price programme for owners who want to grow without the growth creating new blind spots. We build the one-page register with you, set up the compliance calendar, check the controls on payments and data, and review the register with you each quarter as the business changes. The aim is a business whose risks are known, owned and shrinking while revenue moves the other way.