Business Risks


  • Learn about business risk
  • Learn how to identify specific business risks
  • Understand the role of business risk assessments
  • Understand how business risk impacts value

What is business risk?​

There are several different ways to define and assess risk in a business. For example, insurance companies assess the likelihood that a potential company will have a future claim for an accident or workers’ compensation claim in order to determine what premium to charge that company for providing insurance.

Banks will closely examine a company to determine the risk that it may not be able to repay a loan made by the bank to the company. And prospective new hires will attempt to quantify the risk that a company might go out of business or be acquired, reducing the attractiveness of a potential job offer.

All of these assessments of risk examine similar characteristics of a business with variations based on their specific purpose. For our purposes here, we are going to discuss business risk and how it impacts.

How does business risk impact company value?

There are three broad approaches for performing an objective  : the asset approach, the market approach, and the income approach. The market approach is based on data from similar transactions in the private market to determine approximate market value. The asset approach is simply the net asset value of a company based on an assessment of a company’s tangible and intangible assets less its liabilities – this is useful to establish a baseline value for a business.

The income approach (sometimes referred to as the discounted cash flow or capitalization of earnings approach), is probably the most widely used methodology, and attempts to estimate the future free cash flow a company will generate, and uses an appropriate discount rate to calculate the present value of these future cash flows.

Most sophisticated buyers of companies, in addition to reviewing a target’s market value and adjusted net book value, will also perform a valuation using net income or   as the economic benefit stream available to generate future returns.

A Discounted Cash Flow (or DCF) analysis, in simple terms, states that the value of a business should be equal to the value of the free cash flow it will generate over the coming years, discounted for the time value of money according to the level of perceived market, industry, and specific company risk.

What is risk analysis in business?

The second part of your analysis should include an analysis of the specific risk factors of the targeted business or investment, including market risk, industry risk, and specific company risk.

Consider the following: if the Haunted House had a contract with the local municipality to run the Haunted House for the city in exchange for a fixed fee paid by the city, regardless of how many people attended, this would be a less risky proposition than if you as the buyer took on all the risk of people attending. Just as junk bonds that are inherently more risky pay a higher rate of interest than highly rated “AAA” bonds, businesses or investments that are riskier than alternative investments will be comparatively less expensive to purchase. In other words, in our example, if the city guaranteed our fees from the Haunted House, we might be willing to pay more for the two $100,000 streams of cash flow than if we had to take on all the risk of people attending (the weather might be bad, a competitor might open up another haunted house across the street, etc.).

Conversely, you would expect to pay less if you were forced to assume the myriad risks related to operating a haunted house (liability for injuries, for example). To parse the analysis even further, you would need to assess what level of risk is involved in operating this particular haunted house as compared to the pool of all haunted houses (e.g., Does it include particularly complicated exhibits that break often? Does it have unique exhibits that appeal to a broad audience? Will it require new exhibits to remain attractive to potential attendees?).

The challenge for every buyer is to determine what additional discount (on top of the discount attributable to the time value of money) should be applied to the expected stream of cash flows. For the sake of our example, let’s assume that we would need to be paid 10% to take on the risk of the city contract, but we would need to be paid 20% in the event we had to absorb all the risk of attendance or non-attendance. In the former case, the total discount rate we would apply to the stream of cash flows is 15%, or 10% plus the risk-free cost of capital of 5%, and in the latter case our total discount rate we would apply is 25%, or 20% plus the risk-free cost of capital of 5%. As you can see, a buyer would be willing to pay $162,571 in our first example, and $144,000 in our second example for the same stream of cash flows based on the different assessment of the risk of those future estimated cash flows. Put simply, the higher the perceived risk the lower the ultimate valuation.

Why do owners look at business risk differently from buyers?

It is probably no surprise that most sellers value their business more highly than average buyers. As we can see, business valuation is ultimately an assessment of risk, so the most likely reason an owner will value his business more highly than the market is that he understands his business and its risks at a much deeper level than anyone else, and will often ascribe less risk to the operation of his business than a less informed buyer.

