Chapter 10: Understanding Risk in Small Business

Risk Tolerance

Every business owner brings a different level of risk tolerance, which is the degree of uncertainty or potential loss that a person is willing to accept in pursuit of a goal. Risk tolerance is shaped by financial circumstances, personality, experience, industry, and life stage. A single business owner in their twenties with low overhead may be willing to tolerate more risk than someone supporting a family with a mortgage and employees who depend on them.

There is no “correct” risk tolerance. What matters is that you know your own. Business decisions that exceed your risk tolerance will keep you up at night. Decisions that fall well below it may cause you to be overly cautious and miss real opportunities. Self-awareness about your comfort with uncertainty is one of the most useful assets a business owner can have.

Risk Is Not Optional

One thing is certain: you cannot eliminate risk from business. The FDIC’s Money Smart for Small Business program puts it plainly: risk is present in every business decision, from pricing to hiring to the lease you sign. The goal of risk management is not to eliminate all risk; that is impossible. The goal is to identify the risks that matter most, decide how to respond to them proactively, and reduce your exposure to the ones that could threaten the survival of your business (FDIC & SBA, 2022).

Not all risks are the same, and they do not come from the same places. Some threats originate inside your business, from your people, your processes, or your finances. Others come from the external environment, where you have little or no control. Learning to categorize risk helps you think systematically about your vulnerabilities rather than trying to keep a vague mental list of “things that could go wrong.”

The SBA identifies two broad categories, internal and external risks, and most risk frameworks for small businesses further organize these into several specific types (SBA, 2024a; FDIC & SBA, 2022). The following are the categories most relevant to small business owners.

Strategic Risk

Strategic risk arises from decisions about the direction of the business: your market, your competition, your product or service offering, and your long-term goals. Poor strategic decisions can put the entire business at risk even when day-to-day operations are running smoothly.

Example: When the City of Las Vegas raised street parking rates in the Las Vegas Arts District from $2 to $4 per hour in October 2025, small business owners reported an immediate drop in customer traffic. Becky Miller, owner of Main Street Mercantile, stated that her business was already seeing a downturn in its bottom line. Jeff Hwang, owner of Taverna Costera, pointed to several nearby businesses that had closed or changed hands. The Arts District Neighborhood Association called the impact “disproportionate and negative” on the small businesses that anchor the neighborhood (Las Vegas Weekly, 2026).

Financial Risk

Financial risk involves the possibility of monetary loss due to cash flow problems, credit issues, debt, or poor financial management. Financial risk can be existential for small businesses, which often operate with thin margins and limited reserves.

Common sources of financial risk include slow-paying customers, unexpected expenses, over-reliance on a single client or revenue stream, and taking on too much debt. Cash flow problems are one of the leading causes of small business failure; not because the business was not profitable on paper, but because money was not available when bills came due.

Example: The Sphere at Venetian opened in 2023 as one of the most technologically advanced entertainment venues ever built, at a cost of $2.3 billion. Despite its popularity and cultural impact, Sphere Entertainment reported an operating loss of $480 million in its first fiscal year and was carrying $1.5 billion in debt as of early 2025. The venture illustrates a fundamental financial risk: even a high-profile, innovative business can face serious financial strain when construction costs, debt obligations, and operating expenses outpace revenue, regardless of how impressive the product is (KTNV Las Vegas, 2024).

Operational Risk

Operational risk refers to disruptions to the day-to-day processes of the business. These can stem from equipment failures, supply chain disruptions, employee errors, or the sudden loss of a key person. Operational risks are often unpredictable in timing but highly predictable in type. Almost every small business will experience them.

Example: In February 2026, Chet Buchanan departed 98.5 KLUC after 27 years as the station’s morning host. Buchanan was the face of the station’s annual toy drive, which had raised $60 million over 25 years, and was deeply woven into KLUC’s identity and community presence. The station acknowledged his departure with gratitude but had no immediate succession plan in place. Whether a key employee retires, resigns, or simply moves on, the operational risk is the same: when a business depends heavily on one person and has no plan for their departure, that person’s exit creates a significant gap that can be difficult and slow to fill (FOX5 Las Vegas, 2026).

