Sometimes the word is used in its narrow sense as a synonym for “probability”, such as in the observation that there is a high or low risk of an event happening. In its wider sense, however, it incorporates the impact on the observer; the probability must be multiplied by the impact of the event.
Risk = Probability x Impact
A Risk Matrix built as a multiplication table is common in business, with prescribed responses for certain scores. For example, any score above a 10 might require a Board decision. Basic risk matrices like these are of little use in themselves, as they lack granularity and fail to incorporate a financial element, as well as forcing an unrealistic quantification of the future.
But they are useful in separating out the two components of risk in its broader sense. Once this is done, focus can move to managing the key component of any given event’s risk- the probability, or the impact. If an investor asks about an event that is very unlikely but would have a large impact, merely dismissing the risk on grounds of likelihood is not enough. Emphasise the low probability, of course. But prepare a plan and answer on what you would do IF it did happen- in other words, what can you do about the impact?
A system that is sometimes used to address risks is:
Prevent Prepare Respond Recover
Prevent deals with probability; what can you do to reduce likelihood? The other three components cover reducing the impact, through three different stages of planning.
Prepare means acting in advance, such as keeping a month of stock for some component in case your supplier closes down. Clearly, a balanced plan will have to weigh the costs of preparation against the risk.
Respond is twofold. You need a warning system in place that will let you know quickly and efficiently if something happens; would you invest £1m in a biotech company whose only way of knowing whether Glaxo is competing with them is Google Alerts? And then you need an immediate plan of action that is already in place and communicated to the team- making things up in times of stress is bad management.
Recover acknowledges the reality that, should the risk event occur, there will be some impact on your company, however well prepared you were and however efficiently you responded. Health and Safety events usually require an operational recovery, whereas market changes may require strategic ones.
Types of Risk
Below are a few of the less obvious ones- there are lots more. Let’s start at the most abstract and generic level and work down into the company.
Value Chain Risk. Your market is woodcutting, and your value chain is wooden homes supplied to 17th Century London. Then a baker on Pudding Lane starts a great fire in 1666 and wooden homes are banned. Likelihood? Five days in a few centuries. Impact? The entire value chain stops existing.
Market Risk. Perhaps the value chain is healthy but your market within it is not. Disruptive competitors can change how an entire value chain functions, and sometimes cut out certain markets from them. Holiday accommodation is a growing value chain, but since AirBnB, home swap agency sites are a less attractive market. Something else to consider here is what your market is like in general for startups trying to enter. Writing a blog? Easy. Manufacturing cars? Ask Elon. Think about the barriers to entry, and the requirements for entry; if no-one has entered this market for decades there’s probably a reason, and disrupting it from outside might be easier than entering. Supermarkets spend a lot of time in deadly price wars, and a risk to new entrants is that the incumbents intensify discounting until the new entrant runs out of capital.
Regulatory Approval Risk. What would happen if your product failed clinical trials? There might be ways to salvage the situation but a common theme is that reducing the amount of money required to find out if you pass reduces the risk, because the impact (“how much money did the investor lose?”) is lower. Could the investment be in stages triggered by reaching de-risking milestones? Could the CEO’s secretary not be hired until after?
Business Risk. This covers all sorts of general issues that the company might face in the outside world. Forex changes, macro-economic downturns, customers don’t like it, competition, the media are unfair, you just can’t perform from an operations perspective…
Financial Risk. This is usually related to a company’s leverage (debt), and the ability of the free cash flows to cover the debt. There are loads. Startups usually don’t have any debt, but there are ongoing fixed payments that are pretty similar; employee wages being the biggest. Shorter termination periods mean less financial risk as you can stop paying people sooner, but it also means they can leave sooner, increasing business risk, and at some point very short termination becomes unethical. If you are still at the unprofitable stage of existence, the risk is mostly about your ability to reach the next milestone with the cash you have/are asking for. The usual mitigation is a margin built into the raise, usually around 30%. If you are profitable, the risk is about staying that way and becoming more so.
Conclusion
Don’t bury your head in the sand about this. You are the biggest investor in your company and hiding the risks from yourself is unfair on you and your family, and it’s unethical to hide them from your investors. If they spot risks during Due Diligence that you haven’t even alluded to you will come across as either incompetent or potentially even dishonest. Being open about a risk might make an investor back out, but that harsh realisation might save you years of struggling with a failing company.
It’s up to you whether you include a section on risk in the pitch- though you’ll need one on the competition at least. At some point in the meetings or data room you should highlight the key risks and have answers for those and all the other risks. And those answers should be in place because you have planned.