Risk Assessment and Management

Overview

Amateurs think about risk when something has already gone wrong. Professionals think about it on a schedule, before anything has happened, when their judgment is calm and the stakes are still hypothetical. This practice builds that professional habit: a weekly discipline of looking your venture's downside in the face, scoring it honestly, deciding what to do about it, and tracking whether your decisions are working. It is not about becoming cautious. It is about being able to take bigger, smarter bets because you have understood and contained the downside.

The reason this is a practice and not a one-time lesson is that risk is not static. As your venture grows, old risks fade and new ones appear. A risk assessment done once and filed away is worthless within a month. The value is entirely in the repetition — in building the reflex of asking, every single week, "what could take this down, and have I done anything about it?"

There is a deeper reason it must be a habit rather than an instinct, and it is worth understanding because it tells you when the practice matters most. Human risk perception is driven by emotion, and emotion is calibrated for the ancestral world, not the one you operate in. You will feel intense fear about vivid, rare, dramatic risks — the spectacular failure, the public humiliation — and almost no fear at all about the boring, probable, slow-moving risks that actually destroy most ventures: the customer concentration that crept up unnoticed, the cash runway that quietly shortened, the single dependency nobody wrote down. Your gut is a bad risk instrument. It fires loudly at the wrong things and stays silent on the right ones. The weekly routine exists precisely to override the gut with a process — to force a calm, scheduled, numerical look at downside while your judgment is cool, so that the risks that matter get attention proportional to their actual expected cost rather than to how scary they feel. A founder running on instinct is managed by their amygdala. A founder running this practice is managed by a register. Only one of them survives a decade.

The Skill

You are building the capacity to see and manage downside before it arrives. Specifically: to systematically surface the things that could go wrong in a real venture, to judge each one by likelihood and consequence rather than by how vivid or frightening it feels, to choose a deliberate response to each, and above all to distinguish the risks you can recover from (most of them) from the rare ones you cannot (the only ones that can actually end you). This last distinction — ordinary downside versus ruin — is the single most valuable thing in the practice. People who survive long enough to win are not the ones who avoid all risk; they are the ones who never bet the whole thing on a single uncertain outcome.

Frequency & Duration

• How often: Once a week, on a fixed day. Treat it like a standing meeting with yourself that does not get skipped.
• How long per session: 20-30 minutes. Long enough to think, short enough that you will actually keep doing it.
• Minimum commitment: Eight consecutive weeks. The reflex does not form until you have been surprised at least once by a risk you logged before it bit you — and felt the difference.

The Routine

Warm-Up (3-5 minutes)

Open your risk register. Reread last week's entries before adding anything new. Ask one question of each existing risk: did its likelihood or impact change this week? Ventures move fast; a risk that was minor last week can become urgent because of a decision you made or a change in the world. Update scores before you add anything. This rereading is what keeps the register alive rather than a graveyard of stale worries.

Core Practice (15-20 minutes)

Step 1 — Surface (5 minutes). Brainstorm what could go wrong this week and in the coming months. Push past the obvious. Use prompts to force breadth: What financial exposure do I have? What depends on a single person, supplier, customer, or account? What am I assuming will keep working that might not? What would a competent rival do to hurt me? What happens if my most optimistic assumption is wrong? Write every risk down in plain language as a specific sentence — "our entire revenue comes from one client who has not signed a contract," not "client risk."

Step 2 — Score (5 minutes). For each new or changed risk, assign two numbers on a 1-5 scale:

• Likelihood (1 = very unlikely, 5 = nearly certain): how probable is this in your relevant time horizon?
• Impact (1 = a nuisance, 5 = catastrophic, possibly fatal to the venture): how bad is it if it happens?

Multiply them. A risk scoring 4 × 4 = 16 demands attention now. A 2 × 2 = 4 goes on the list and gets watched. Scoring forces honesty — it stops you from spending all your worry on a vivid-but-unlikely disaster while ignoring a boring, probable one that will actually cost you.

Step 3 — The ruin check (2 minutes). Separately from the scoring, ask of every risk one binary question: if this happens at its worst, can I recover? Most risks, even painful ones, you can recover from — you lose money, time, or a customer, and you continue. A few cannot be recovered from: they end the venture, do lasting harm to your reputation, hurt someone, or wipe out something irreplaceable. Flag every ruin risk, regardless of its likelihood score. A ruin risk with even a small probability outranks any number of high-scoring recoverable risks, because you only have to hit ruin once. This is the asymmetry that ends careers — people optimize for the average case and get destroyed by the one tail they did not protect against.

Step 4 — Respond (5 minutes). For your highest-scoring risks and every ruin risk, choose one of four deliberate responses and write it down:

• Avoid — do not take the action that creates the risk at all. The right call for low-reward ruin risks. (Do not sign the deal that could bankrupt you for a modest upside.)
• Reduce — lower the likelihood or the impact. Add a backup supplier. Keep a cash reserve. Build the redundancy. Most risk work is here.
• Transfer — move the downside to someone equipped to carry it. Insurance is the classic example; so is a contract clause that puts a specific risk on the other party.
• Accept — knowingly carry the risk because the reward justifies it and you can survive the worst case. This is a legitimate, often correct choice — but it must be a decision, written down, not a thing you ignored by default.

The discipline is that every significant risk gets a named response. Unaddressed risks are the ones that take you down, and "I'll deal with it if it happens" is not a response — it is the absence of one.

