Business Risks: 7 Types, How to Assess Them, and an Example

A business risk is any event that can cut your profit below plan or close the business: a new competitor, an unforeseen cost, a cyberattack, a lawsuit, a bad review. Risks fall into seven types: strategic, financial, operational, cybersecurity, compliance, reputational and hazard. You manage them in five steps: list them, rate each on likelihood and impact, rank them, choose a response (avoid, reduce, transfer, accept), and review the list on a schedule.

What business risk means

ISO 31000:2018 defines risk as the “effect of uncertainty on objectives.”¹ Each risk gets two ratings: how likely it is and how much it would hurt.

A hazard is the source of harm, such as a wet floor. A risk is the chance that it hurts you, and how badly. An issue is a risk that already happened.

The 7 types of business risk

A risk starts with a choice you make (a loan, a new market), an event you cannot control (a recession) or a hazard in the work itself (a fire).

Type	What it is	Example	First control
Strategic	Your plan stops matching the market	A cheaper rival opens nearby	Track direct competitors
Financial	Cash runs short or does not come in	A large customer pays late	A monthly cash forecast
Operational	People, processes, systems or suppliers fail	Your only supplier misses a delivery	A second supplier
Cybersecurity	An attack exposes data or stops systems	Phishing takes over the payment account	Multi-factor sign-in
Compliance	You break a law, permit or contract	An injured employee, no workers’ comp	A list of state and city duties
Reputational	Customers stop trusting you	A one-star review spreads	A reply to every review
Hazard	Physical harm to people or property	A fire closes the shop	Property insurance

Strategic risk

Strategic risk is the chance that your offer stops working. You set prices and choose the product and markets. The market controls tastes and new entrants; for that half, learn how to do a market analysis.

To manage it, list your direct competitors and their prices, then write a contingency plan for the top risk: what you do if a cheaper entrant opens next door.

Financial risk

From the business’s side, financial risk is cash flow (bills due before customer money arrives), credit (a client stops paying), debt (a variable rate rises) or currency (imports get dearer).

Forecast cash monthly and hold a reserve of the months of fixed costs you choose to cover. For B2B sales, trade credit insurance protects receivables against non-payment due to insolvency or protracted default.² Before you set a price, check your unit economics.

Operational risk

Operational risk is a breakdown in daily work: the only employee who knows the bookkeeping quits, or your single supplier closes. The first control is concentration: if one supplier or customer carries a large share of revenue, find a second.

Cybersecurity risk

In the Allianz Risk Barometer 2026, cyber incidents rank as the top global business risk for the fifth year in a row, with 42% of responses.³ The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints and $20.877 billion in reported losses in 2025, a 26% rise in losses from 2024.⁴

NIST released Cybersecurity Framework 2.0 on February 26, 2024, with six functions: Govern, Identify, Protect, Detect, Respond and Recover.⁵ Five actions for a small business:

Assign a security owner (Govern).
List devices and accounts, then customer data (Identify).
Lock accounts with multi-factor sign-in; update software (Protect).
Watch sign-in and payment alerts (Detect).
Back up data offline; write down whom to call (Respond, Recover).

Scheme of 5 steps in order: Assign a security owner (Govern) → List devices and accounts, then customer data… → Lock accounts with multi-factor… — Each step builds on the one before it: start with «Assign a security owner (Govern)» and get to «Back up data offline» only when the steps between are done.

Compliance and legal risk

A US business with employees must manage these by law:

Workers’ compensation is mandatory for nearly all employers in every state except Texas, which allows employers to opt out.⁶
OSHA’s General Duty Clause, Section 5(a)(1), requires a workplace free of recognized hazards likely to cause death or serious physical harm.⁷
All 50 states have data-breach laws: if customers’ personal information is breached, you notify them.⁸
Licenses and permits come from your city and state.

Reputational risk

Reputational risk is sales lost when customers stop trusting you. It is direct (a customer posts your failure on Google reviews or Yelp), indirect (a partner misbehaves in your name) or peripheral (your industry gets bad press). Answer every review and fix the cause it names.

