Risk Framework Template
Written by Dr Laura Faulconer
Communicating risk to investors
There are some universal startup risks, like problem-solution fit, product-market fit, and the channel to reach customers. Early-stage startups seeking investment funding still have a lot of unmitigated risk. What investors look for in a startup is that they are aware of their biggest risks and are actively managing them.
Risk management is the formal process of identifying and controlling risks. It is the art and science of thinking about what could go wrong and what should be done to mitigate those risks in a cost-effective manner.
Most seed-stage startups do not have a well-refined risk management framework. If you want to stand out from the crowd when fundraising, consider taking the time to curate a coherent risk management framework for your opportunity. The 3-step process outlined below can help you get started.
For the purposes of risk assessment in an early-stage startup, it is most valuable to focus on your unvalidated assumptions – of which there are inevitably a lot. These are the same assumptions you should be working toward testing through a customer discovery process, which has been outlined in Steven G. Blank’s book, The Four Steps to the Epiphany. In general, these assumptions are across the following categories: product concept; customers and the problems they want to solve; distribution and pricing; demand creation; market type; and competition. Below are some example assumptions listed for each category:
I can manufacture it
I can secure reliable vendors
Customers and the problem
My target customers are who I expect them to be
My customer agrees that there are no good solutions available to them
My customer does not have a ready substitute that satisfies their need
X is sufficient demand for my solution to achieve breakeven
x% of my ideal customers will use my product regularly
We can reach our customers through channel x without an internal sales force
Market leader will not initiate competitive response until I have >x% market share
Acquisition, not competition, is the likely competitive response
Barriers to entry prevent new entrants
I have a strong IP defensibility position
Distribution and pricing
I can make it for $x
I can sell it for $x
I can secure a distributor to access x% of customers in initial target region
I can secure cost-effective distribution logistics
Market type, trends and drivers
This is a new market / existing market / resegemented market
Legal & Regulatory
I have the correct regulatory / reimbursement strategy
I have freedom to operate
I can recruit / motivate / retain top talent
With your entire team, get together and do a sticky-note brainstorming session considering risk factors and unproven assumptions that could cause substantial harm to realising your opportunity.
You could spend a lot of time worrying about the many risks that are possible. At this stage, it is most helpful to think about risks that are potential ‘company killers’, falling in the quadrants of high likelihood and major consequence.
Create a spreadsheet that assigns a score to the possibility of a wrong assumption and the level of impact if you are wrong. Multiply the likelihood score (from 1-5) and severity of impact (from 1-5) to get a risk score.
Scores that place that risk factor into an ‘Extremely High Risk’ or ‘High Risk’ classification you should be able to discuss a detailed risk mitigation strategy with potential investors. You certainly would not want them to raise a potential risk in this category that you had not considered.
You can mitigate risk through insurance, risk sharing, or actions to minimise harm. There are three core principles of risk mitigation (borrowed from How to De-Risk a Startup, from Coding VC):
Showing is better than telling
You think you can do XYZ
You’ve done XYZ in the past
You’re currently doing XYZ and doing it well
External validation is stronger than personal opinion
You claim XYZ
Numerous people who are affiliated with you claim XYZ
Numerous people who are completely unaffiliated with you claim XYZ
More data is better
You have 0 data points
You have 5 data points
You have 50 data points
For each of your most critical risk factors identified previously, craft a mitigation tactic that can step down that risk using the principles above. For example:
You think people will want to use your product (unvalidated product/market fit assumption)
You talked to potential customers, they said they were interested
You have LOIs (letters of intent)
You have unpaid pilots
You have paid pilots
You have executed contracts
You have executed long-term contracts
It is also helpful to consider the cost of mitigation – an effective risk strategy weighs the benefit of mitigating the risk against the cost of doing so. One way of communicating the risks you are actively managing and monitoring is with a simple risk register table.
Like your business plan, your risk management plan is a living document. You should review and revise it regularly as your circumstances evolve.
Finally, although it’s important to develop a risk management plan, you shouldn’t obsess over it. Anticipating every possible risk factor is neither possible, nor practical. That’s because no matter how smart we are, and no matter how carefully we assess the situation, we can’t think of everything. What an investor wants to see is that you are thinking about risk and that you have a credible strategy for monitoring, assessing and managing risk.