Managing risk in the smaller organisation