For example, a client private equity firm once looked at an acquisition of a construction contractor who had almost a year’s worth of backlog on the books, which represented a whopping 70% growth in revenues over the prior year. The owner of course wanted to value the business based on the expected earnings represented by his backlog, but because the PE firm could never get as comfortable as the owner was about the underlying contracts, costs, and margin assumptions, the PE firm’s valuation for the owner’s business was substantially below his.

This difference in perceived risk finds its way into almost all discussions about the future, and not being intimately familiar with the target company’s industry or market simply increases the level of perceived risk for any rational buyer, which will result in a lower valuation.

Objective observers, or what we commonly refer to as “market participants,” will tend to look at valuation from a number of different perspectives, but will conclude their valuation based primarily on expected future cash flows and the riskiness of those future cash flows. As a result, whether you are a buyer or a seller or you simply want to understand valuation better, you need to start with the most objective set of facts you can put together about a company’s business risk and work from there.

Types of business risk

Understanding business risk is important, but how do you go about doing it?

At our firm, we break business risk down into categories to make it easier to assess. We look at business risk in the following “buckets”: financial risk, organizational risk, customer risk, employee/team risk, strategic risk, market risk, and growth risk.

Business risk examples

Using this rubric as a guideline will help you rigorously examine a company’s level of risk in its future cash flows.

Financial risk

The financial risk category is not an assessment of the company’s financials, per se, but how confident are we that the company’s books and records are accurate and in accordance with generally accepted accounting principles (GAAP). Does the company have ready access to critical financial reports? Does the company track key performance indicators that allow it to operate its business more effectively? Does the company have strong   to prevent fraud? How strong is the company’s banking relationship? Understanding these factors can make buyers either more or less confident in the company’s overall financial risk.

Financial risk control measures

Here is a list of financial control measures that are easy to implement:

  • Run background checks before hiring
  • Perform a monthly review of bank statements and credit card statements
  • Perform monthly bank reconciliations and review them
  • Conduct regular reviews of inventory
  • Get fraud insurance
  • Review all outgoing payments and checks
  • Perform periodic (and random) reviews of your financials
  • Have more than one person managing financials

Business risk vs financial risk

Financial risk refers to a company’s debt management and financial leverage, while business risk refers to the company’s ability in generating revenue to cover operational expenses.

Organizational risk

Organizational risk assesses whether the company’s books and records are in good order, whether it has documented, repeatable processes and procedures, does it have signed contracts with its key customers and suppliers, is its intellectual property adequately protected, and does it have adequate information technology systems that can scale with future growth.

What is environmental risk in business?

In addition, organizational risk will look at specific risks like environmental risk (does the company have any potential exposure for future environmental clean-up requirements).

What is litigation risk?

Finally, organizational risk will look at litigation risk (does the company have specific legal exposure for a current lawsuit, or it is frequently involved in litigation?). Each of these questions can highlight potential trouble spots down the road which could adversely impact the company’s future performance and therefore its current valuation.

Customer concentration risk

Customer risk examines potential issues like whether the company has customer concentration ( ) or geographic or end-user concentration (too much revenue coming from customers in one geography or vertical). Is the company’s relationship with its customers a one-time, project-based relationship, or is it   such that future revenues are more predictable? What is the credit quality of the customers? Does the company have adequate systems in place to manage effective business development efforts? Is the company strategic in its selection of customers to pursue, or does it simply take revenue where it can find it? Each of these questions can highlight areas where a company’s future revenues might be at risk, decreasing the current value of the business.

Employee/team risk

Employee or team risk examines a company’s team to see if it has adequate depth and breadth (or is the business to dependent on the owner or just a few key personnel?), whether the team has the  , whether the company’s annual turnover rate is too high (or too low), whether there is a single point of failure in the business with a key individual, and whether the company’s relationships with its employees is documented and there are good records. From our CoPilot application, we know that over 90% of businesses are   for either sales, marketing, product development or operations. This risk will decrease valuation by 10-30% in most cases.

Strategic risk

Strategic risk examines the company’s protective “moat” around its business – what level of protection or insulation from competition does the company have? Does the company have a  ? Does it have patented products that give it effectively exclusivity in certain markets? Does the company have exclusive territories? What are the barriers to entry for competitors? Each of these questions demands detailed analysis to understand how much revenue growth and what level of profitability a company could expect to achieve over the coming years. Companies with very strong strategic positions will be worth much more than companies that have little or no differentiation.

