Guide to Business Risk Analysis: The Uncomfortable Truth That Nobody Talks About
A guide to uncover hidden dangers that can affect the results of your investment
Investing in the stock market is not easy; we already know that. However, the difficulty is significantly reduced if I pay attention to the risks instead of focusing only on the potential return on an investment.
What can go wrong? why you should NOT invest in a certain company?
These are the questions on my mind when I'm analyzing a company, always looking for risks and red flags to avoid investing.
Introduction
My definition of risk is that of every other value investor. The risk is not the volatility in the share price but the probability of suffering a permanent loss of capital. Warren Buffett frequently cites purchasing Washington Post stock as an illustrative example of investment risk and opportunity.
According to Buffett, risk does not necessarily come from volatility in stock prices but rather from a lack of knowledge or certainty about the economic fundamentals of an investment. When Buffett bought shares of the Washington Post in the 1970s, the market was very pessimistic about the future of newspapers due to several factors, including a difficult business environment.
In Buffett’s view, the Washington Post had a durable competitive advantage and, although the stock price could be volatile in the short term, the true "risk" was very low. In other words, the widespread perception of risk was much higher than the actual risk according to his analysis.
Following the traditional view of risk (well…I don’t know who thinks this anymore), if the share price falls, the risk increases because volatility increases. However, for Buffett, the risk decreases since he is buying the same quality company at a cheaper price.
This is a really important implication because in most financial models they talk about risk as the volatility in the share price. However, when we look at a stock from the point of view of a value investor, what we are trying to avoid is suffering a permanent loss of capital.
There is a very popular phrase that says: "If we take care of the risks, the profits will follow." Let's see why this is so.
Fighting Confirmation Bias
While investing, the human brain often falls victim to various cognitive biases, you probably know that and I’m going to write a big piece on those very soon. In fact, I could write an entire course just focusing on cognitive biases.
However, I think that in the context of investing, one of the most relevant cognitive bias to consider is confirmation bias.
A positive view is already implied in the fact that you decide to actually research a company. If you didn’t think it had potential, then you wouldn’t anlayze it (well, at least if you are running a long only portfolio).
So many times, what happens is that our brain starts searching for data and elements that support our bullish view of that particular stock, even if we don’t realize it. For this reason, it is crucial to take steps to actively counteract this bias.
What I do is to look for exactly the opposite: reasons why I should NOT invest in that specficic company. This could be called an "anti-confirmation bias." By taking this approach, I improve my ability to identify red flags that we might otherwise miss if we don't intentionally seek them.
Sources of Information for the Risk Analysis of a Company
The sources of information to identify the possible risks faced by a company can be varied. Generally, I look at the following:
Review Annual Reports - The risks section of the 10-K will likely include risks identified by the management team. It is useful not only to review the current year but also previous years to evaluate how management has responded to adverse situations.
Examine Annual Reports of Competitors - This helps to understand if there are aspects that we are not considering in the reports of the company we are evaluating.
Search the Internet for Industry Reports - Sector reports can reveal potential risks that affect the entire industry.
Earnings Calls and Investor Presentations – These events include detailed discussions about the company's performance and future risks as well as offering the opportunity to hear questions from financial analysts.
Research by Analysts and Investment Firms - Many firms publish in-depth reports that include risk analysis.
Social Networks and Financial Forums - Sites like X and Reddit can offer non-traditional information and diverse opinions.
Sector Reports - Studies by consulting firms and investment banks provide a broader context to understand risks at the sector level.
Government Regulations and Policies – Keep up to date with changes in laws and regulations that could impact the industry in question.
Interviews and Talks with Management - Although more difficult for the average investor, speaking directly with the management team can offer valuable insights.
Customer and Product Reviews - Customer review and feedback sites may provide information about the quality of the product or service, which could indicate potential risks.
Academic Publications and Case Studies – These can offer in-depth, researched insights into a company or industry.
Intellectual Property Information - Documents such as patents and licenses can provide clues to the company's innovation potential and competitive risks.
How to Process and Track Detected Risks
Ok, if you checked the sources above and did your due dilligence, you may have now a pretty intresting list of risks. So, now what?
Once I have identified all the risks relevant to a particular company, I classify them according to two variables: the probability of occurrence and the severity of the risk. By "severity," I mean the degree to which a specific risk could impact the company's ability to generate profits and, in the worst case, bankrupt it.
The most dangerous risks, and those to which I should pay the most attention, are those with a high probability of occurrence and high severity. These are risks that could have a significant impact on the business. To manage these risks effectively, I use a matrix that tells me how I should track them.
In this matrix, risks are organized according to the mentioned criteria, allowing me to prioritize and take appropriate mitigation measures.
With this matrix in hand, I can quickly get an idea of the amount of work that will be involved in continuously monitoring a company.
Once I have a list of the risks, the frequency with which they should be monitored, and the relevant sources of information, my next step is to prepare a detailed list for the risks with a high probability of occurrence and high severity. In this list, I assign each risk a percentage probability and a degree of severity.
This approach allows me to create different investment scenarios that show the possible outcomes should I decide to purchase shares in the company and the identified risks materialize.
To determine the probability of a risk occurring, I analyze the frequency with which that event has happened in the past for that particular company. I also consider whether the event has occurred to its competitors, which helps me understand how prevalent the risk in question really is. As for the severity of the risk, I focus on evaluating the potential financial cost and the impact it could have on the company's free cash flow.
Examples of Common Risks That Affect All Companies
While each business faces operational risks unique to its industry, below are some that are common to all companies:
Regulatory Risks - Changes in legislation or regulations can significantly affect a company's operations and costs.
Customer Concentration - Reliance on a small number of important customers can make the company vulnerable to fluctuations in demand.
Brand Erosion or Image Crisis - Scandals, bad press, or quality problems can irreversibly damage a company's reputation.
Supply Chain Disruption – Factors such as natural disasters, strikes, or political conflicts can disrupt the supply chain and affect production.
Product Obsolescence – The inability to keep up with market innovations can lead to products becoming obsolete.
Technological Changes - The emergence of new technologies can require significant investments and change the competitive landscape.
Emergence of New Competitors – The entry of new players in the market can reduce market share and affect profits.
If you visit the Investment Checklists section of the site you may be able to download a complete list of thinks I look for while analyzing operational risks.
Final Considerations
While investing in any company, it makes a lot of sense to first consider the potential loss before the potential gain.
Having a list of all possible risks helps to structure the thinking in relation to this topic. Therefore, I always advice creating a matrix and making a list of the most important risks, taking into account the probability of occurrence and the severity of the impact.
I hope this article has helped you increase your confidence as an investor and helps you make more informed investment decisions.
This is a thoughtful representation of what we know today as enterprise risk management. Well done!
Great piece! 🦉