How to identify business risks in 5 steps

Identify: list every risk. A SWOT analysis is another way to find threats.
Analyze: rate each 1–3 on likelihood and impact; note whether it hits fast or slow.
Evaluate: multiply the two scores, then rank by band.
Respond: choose a response and name an owner.
Monitor: re-score on your schedule and after any change.

Six questions find the big risks: What would stop sales for a month? Which supplier or customer is a large share of revenue? What would a rival undercut? What data do you hold? Which law governs your work? What would a bad review say?

Two rows of the example’s risk register (L = likelihood, I = impact):

Risk	Type	L	I	Score	Response	Review
A competitor offers about 70% of the idea^ex	Strategic	3	3	9	Reduce	Before the lease
Labor may erode the 35% margin^ex	Operational	2	3	6	Measure	Before the lease

How to assess risks with a likelihood × impact matrix

Our method in the open. Likelihood 1–3: unlikely within a year, could happen, expected or under way. Impact 1–3: an annoyance you absorb, hurts the year’s profit, threatens the business. The idea check uses the same scales.

Score = likelihood × impact, from 1 to 9. We read it in three bands:

6–9, act now: respond and assign an owner this week.
3–4, plan: write the response down and name a trigger to watch.
1–2, watch: review at the next scheduled check.

Deciding in advance which band you accept without action is your risk appetite. The worked example on the grid:

Impact \ likelihood	1	2	3
3 threatens the business	3	6: R2, R4	9: R1
2 hurts the year’s profit	2	4: R3	6
1 an annoyance	1	2	3

If a risk rests on an unmeasured figure, such as demand or margin, measure it first; a good-looking guess does not lower the risk.

Four ways to respond to a risk

Response	What you do	When it fits	Example
Avoid	Drop the activity	Score 6–9, activity optional	An uninsurable delivery route
Reduce	Lower likelihood or impact	Risks you can influence	A second supplier
Transfer	Shift the cost	High impact you cannot reduce	Insurance, a contract clause
Accept	Live with it and watch	Score 1–2	A small supplier price rise

Give each action an owner and a date, and carry the list into the risks section of your business plan.

Which insurance covers which risk

The NAIC describes a business owner’s policy (BOP) as a package product that typically includes property, business interruption/continuation and liability insurance.⁹

Risk	Policy	What it covers
Fire, theft, an injured customer	BOP	Property and liability
A shutdown after a fire	Business interruption	Lost income, generally only after direct physical loss from a covered peril¹⁰
An employee hurt at work	Workers’ comp	Mandatory for nearly all employers outside Texas⁶
A breach or ransomware	Cyber	Costs after an attack, per the policy
A B2B customer who does not pay	Trade credit	Receivables lost to insolvency or protracted default²

A worked example: a laundromat in Columbus, Ohio

The idea, in the example by our method: a neighborhood laundromat with wash-and-fold drop-off service in a dense renter area of Columbus, Ohio, for apartment dwellers without in-unit washers.^ex In the example, the check returned “Possible, with caveats”^ex with a score of 64^ex and found four risks:

R1 (3 × 3 = 9, act now): Columbus Express Laundry already offers about 70% of the idea, so the new site must win renters on something else.^ex In the example, the check counts 10 direct competitors.^ex
R2 (2 × 3 = 6, act now): labor costs for wash-and-fold may erode the 35% margin estimate, which is not measured in Columbus.^ex
R4 (2 × 3 = 6, act now): demand is unmeasured because no search-volume data exists^ex, so the buyer count may be smaller than assumed.^ex
R3 (2 × 2 = 4, plan): rising rents may push self-serve laundromats out of the neighborhood, as seen in other cities.^ex

Responses by our method:

R1, reduce: in the example, 3 complaints concern price^ex and 3 convenience^ex, so build the offer on your customers’ pain points.
R2, reduce by measuring: price wash-and-fold labor in Columbus before signing.
R4, reduce by testing: run a demand test or a fake door test before the lease.
R3, plan: write down the lease terms you need and a second site.