Compliance and Legal Risk

Compliance risk is the risk of penalties, lawsuits, or reputational damage that result from failing to follow laws, regulations, or contractual obligations. For small businesses, compliance obligations may include tax requirements, employment law, licensing, health and safety regulations, environmental standards, and industry-specific rules.

“Federal, state, and local laws are constantly changing, but you must stay up to date so you can remain compliant,” notes the SBA (2024a). Non-compliance can result in fines, forced shutdowns, and lawsuits that drain resources and damage the business’s reputation.

Example: In January 2026, Aloha Specialties, a nearly 40-year-old Hawaiian restaurant in downtown Las Vegas’s California Hotel, was immediately shut down by the Southern Nevada Health District following a routine inspection that found 31 health code violations, including pest control failures, improper handwashing practices, and unsanitary food contact surfaces. The restaurant was forced to close for a week before passing reinspection. Even a long-established business with decades of community loyalty is not exempt from compliance risk; a single failed inspection can shut the doors without warning (Las Vegas Review-Journal, 2026).

Reputational Risk

Reputational risk is the threat of damage to how your business is perceived by customers, partners, and the community. In the age of online reviews and social media, reputational damage can spread quickly and be difficult to reverse.

Reputational risk can arise from a product defect, a customer service failure, an employee’s public behavior, or even being associated with a supplier that behaves badly. The best defense is building a strong culture of quality and service from the start, so that when something goes wrong (and something will), you have a solid foundation to recover from.

Example: In early 2025, FOX5 Las Vegas reported that multiple Las Vegas Valley restaurants received threatening emails from international scammers, warning that 100 fake one-star reviews would be posted on Google, Yelp, and Facebook unless the businesses paid ransoms ranging from $75 to thousands of dollars. Three local restaurants confirmed receiving the threats and an influx of AI-generated negative reviews from newly created accounts. While Yelp flagged and removed many posts, the incident highlighted how quickly and easily a small business’s online reputation can come under attack through no fault of its own (FOX5 Las Vegas, 2025).

Cybersecurity Risk

Cybersecurity risk has become one of the most pressing concerns for businesses of all sizes. Small businesses are frequent targets of cyberattacks because they often lack the security infrastructure of larger companies. Ransomware attacks, phishing scams, and data breaches can compromise customer data, disrupt operations, and result in significant financial losses.

The SBA recommends checking computer security regularly and staying vigilant against digital threats that can “damage your data and cost you a lot of money to repair” (SBA, 2024a). Practical steps include using strong passwords, regularly updating software, backing up data, and training employees to recognize phishing attempts.

Example: In September 2023, hackers targeted MGM Resorts International using a social engineering attack, specifically a phone call impersonating an employee, to gain access to MGM’s systems across multiple Las Vegas properties. Slot machines, digital room keys, reservation systems, and hotel websites were taken offline for nearly ten days. MGM reported losses of approximately $100 million in the third quarter of 2023. While MGM is a large corporation, UNLV cybersecurity professor Gregory Moody noted that the attack should serve as a warning for all Las Vegas businesses: “It’s not a matter of if you’re going to get hit, but when” (Las Vegas Weekly, 2023).

External and Environmental Risk

External risks originate outside the business and are largely beyond your control. They include natural disasters, economic downturns, changes in interest rates, supply chain disruptions, shifts in consumer behavior, and new competitors entering the market. While you cannot prevent these events, you can prepare for them.

Example: In 2025, Las Vegas small businesses reported a significant drop in foot traffic as tourism declined. A Las Vegas pizza shop owner told reporters his business was struggling as fewer visitors meant less spending in neighborhood establishments. The Nevada Retail Association reported a notable increase in customers using buy-now-pay-later programs even for basic purchases, signaling broader financial strain among consumers. For small businesses in a tourism-dependent economy like Las Vegas, external forces such as shifting visitor patterns or broader economic conditions can directly affect revenue with little warning and no local remedy (FOX5 Las Vegas, 2025).

