Startups and Risk Management

I've been spending a lot of time thinking about Risk Management in startup companies. No surprises here – risk is an everyday fact when you work with (or in!) startup companies.

From my personal observations, few VCs or startup company executives face these risks explicitly. There is awareness of the possibility of risk but only on rare occasions are the factors stated or discussed. It's a lot like driving a car – you get in and drive away without explicit analysis of the risks you are about to face.

Driving a car, walking on the sidewalk, taking a flight across the country… the sources of risk in everyday life are many-fold and typically ignored because the probability of a catastrophic event is very small.

In practice, there is seldom a single catastrophic event in a company that leads to its failure – failure is the conclusion of a chain of smaller events that went unbroken. Missed deadlines, revenue expectations falling short, a critical miss-hire, unanticipated competitor… the list is long, very long.

Sunday's New York Times Magazine had an article about catastrophes and how to insure against it financially – the article is titled "In Nature's Casino". It's an interesting read because it gives a different perspective on how to consider improbable events (can you say Black Swans????). One part of the article talks about the loss of the RMS Titanic and really stuck in mind (my emphasis added):

"The Titanic offered another lesson for the investor in catastrophe: the threats that seem to us the most remote are those we know the least about. Catastrophe risk is fundamentally different from normal risk. It deals with events so rare that experience doesn't help you much to predict them."

I think this hits one aspect of risk management in startups on the head – if risk is left implicit, little or no effort is made to analyze what could happen. The article continues (my emphasis again):

"How do you use history to judge the likelihood of a pandemic killing off 1 in every 200 Americans? You can't. It has happened only once. (The Spanish flu epidemic of 1918.) You lack information. You don't know what you don't know."

This resonated with my post – The List of 4 Lists a few weeks ago…

Making risk factors explicit, even if they seem extremely remote, is a good habit to get in to and discuss periodically – it helps create a shared perspective of how the company will respond if the risk factors develop into full blown issues. The earlier growing risks are confronted, the more time (and money!) is available to respond to the risk.