Stress-testing R2, in the example: $6 a purchase^ex, 4 purchases a month^ex, a 12-month lifetime^ex, a $30 customer acquisition cost (CAC)^ex and a 35% margin^ex, giving a lifetime value (LTV) of $100.80^ex, LTV to CAC of 3.36^ex and payback in 3.6 months.^ex LTV = price × purchases a month × lifetime × margin. In our example, if labor cuts the margin to 25% (an assumption), LTV falls to $72, LTV to CAC to 2.4, and payback grows to 5 months. Check your unit economics with your own figures.

Two of the three act-now risks rest on unmeasured figures, so both get tested before any money goes into a lease.

Your next step

List your risks, score each one, act on the 6–9 band this week and review the register on your schedule. For your own idea, check your idea’s risks free.

FAQ

What are the 7 types of business risk?

Strategic, financial, operational, cybersecurity, compliance and legal, reputational and hazard.

What is an example of a business risk?

In the example by our method, a new Columbus laundromat faces a competitor already offering about 70% of the idea.^ex A common beginner mistake: treating an unmeasured figure as fact. See how to start a business.

How do you identify business risks?

List them, rate each 1–3 on likelihood and impact, rank them, choose a response and review on a schedule.

What insurance does a small business need?

Most start with a business owner’s policy, which bundles property and liability insurance with business interruption cover.⁹ Nearly all employers outside Texas also need workers’ compensation.⁶

What is the difference between business risk and financial risk?

Business risk is the uncertainty of operating income (EBIT) from the business itself. Financial risk is the added risk from using debt.¹¹

One of my risks scores a 6. Do I really have to act on it this week, or can it wait?

Fox Act on it. On this method's scale a score from 6 to 9 is the act-now band: choose a response and assign an owner this week. Only a 3 or 4 lets you plan, by writing the response down and naming a trigger to watch, and a 1 or 2 waits for the next scheduled check. Next step: put an owner's name and a date next to every risk that scored 6 or more.

My demand numbers are basically a guess. How should I score a risk that depends on them?

Fox Treat the guess as part of the risk, not as proof against it: a good-looking guess does not lower the risk, so measure the figure first. In the laundromat example, unmeasured demand scored 2 × 3 = 6, act now, and the response was to test before committing. Next step: run a demand test or a fake door test before you sign a lease or spend serious money.

If labor eats my margin, how much does that change LTV to CAC and payback?

Fox In the page's laundromat example, labor cutting the margin from 35% to 25% drops LTV to $72, LTV to CAC to 2.4, and stretches payback to 5 months. Keep in mind the 25% is an assumption and the 35% margin itself was not measured in Columbus. Your result depends on your own price, purchase frequency and lifetime. Next step: price your labor locally, then rerun LTV = price × purchases a month × lifetime × margin at your worst-case margin.

How do I choose between reducing a risk myself and just shifting it to insurance?

Fox Ask whether you can influence the risk. If you can, reduce it, for example with a second supplier. If the impact is high and you cannot bring it down, transfer the cost with insurance or a contract clause. Small risks scoring 1 or 2 you can simply accept and watch. Next step: mark each high-scoring risk as one you can influence or not, then give each chosen action an owner and a date.

Sources

iso.org, 02/15/2018
allianz-trade.com, 04/09/2026
commercial.allianz.com, 09/24/2025
ic3.gov, 08/25/2026
nvlpubs.nist.gov, 08/25/2026
congress.gov, 09/02/2025
osha.gov, 10/02/2026
documents.ncsl.org, 01/19/2026
content.naic.org, 08/24/2026
insurance.ca.gov, 10/03/2026
ssrudlp.ssru.ac.th, 07/10/2026

Business Risks: 7 Types, a Risk Matrix, and How to Manage Them

What business risk means