Knowing the categories of risk is a start. But in practice, small business owners face a long list of potential risks and limited time and resources to address all of them. This is where risk assessment becomes essential. Risk assessment is the process of identifying your specific risks, evaluating their potential impact and likelihood, and prioritizing which ones to address first.

The FDIC’s Money Smart for Small Business curriculum describes this process clearly: begin by listing events or resources that could impact your continued operations and cash flow, then measure each risk by how it would affect those operations if it occurred (FDIC & SBA, 2022). The goal is to move from a vague sense of worry to a specific, prioritized list you can act on.

Step 1: Identify Your Risks

Start by brainstorming all the risks your specific business might face. Use the categories from the previous section as a guide. Be honest. This is not the time for optimism. Think about what could go wrong with your suppliers, your equipment, your staff, your finances, your customers, your technology, and your physical location.

The SBA recommends reviewing your business plan as part of this process and looking carefully at “anything that could halt, slow, or affect the profit of your business” (SBA, 2024a). A practical way to get started is to ask yourself a few pointed questions about your own business:

• What would happen if my top supplier could not deliver?

• What if a key employee left tomorrow?

• What if my revenue dropped by 30% for three months?

• What physical, digital, or legal vulnerabilities does my business have?

• What external events, such as weather, economic shifts, or new competitors, could disrupt my operations?

Step 2: Evaluate Likelihood and Impact

Once you have a list of risks, evaluate each one along two dimensions:

• Likelihood: How probable is it that this risk will actually occur? Consider whether it has happened before in your industry, what conditions might trigger it, and whether warning signs exist.

• Impact: If this risk occurs, how severely would it affect your business? Consider financial loss, operational disruption, damage to customer relationships, and time needed to recover.

Both dimensions matter. A risk that is highly likely but low impact may be less urgent than a risk that is less likely but could be catastrophic. Thinking through both factors keeps you from wasting energy on minor inconveniences while leaving major threats unaddressed.

Step 3: Use a Risk Matrix to Prioritize

A risk matrix is a simple visual tool that plots your risks on a grid based on likelihood and impact. It helps you see at a glance which risks deserve immediate attention (high likelihood + high impact), which can be monitored (lower on one dimension), and which are minor enough to accept without active intervention.

The matrix below uses a 3x3 format, an ideal size for small businesses. Each cell is color-coded: red cells represent high-priority risks that require immediate action; yellow cells represent moderate risks that should be monitored and addressed; green cells represent lower-priority risks that can be accepted or managed with minimal intervention.

Once you have identified and prioritized your risks, the next step is deciding what to do about them. Risk management is the ongoing process of making decisions about how to handle identified risks. There is no single strategy that works for every risk; effective risk management means matching the right strategy to each specific situation.

Four core strategies form the foundation of small business risk management: avoidance, reduction, transfer, and acceptance. In practice, most businesses use a combination of all four.

Strategy 1: Risk Avoidance

Risk avoidance means choosing not to engage in an activity or decision that would expose the business to a particular risk. This is the most straightforward strategy, but it is also the most limiting. If you avoid every risk, you will never take the steps required to grow.

Avoidance is most appropriate when the potential downside far outweighs any possible benefit, or when you lack the resources to manage a risk responsibly.

Example: A Las Vegas wedding photographer with a strong reputation for portrait and ceremony work is approached to provide full audiovisual production services for a 400-person corporate event at the Las Vegas Convention Center. The contract is lucrative, but it would require equipment she does not own, vendors she has never worked with, and deliverables she has no experience producing. She declines. The Las Vegas events industry creates constant opportunities to take on work beyond your current capacity, but the reputational and financial risk of failing to deliver in a market built on referrals and reviews is too high. Choosing not to pursue this contract is risk avoidance: the potential downside significantly outweighs the benefit given her current resources and expertise.

Strategy 2: Risk Reduction

Risk reduction (also called risk mitigation) involves taking steps to decrease either the likelihood of a risk occurring or the severity of its impact if it does occur. This is the most active and proactive of the four strategies.

