Most risk sections list hazards every business shares and persuade nobody. This one works through a complete assessment for a single business, entry by entry, and shows what a lender is actually checking.
Search for a business plan risk assessment example and you will mostly find tables of generic hazards - "competition", "economic downturn", "key person leaves" - each with a colour next to it. They are easy to produce and they persuade nobody, because every plan has them and none of them says anything specific about *your* business.
This guide is the opposite. It works through a complete risk assessment for one fictional business, shows the reasoning behind each entry, and explains what a lender or investor is actually checking when they read it. Every figure in the worked example is labelled (illustrative); every figure about the world is sourced.
Here is a fact that explains most of the confusion. The U.S. Small Business Administration's traditional business plan format has nine sections: executive summary, company description, market analysis, organization and management, service or product line, marketing and sales, funding request, financial projections, and an optional appendix.
None of them is a risk assessment.
So writers either omit risk entirely, or bolt on a table they have seen elsewhere without knowing what it is for. Meanwhile, the opposite is true at the other end of the market: a public company must disclose its risks, and in a specified form.
Required by law - Item 105 of the SEC's Regulation S-K requires registrants to discuss the material factors that make an investment speculative or risky - organised logically under headings, written in plain English, with a summary of no more than two pages if the section runs past fifteen.
That gap is the opportunity. The discipline regulators impose on public companies - name the material risks, be specific, be readable - is exactly what makes a private business plan credible. You are not required to do it, which is precisely why doing it well stands out.
A risk section is not a confession and it is not a disclaimer. It is evidence about the author. A reader is asking three questions, and only one of them is about the risks themselves:
This is why a colour-coded grid is weak evidence. Red, amber and green record how the author feels. They cannot be checked, compared, or proved wrong, so they tell a reader nothing about the author's judgement. See why business plans fail for the broader pattern.
Before any example, it helps to know the odds the reader already has in mind. These are the national figures, and they are less dramatic than the folklore about nine in ten businesses failing.
49.8% to 57.3% - the range of five-year survival rates for new U.S. establishments, depending on the year the business was born. Start-ups that hit a recession early have materially lower survival than those born into a recovery.
Source: U.S. Bureau of Labor Statistics, Business Employment Dynamics
Roughly half of new establishments reach year five. Survival also gets easier the longer you last: about 82% of establishments survive each of their first four years, and from the fifth year on the annual survival rate of the remaining businesses rises above 90%. The risk is front-loaded, which is an argument for being specific about the first eighteen months rather than the fifth year.
Funding is its own hurdle. In the Federal Reserve Banks' most recent Small Business Credit Survey, 60% of employer firms applied for financing; of those applicants, 42% received the full amount they sought, 36% received some or most, and 22% received none. A risk section is part of how you end up in the first group.
Six columns. Each one exists because a reader asks that question anyway, and a table that answers it beforehand is doing work a colour cannot.
The two columns people leave out are the ones that carry the most weight. Early signal says what you would observe before the risk fully arrives - it turns a worry into something monitorable. Owner says who is watching. A risk with no owner is a risk nobody is watching.
All figures in this example are (illustrative) - invented for the purpose of showing the reasoning. The point is the structure and the logic, not the numbers.
Mercer & Fen is a fictional two-year-old coffee roaster seeking $180,000 (illustrative) to buy a larger roaster and add a second wholesale route. Revenue is $1.2M (illustrative), roughly 70% wholesale to cafes and 30% direct-to-consumer online.
Green coffee is the single largest input cost. The generic version of this entry says "commodity price risk - medium". The specific version states the exposure in the business's own terms:
Notice what makes this credible: it names the mechanism, quantifies the exposure as a share of costs, and the mitigation is a policy someone could actually audit. It also admits the mitigation is partial - 40% stays exposed. Claiming a risk is fully neutralised is the fastest way to lose a careful reader.
This is the entry most plans miss, and the one an experienced lender looks for first.