A worked example

Suppose you run a small web-development business with three clients, one of whom — call them the anchor client — pays for 60% of your monthly revenue on a handshake, with no signed contract. Run the routine on that single fact:

• Surface: "60% of my revenue comes from one client who can stop paying with no notice and no contract obligating them." That is one specific risk, written as a sentence.
• Score: Likelihood that an unsecured anchor client eventually leaves over a long enough horizon? Realistically a 3 or 4 — clients churn, budgets change, relationships sour. Impact if it happens with no warning? A 5 — losing 60% of revenue overnight is close to fatal for a one-person business with no reserve. That is a 4 × 5 = 20. It is now your top risk, ahead of a dozen things that felt scarier.
• Ruin check: Can you recover if it happens? If you have one month of expenses saved, painful but survivable — not ruin. If you have nothing saved and fixed obligations, this is a ruin risk and gets flagged regardless of the score.
• Respond: You will not avoid it — you want the revenue. You can reduce it on two fronts at once: lower the likelihood by getting a contract with a notice period signed, and lower the impact by deliberately acquiring two more clients so no single one is more than a third of revenue. You can partly transfer the cash-flow shock by building a reserve (effectively self-insurance). What you must not do is silently accept it by default, which is what you were doing before you ran the routine.

That is the whole practice in one example: a vague background unease ("I should really get that contract signed someday") became a scored, ruin-checked, response-assigned line item with concrete actions for the week. Multiply that across every exposure in your venture and you have a discipline that quietly removes most of the disasters that end young ventures — not by being lucky, but by having looked.

Notice one more thing the worked example demonstrates, because it is the entire reason to do risk work at all and it is the opposite of what most people assume. The point of running that routine was not to make the designer more cautious. It was to make them able to take the anchor client with confidence — to grow the business aggressively while knowing the one thing that could sink it was being actively contained. Risk management is not the brake. It is the thing that lets you safely press the accelerator. The founder who has mapped and capped their downside can pursue upside far more boldly than the one operating on hope, because they know exactly which bets could end them and have already defused those. Caution and ambition are not opposites here; the discipline is what marries them.

Where Scoring Goes Wrong

The scoring step looks simple and is the place where the practice most often quietly fails. Watch for four specific errors and correct them as they appear.

• Anchoring on the vivid. You will be tempted to score the dramatic risk a 5 on impact because you can picture it in detail. Detail is not probability. The risk you can vividly imagine is usually one you have already half-prepared for; the one that gets you is the one too boring to picture. Score impact by consequence, not by how cinematic the failure would be.
• Scoring to feel better. It is tempting to score a frightening risk low so you can stop worrying about it, or to score everything high so you feel appropriately serious. Both are emotional management dressed as analysis. The number has one job: to rank where your limited attention goes this week. Inflate or deflate it and you have broken the only thing it is for.
• Forgetting the time horizon. A risk that is a 2 over the next month may be a 5 over the next year. Always score against a stated horizon, and re-score when the horizon changes. "Will my key supplier survive?" has a very different answer at one month and at three years.
• Treating the score as the answer. The number prioritizes; it does not decide. A high score tells you to choose a response, not what the response is. Two risks scoring 16 might demand completely different actions — one you reduce, one you transfer, one you might even accept. The score opens the conversation; the four responses close it.

Cool-Down (3-5 minutes)

Log what changed: new risks added, responses decided, actions you committed to take this week. Then close with one reflection question, answered in a sentence: was I surprised by anything this week that I should have seen last week? Over time, the answer to that question is your scorecard. A risk practice is working when surprises get rarer and smaller.

Progression

Tracking Progress

• The number of risks you surface that later materialize and were already on your register — this should rise (you are seeing more), then your surprises should fall (you are acting).
• Your calibration: when you start estimating real percentages, check whether things you called "20% likely" actually happen about 20% of the time. Most people are wildly overconfident; calibration is a trainable skill and the log proves it.
• The ratio of ruin risks that have a named protective response. This should be 100%. Anything less is an unguarded path to a fatal outcome.

Common Plateaus

• Plateau: The register becomes a list of vague worries you reread and never act on. Solution: Force a written response on the top three risks every single week. A risk without a response is just anxiety with a spreadsheet.
• Plateau: You keep getting blindsided by risks you could have foreseen. Solution: Add a structured prompt list to your warm-up (financial, single-point-of-failure, assumption, competitor, optimism risks) and run it every week. Most missed risks come from never asking the category they live in.
• Plateau: You become so risk-aware that you stop taking action — paralysis dressed as prudence. Solution: Reread your purpose. The point of managing risk is to take bigger bets safely, not to take none. If a risk is recoverable and the expected value is positive, accept it deliberately and move. Caution that prevents all action is itself a ruinous risk — the risk of building nothing.

Motivation Tips

• The practice is invisible when it works. You will be tempted to stop because "nothing is going wrong" — but nothing going wrong is the product of the practice, not a sign it is unnecessary. The week you skip it is the week the unguarded risk arrives.
• Keep a short log of risks you caught and contained before they hurt you. On the days the practice feels pointless, reread it. That list is the difference between you and the version of yourself who would have walked into each of those, eyes closed.
• Find a peer also building something and trade risk registers monthly. Naming each other's blind spots is faster than discovering them the hard way, and it makes the practice social instead of solitary.