Market risk

Market risk is an analysis of the overall market in which the company operates. Is the company’s market highly cyclical or does it perform well in recessions? Are there specific regulatory issues in the company’s market which could adversely impact future performance? Is the market expected to grow or shrink in the future? Is the market highly fragmented in terms of competition, or are there one or two large players controlling much of the market? Each of these factors will help explain whether the company faces headwinds or will benefit from market tailwinds.

Growth risk

Finally, growth risk is both an assessment of the overall market growth expected, as well as whether a particular company has the capacity to grow and scale. Are the company’s systems and personnel adequate to support future growth? Does the company have any unique competitive advantages which would allow it to grow faster than the market growth rate? Has the company historically demonstrated that it can grow quickly and still maintain customer quality? Each of these answers will have a major impact on valuation – without adequate future growth, the value of its cash flows will be much lower (and the corresponding valuation will also be much lower).

How to calculate risk in business

Understanding each of these specific areas for business risk assessment is helpful, but is there a way a business owner can get an objective view of the specific risks in their business?

Here are four ways to get an objective assessment of the level of risk in your business:

Hire a consultant

There are thousands of business consultants who can provide an objective assessment of your business – ideally, these consultants will have operating experience as well as transaction or valuation experience so they can help you dial in exactly which risks in your business are impacting value the most.

Use a peer advisory board

We do a lot of work with Vistage, a peer advisory organization in which groups of 12-15 CEO’s gather monthly to discuss issues and address business challenges. These groups can be an incredibly effective way to get an outsider’s assessment of what they see in your business and what issues would worry them the most.

Ask your team

Most management teams see business risk differently from the company owner. It is remarkable to us how many times the management team identifies risks the company owner never even thought of, or thought that these risks were not important. Your team should be able to give you a better assessment of the level of risk in your business because they are likely closer to the customer and your operations.

Use a business risk assessment

We only know of our own proprietary business risk assessment, CoPilot. CoPilot is free to qualified business owners – it will ask you 120 questions, score you against peer companies, identify risks in your business that will cause investors to reduce their valuation of your business, and help you prioritize what to work on to get the biggest bang for your buck. CoPilot is just a starting point, but it is a great tool to spot potential issues and then have more detailed discussions with your team or an outside advisor.

What does a risk assessment do for a business?

We have done hundreds of our own assessments through CoPilot, and in most cases, the business owner was aware of maybe 70-75% of the business risks CoPilot identified and was unaware of the other 25-30% of risks that investors might deem important. Understanding where an investor is going to see problems with your business is sort of like getting the test ahead of time.

Knowing what investors are going to have issues with gives you plenty of time to address those problems before ever having a discussion with an investor or buyer. This allows you not only to make your business better (and allow you to sleep better at night), but also to drive a higher expected valuation for your company. It prevents you from getting surprised during due diligence with a potential buyer who then wants to renegotiate the price or terms of your deal.

Why risk management is important for businesses

As business owners, we all have blind spots – issues we can’t see (or choose not to see) that make our business less dependable and less predictable. Getting the perspective of someone who is not in our day-to-day business is simply good business practice.

If you are able to drive more and more risk out of your business, your future revenues and cash flow will be more predictable (making your business more valuable), and it will maximize the options you have when it comes time to transition your business.

How to reduce business risk: business risk assessment

If you are considering buying or selling a company and would like to get an assessment of your business or a seller’s business, please feel free to contact us or reach out to personally and we will discuss your goals and objectives and the tools we have to assist you.

If you’d like to learn more about how prepared your business currently is for a sale, click the red banner above to take our CoPilot Assessment. CoPilot will help you identify what specific risks your business has that decrease company value and reduce your certainty of close. The assessment identifies over 90 different types of potential risks your company could have that will make your business less valuable in the eyes of an investor. Get the test ahead of time and build value today with CoPilot.

Take our copilet market readiness assessment

Enter you information below, and a team member will be in touch.

"*" indicates required fields

This field is for validation purposes and should be left unchanged.