This entry does something subtle and important: it connects the risk to the thing being funded. The loan is not just for growth - it is the de-concentration strategy. A reader who sees that understands the use of funds better than the funding request did.
Almost every plan lists this. Almost none of them says anything useful. The difference is naming what the person actually does that nobody else can.
The "not applicable" in the early-signal row is deliberate. A risk register where every row is neatly filled in is a register someone has written to look complete. Saying plainly that one risk cannot be monitored - only prepared for - is more convincing than inventing an indicator.
A good register tells a reader you understand your business. It still does not answer the question the register raises: given all of this, how likely is the plan?
The jump is from listing risks separately to letting them act together. Green coffee could rise and the largest account could leave in the same year. Those are the cases that break a plan, and no row-by-row table can show you the combined odds, because the combination is the part a table cannot hold.
This is what Monte Carlo simulation does: instead of one number per assumption, you give a range, and the model samples across all of them thousands of times to produce a distribution of outcomes. The technique is covered in depth in our guides to scenario analysis software and risk modeling software; three-point estimation is the natural first step if you have only ever written single numbers.
There is a well-documented reason not to trust a single-point forecast: planners are systematically optimistic, and the bias is not random error.
Bias, not error - Research on large projects finds cost overruns are driven by systematic optimism rather than random mistakes. The proposed correction - reference class forecasting - estimates from the outcomes of comparable past projects rather than from the planner's own view of this one.
The practical implication for a business plan is simple. When you write a range, do not centre it on your plan and add a little either side. Ask what happened to comparable businesses, and let that set the width. Our guides to reference class forecasting and optimism bias in business go further into this.
Since the SBA format has no risk section, you are choosing. Two placements work:
On length: the SEC requires a summary when a risk section runs past fifteen pages, which is a useful sense of proportion. For a small business plan, five to eight well-reasoned entries beats twenty generic ones. A reader who sees twenty rows assumes you have padded; a reader who sees six specific ones assumes you have chosen.
A business plan risk assessment is not a list of things that could go wrong. It is the part of the plan that shows the forecast was built rather than hoped for. Be specific enough that the section could only have been written about your business; quantify impact in your own units; admit what you cannot fully mitigate; and where you can, replace single numbers with ranges so the reader can see the downside you are asking them to accept.
If you want the odds rather than the list, that is what Incertive does: it turns a plain-language plan into a probability of success and a ranked list of the assumptions driving it. You can also start from our business risk assessment template.
Not formally. The SBA's traditional business plan format lists nine sections and risk assessment is not one of them. But public companies are required by SEC Regulation S-K Item 105 to disclose material risk factors in plain English, and the same discipline is what makes a private plan credible to a lender or investor. Because it is optional, doing it well is a differentiator rather than a box-tick.
Five to eight specific, well-reasoned entries is more persuasive than twenty generic ones. A long list reads as padding; a short list reads as judgement. The test is whether each entry could only have been written about your business - if a competitor could copy it verbatim, it is not earning its place.
Six things: the risk stated as a mechanism rather than a category, its likelihood, its impact quantified in your own units (margin points, months of runway, share of revenue), the early signal you would observe first, the mitigation with an owner and a date, and the person accountable. The early-signal and owner columns are the ones most often omitted and the ones that most distinguish a real assessment from a table.
It is a weak form of evidence. A colour records how the author feels and cannot be checked, compared or proved wrong. "Roughly one year in three, costing 4-7 points of gross margin" is a claim a reader can argue with, which is what makes it worth something. Use the matrix for internal triage if it helps; do not make it the substance of the section.
A register treats risks one at a time, but plans break when several go wrong together. Replacing single-point assumptions with ranges and running a Monte Carlo simulation samples across all of them repeatedly, producing a distribution of outcomes instead of one number. That is what lets you state the probability of missing the plan, and rank which assumption moves it most.
Incertive turns a plain-language plan into a probability of success, a ranked list of the assumptions driving it, and the changes that most improve your odds.
Try Incertive Today