The Main Types of Business Risk

Businesses face all kinds of risks, some of which can cause serious loss of profits or even bankruptcy. But while all large companies have extensive “risk management” departments, smaller businesses tend not to look at the issue in such a systematic way.

So in this four-part series of tutorials, you’ll learn the basics of risk management and how you can apply them in your business.

In this first tutorial, we’ll look at the main types of risk your business may face. You’ll get a rundown of strategic risk, compliance risk, operational risk, financial risk, and reputational risk, so that you understand what they mean, and how they could affect your business. Then we’ll get into the specifics of identifying and dealing with these risks in later tutorials in the series.

1. Strategic Risk

Everyone knows that a successful business needs a comprehensive, well-thought-out business plan. But it’s also a fact of life that things change, and your best-laid plans can sometimes come to look very outdated, very quickly.

This is strategic risk. It’s the risk that your company’s strategy becomes less effective and your company struggles to reach its goals as a result. It could be due to technological changes, a powerful new competitor entering the market, shifts in customer demand, spikes in the costs of raw materials, or any number of other large-scale changes.

History is littered with examples of companies that faced strategic risk. Some managed to adapt successfully; others didn’t.

A classic example is Kodak, which had such a dominant position in the film photography market that when one of its own engineers invented a digital camera in 1975, it saw the innovation as a threat to its core business model, and failed to develop it.

It’s easy to say with hindsight, of course, but if Kodak had analyzed the strategic risk more carefully, it would have concluded that someone else would start producing digital cameras eventually, so it was better for Kodak to cannibalize its own business than for another company to do it.

Failure to adapt to a strategic risk led to bankruptcy for Kodak. It’s now emerged from bankruptcy as a much smaller company focusing on corporate imaging solutions, but if it had made that shift sooner, it could have preserved its dominance.

Facing a strategic risk doesn’t have to be disastrous, however. Think of Xerox, which became synonymous with a single, hugely successful product, the Xerox photocopier. The development of laser printing was a strategic risk to Xerox’s position, but unlike Kodak, it was able to adapt to the new technology and change its business model. Laser printing became a multi-billion-dollar business line for Xerox, and the company survived the strategic risk.

2. Compliance Risk

Are you complying with all the necessary laws and regulations that apply to your business?

Of course you are (I hope!). But laws change all the time, and there’s always a risk that you’ll face additional regulations in the future. And as your own business expands, you might find yourself needing to comply with new rules that didn’t apply to you before.

For example, let’s say you run an organic farm in California, and sell your products in grocery stores across the U.S. Things are going so well that you decide to expand to Europe and begin selling there.

That’s great, but you’re also incurring significant compliance risk. European countries have their own food safety rules, labeling rules, and a whole lot more. And if you set up a European subsidiary to handle it all, you’ll need to comply with local accounting and tax rules. Meeting all those extra regulatory requirements could end up being a significant cost for your business.

Even if your business doesn’t expand geographically, you can still incur new compliance risk just by expanding your product line. Let’s say your California farm starts producing wine in addition to food. Selling alcohol opens you up to a whole raft of new, potentially costly regulations.

And finally, even if your business remains unchanged, you could get hit with new rules at any time. Perhaps a new data protection rule requires you to beef up your website’s security, for example. Or employee safety regulations mean you need to invest in new, safer equipment in your factory. Or perhaps you’ve unwittingly been breaking a rule, and have to pay a fine. All of these things involve costs, and present a compliance risk to your business.

In extreme cases, a compliance risk can also affect your business’s future, becoming a strategic risk too. Think of tobacco companies facing new advertising restrictions, for example, or the late-1990s online music-sharing services that were sued for copyright infringement and were unable to stay in business. We’re breaking these risks into different categories, but they often overlap.

3. Operational Risk

So far, we’ve been looking at risks stemming from external events. But your own company is also a source of risk.

Operational risk refers to an unexpected failure in your company’s day-to-day operations. It could be a technical failure, like a server outage, or it could be caused by your people or processes.

In some cases, operational risk has more than one cause. For example, consider the risk that one of your employees writes the wrong amount on a check, paying out $100,000 instead of $10,000 from your account.

That’s a “people” failure, but also a “process” failure. It could have been prevented by having a more secure payment process, for example having a second member of staff authorize every major payment, or using an electronic system that would flag unusual amounts for review.

In some cases, operational risk can also stem from events outside your control, such as a natural disaster, or a power cut, or a problem with your website host.  Anything that interrupts your company’s core operations comes under the category of operational risk.

While the events themselves can seem quite small compared with the large strategic risks we talked about earlier, operational risks can still have a big impact on your company. Not only is there the cost of fixing the problem, but operational issues can also prevent customer orders from being delivered or make it impossible to contact you, resulting in a loss of revenue and damage to your reputation.

4. Financial Risk

Most categories of risk have a financial impact, in terms of extra costs or lost revenue. But the category of financial risk refers specifically to the money flowing in and out of your business, and the possibility of a sudden financial loss.

For example, let’s say that a large proportion of your revenue comes from a single large client, and you extend 60 days credit to that client (for more on extending credit and dealing with cash flow, see our earlier cash flow tutorial).

In that case, you have a significant financial risk. If that customer is unable to pay, or delays payment for whatever reason, then your business is in big trouble.

Having a lot of debt also increases your financial risk, particularly if a lot of it is short-term debt that’s due in the near future. And what if interest rates suddenly go up, and instead of paying 8% on the loan, you’re now paying 15%? That’s a big extra cost for your business, and so it’s counted as a financial risk.

Financial risk is increased when you do business internationally. Let’s go back to that example of the California farm selling its products in Europe. When it makes sales in France or Germany, its revenue comes in euros, and its UK sales come in pounds. The exchange rates are always fluctuating, meaning that the amount the company receives in dollars will change. The company could make more sales next month, for example, but receive less money in dollars. That’s a big financial risk to take into account.

5. Reputational Risk

There are many different kinds of business, but they all have one thing in common: no matter which industry you’re in, your reputation is everything.

If your reputation is damaged, you’ll see an immediate loss of revenue, as customers become wary of doing business with you. But there are other effects, too. Your employees may get demoralized and even decide to leave. You may find it hard to hire good replacements, as potential candidates have heard about your bad reputation and don’t want to join your firm. Suppliers may start to offer you less favorable terms. Advertisers, sponsors or other partners may decide that they no longer want to be associated with you.

Reputational risk can take the form of a major lawsuit, an embarrassing product recall, negative publicity about you or your staff, or high-profile criticism of your products or services. And these days, it doesn’t even take a major event to cause reputational damage; it could be a slow death by a thousand negative tweets and online product reviews.

Next Steps

So now you know about the main risks your business could face. We’ve covered five types of business risk, and given examples of how they can affect your business.

This is the foundation of a risk management strategy for your business, but of course there’s much more work to be done. The next step is to look more deeply at each type of risk, and identify specific things that could go wrong, and the impact they could have.

It’s not much use, for example, to say, “Our business is subject to operational risk.” You need to get very granular, and go through every aspect of your operations to come up with specific things that could go wrong. Then you can come up with a strategy for dealing with those risks.

We’ll cover all of that in the rest of the tutorials, so stay tuned for the rest of the series on how to manage risk in your business. Next up is a tutorial on measuring and evaluating different risks.

Editorial Note: This content was originally published in 2014. We’re sharing it again because our editors have determined that this information is still accurate and relevant.