The SBA recommends a range of best practices for risk reduction, including hiring carefully, training employees well, maintaining safe and well-functioning facilities, keeping software and security systems updated, and staying current with regulatory requirements (SBA, 2024a). Each of these actions directly reduces either the probability or the potential impact of a specific risk.

Other reduction strategies include: diversifying your customer base so no single client represents more than between 20 and 25 percent of revenue, maintaining an emergency fund, cross-training employees so the business can function if someone is absent, and developing a business continuity plan, a written plan describing how your business will continue to operate during and after a disruptive event.

Example: A small restaurant near the Las Vegas Strip knows from experience that the annual Formula 1 Grand Prix weekend will significantly reduce foot traffic and customer access for several weeks. Rather than being caught off guard, the owner proactively reduces inventory orders ahead of race week, schedules fewer staff shifts, and arranges vacation time for employees during the slowest days. Each step reduces the financial impact of a risk the owner cannot eliminate but can prepare for. This is risk reduction: taking deliberate action to lower the severity of a known, recurring risk.

Strategy 3: Risk Transfer

Risk transfer means shifting some or all of the financial consequences of a risk to another party. The most common mechanism for risk transfer is insurance. By paying a premium, the business owner transfers the risk of a large financial loss to an insurance company. Other forms of risk transfer include contracts that shift liability to suppliers, outsourcing functions that carry risk, and forming business entities (like an LLC or corporation) that separate personal assets from business liabilities.

Choosing the right insurance requires understanding your specific industry, location, and operations. Consulting with a licensed insurance professional who works with small businesses is strongly recommended. The right coverage can mean the difference between recovering from a setback and being forced to close permanently.

Example: A Henderson boutique owner carries a Business Owner’s Policy that includes commercial property and business interruption coverage. When a summer flash flood damages her storefront and forces a two-week closure, the insurance policy covers both the cost of repairs and the revenue lost during the closure. Without that coverage, both losses would have come directly out of her own pocket. This is risk transfer: by paying a regular premium, she shifted the financial consequences of an unpredictable event to the insurance company rather than absorbing them personally.

Strategy 4: Risk Acceptance

Risk acceptance means acknowledging a risk and deciding to proceed without additional mitigation, typically because the cost of addressing it outweighs the potential downside, or because the risk is low enough that it does not justify significant resources.

Acceptance is a legitimate strategy, but it must be conscious. There is a significant difference between accepting a risk after careful analysis and simply ignoring it. The FDIC notes that business owners must be honest in reviewing their business for risk and should know the warning signs (FDIC & SBA, 2022). Risk acceptance paired with ongoing monitoring is responsible. Risk acceptance through obliviousness is not.

Example: A food truck owner operating in the Las Vegas valley knows that extreme summer heat will slow business significantly for six to eight weeks each year. After reviewing her finances, she determines the revenue dip is predictable and manageable. Rather than spending money on mitigation strategies that would cost more than the losses themselves, she builds the slow season into her annual cash flow plan and sets aside reserves during busier months to cover fixed costs. She monitors the dip each summer but takes no additional action. This is risk acceptance: a conscious, informed decision to absorb a known risk because the cost of addressing it exceeds its impact.

Business Continuity Planning

A business continuity plan (BCP) is a documented plan that describes how your business will continue operating during and after a disruptive event, whether that is a natural disaster, a cyberattack, the sudden loss of a key employee, or any other serious disruption. The FDIC emphasizes that “a business continuity plan should be part of your overall business plan” (FDIC & SBA, 2022).

A basic continuity plan addresses several key questions:

• What are our most critical business functions, those that if interrupted would most harm the business?

• What is our plan to maintain or quickly restore those functions if disrupted?

• Who is responsible for executing the plan, and does everyone know their role?

• Where are our key records, and how will we access them if our primary location is unavailable?

• How will we communicate with employees, customers, and suppliers during a disruption?

You do not need a lengthy document to have a useful continuity plan. A clear one-to-two page summary that addresses these questions, reviewed and updated annually, can make the difference between a recoverable setback and a business-ending crisis.