Understanding Business Risks

What are business risks?

Business risks are the threats that can permanently damage a company's ability to earn profits, as distinct from the temporary swings of its share price. This distinction is the heart of the matter. A stock that falls because the market is fearful is a fluctuation; a company that loses its main customer, its technological edge, or its solvency has suffered a real injury to its value.

Value investors care intensely about the second kind and much less about the first. A falling price with the business intact is often an opportunity, because the earning power is unchanged. A rising price hiding a deteriorating business is a trap. The whole point of studying business risks is to tell these apart: to focus on what could impair the company itself, not on what merely moves its quote from day to day. The difference between price volatility and permanent loss is a distinction worth holding onto, because it decides which falling stocks are bargains and which are warnings.

The sections below walk through the five most common categories of business risk. None of them is a reason to avoid investing; every business carries risks, and a company with none would earn no premium return. The goal is to identify the risks clearly, judge how likely and how severe each is, and decide whether the price you pay compensates you for bearing them. Doing so is the mirror image of confirming what makes a great business: quality and risk are two sides of the same judgment.

Concentration risk

Concentration risk is the danger that a company depends too heavily on a single customer, supplier, product, or market, so that losing it would cause serious harm. When too much of a business rests on one point of failure, that point becomes a vulnerability no matter how healthy the rest looks.

Customer concentration is the most common form. A supplier that earns half its revenue from one large buyer is hostage to that relationship; if the buyer switches, cuts orders, or demands lower prices, the supplier has little defense. Supplier concentration works the same way in reverse, when a company relies on a single source for a critical component and has no ready alternative. Product concentration, where one product generates most of the profit, and geographic concentration, where one country or region dominates, round out the picture.

You can often find concentration disclosed directly in the annual report, since companies must reveal when a single customer accounts for a large share of revenue. Watch for the phrasing that a small number of customers represent a significant portion of sales. Concentration is not always a dealbreaker, and some excellent businesses live with it, but it should always be weighed against the price and set against the durability of the relationships. It also interacts with the moat, since a strong competitive position can make even a concentrated customer reluctant to leave, a link explored in identifying competitive advantages (moats).

Disruption risk

Disruption risk is the danger that new technology, new competitors, or changing customer habits erode or destroy a company's business faster than it can adapt. It is the risk that undid some of the most dominant companies in history, and it is often hardest to see precisely when a business looks strongest.

The pattern recurs across decades. A company dominates its market, grows complacent, and is overtaken by a technology or a business model it dismissed or failed to master. Kodak led photography for a century and was undone by the shift to digital, a story told in why Kodak failed. Nokia dominated mobile phones and was overtaken by smartphones, examined in the rise and fall of Nokia. In both cases the disruption was visible in advance to those willing to look, but the incumbent's success made it hard to act.

Judging disruption risk means asking how durable a company's advantage really is against change. Is its moat the kind that technology can leap over, or the kind rooted in brand, network, or switching costs that new entrants struggle to replicate? Is the industry stable or in flux? A business earning high returns today can still be a poor investment if those returns are about to be competed or engineered away. This is why durability, not just current strength, sits at the center of judging business quality.

Financial leverage risk

Financial leverage risk is the danger created by debt, and it is often the most lethal of all business risks because it magnifies every other one. Debt must be serviced in good times and bad, so a company carrying heavy borrowings has far less room to survive a shock of any kind. Leverage turns a survivable problem into a potentially fatal one.

The mechanism is simple and unforgiving. A business with little debt that hits a rough patch, a lost customer, a recession, a regulatory setback, can cut costs, wait, and recover, because it owes little and can ride out the storm. A business with heavy debt facing the same rough patch still has to make its interest and principal payments, and if cash falls short, lenders can force it into distress or bankruptcy regardless of how good the underlying operations are. The same downturn that merely bruises one company can destroy another purely because of the debt on its balance sheet.

This is why leverage deserves scrutiny even in businesses that look strong. Check how much debt a company carries relative to its equity and its earnings, and whether it generates enough cash to cover the interest comfortably. The debt-to-equity ratio is a quick gauge of how much leverage sits under a business. A company that keeps its borrowing modest preserves the freedom to survive surprises and even to act while leveraged rivals are struggling, which is one reason a strong balance sheet is such a quiet asset.

Regulatory and key-person risk

The final two categories, regulatory risk and key-person risk, are less universal but can be decisive for particular companies. Regulatory risk is the danger that government action, new laws, tariffs, price controls, antitrust enforcement, or changed rules, damages a company's economics. Key-person risk is the danger that a business depends too heavily on one individual, usually a founder or a star executive, whose departure would harm it.

Regulatory risk bears hardest on industries where the government sets the rules of the game, such as banking, healthcare, utilities, and increasingly the large technology platforms. A company earning high returns under a favorable regulatory regime can see those returns curtailed by a single ruling. When you assess a business in a regulated industry, the durability of its regulatory environment is part of the analysis, not a footnote, and it can turn an apparently strong business into a fragile one.

Key-person risk matters most in businesses closely identified with a founder or a uniquely talented leader whose judgment, relationships, or vision drive the results. Such dependence can be a strength while the person is present and a serious risk when succession looms. The question is whether the company's advantages are embedded in its systems, brand, and culture, which survive a departure, or in one irreplaceable person, which does not. Both of these risks, along with the others, are typically disclosed in the filing all US public companies must produce, which brings us to where you find them.

How to find risks in the 10-K

The clearest place to find a company's business risks is the risk factors section of its annual 10-K filing, usually labeled Item 1A, where management is required to lay out the threats it considers most significant in its own words. Reading it is one of the most useful and most neglected steps in analyzing a company.

Approach it with a filter, because risk factor sections have grown long and partly boilerplate, with companies listing every conceivable threat to protect themselves legally. Your job is to separate the generic risks that apply to almost any business from the specific, material ones that could genuinely impair this company. A risk factor that names a particular large customer, a specific pending regulation, or a concrete technological threat is worth far more than a vague warning that competition exists. The broader map of company filings and where each fits is set out in SEC filings every investor should know.

Pair the risk factors with the numbers. A disclosed customer concentration means more when you see how much revenue it represents; a mention of debt covenants means more when you check the leverage on the balance sheet. Reading the risks in the company's words, then confirming them against the financial statements, gives you a grounded view of what could go wrong and how badly. That view is the other half of an investment judgment, the counterweight to the search for quality, and it feeds directly into sizing and diversifying a portfolio so that no single risk can sink it.

Where to go from here

Business risks are the threats that can permanently impair a company, and finding them in the 10-K is how you weigh the downside before you commit. From here, see how these risks play out across the economy in understanding economic cycles, and how they feed the full quality judgment in how to identify high-quality businesses. To start reading the risks yourself, open a company's latest filings from its Tenet news and filings view.