The smaller the entity, the more vulnerable it’s likely to be, Moody’s report says