The biggest liability confronting small-business owners is also the one many fail to recognize until it is too late: not having a plan to deal with catastrophic setbacks, says entrepreneur and author Brad Forsythe. In his new book, Bulletproof Your Business, Forsythe explains how entrepreneurs tend to be so limited in resources that all they can do is rush from one immediate task to the next. By never getting ahead of serious issues, many unknowingly put what are essentially fragile outfits in positions where they can easily be blindsided, perhaps even plunged into debt and driven out of business. Forsythe shared some insights about the best ways business owners can prevent or mitigate catastrophe in a recent conversation with Smart Answers columnist Karen E. Klein. Edited excerpts of their conversation follow:

Q: Why do so few entrepreneurs take steps to minimize their risk before disaster strikes?
A: The risks that I identified typically take extreme subject-matter expertise to address. And the problem is that that expertise is very expensive. Entrepreneurs don't know how to deal with risk preventatively, so they ignore it. What happens is, by the time they have to deal with a risk that's become a reality, it costs even more to fix -- maybe so much that the company is wiped out. Or, the entrepreneur hesitates or stops growing her company because she is concerned about risk. But a company that hesitates is the first to get run over from behind in the very competitive world we live in. My book tries to make risk-management actionable for small companies by putting it into a process that a small business owner can use. (See BW Online, 8/10/03, Bulletproof Your Business.)

Q: What kinds of risks are we talking about?
A: There are four main categories of risk. My research showed that entrepreneurs are vulnerable to risks from clients (such as contract liability or theft of intellectual property); risks from suppliers (buying from another small business that could fail and leave yours unable to fill a large contract); risks from employees (employment lawsuits); and from financial stakeholders (personally guaranteeing a business loan by putting your house up as collateral). There are dozens of examples of risks in each category, of course, which is what overwhelms CEOs who are busy running their businesses, making sales, hiring employees, and doing customer relations.

Q: How does an overwhelmed business owner deal with so many potential pitfalls?
A: The American small-business owner is an absolute master when it comes to dealing with complex subject matter! They go out and find business models they admire and that they can copy in a fashion that is quick, easy and cheap. How you end "analysis paralysis"? Get a model and follow it. That's what my book is all about.

The first thing I advise is that entrepreneurs approach risk-management in a piecemeal faction, taking one potential threat at a time. Once you start preventing negative things from happening, you can stay focused on growing your company and making money, which should be your main focus. If you're just reacting to risks that you haven't minimized all the time, you're putting a patch on a problem, but not getting ahead of anything. And the problem is that the risk that hasn't hit yet might be the one that kills you. I also advise that the process of minimizing risk is not Ms. CEO's job. The CEO of a small company is already top ambassador, manager, and salesperson. You will fail at the task unless you delegate it.

Q: Would you delegate it to an outside expert, or someone in-house?
A: Definitely pick a person inside your company. If you go to your lawyer and say, "Fix my risk," she'll look at your contracts and processes -- if you have them -- and at your sales and marketing materials and say, "Here's the risk." But you won't be able to pay enough to send her on a fishing expedition inside your company to find real risk. And even if you could pay that much, none of your team managers will trust an outsider to expose their dirty laundry. So, what will happen is that the tip of the iceberg will be written down and fixed, when most of the risk is underground.

Q: What person inside your company would you designate as a risk-manager?
A: Pick a good collaborator who is trusted, can find things out, and will be welcomed by the staff. It sound counterintuitive, but I advise that you pick somebody who is already very busy.

Someone who is busy is already good at being productive. It might be your partner, your controller or your vice-president of operations. This is a powerful job, but it's a part-time job. No small company needs to devote a full-time position to risk-management.

Q: What is this in-house, part-time risk-manager given to do?
A: If they follow the detailed processes laid out in my book, that person just follows the strategy outlined for each area of risk, taking it one piece at a time. For instance, the first area might be to go through all the contracts that are used by the company and examine them to see if they adequately minimize or prevent risk.

If the company doesn't have contracts, I included model contracts in the book. For instance, I have three different styles of employment contracts: One that's very aggressive and sophisticated, one that's middle-of-the-road, and one that's easy and simple. The risk-manager would choose the contract that best fits your company, modify it to include the things that are unique to your business, then take it to a lawyer to make sure that it will be effective for...the region you operate in. Reviewing such a contract should take no more than an hour of your lawyer's time, which makes it a cheap investment -- especially if you can stop an employee from blowing up your company.