In 1986, the engineers at NASA's Marshall Space Flight Center knew something was wrong with the Challenger launch. The night before the scheduled liftoff, a group of engineers at Morton Thiokol, the contractor responsible for the solid rocket boosters, presented data showing that the O-ring seals had never been tested at the temperatures forecast for launch day. They recommended a delay. The recommendation was overruled. The following morning, seventy-three seconds after launch, Challenger broke apart over the Atlantic Ocean.
The Rogers Commission, which investigated the disaster, did not conclude that nobody had identified the risk. The risk had been identified, documented, and discussed. What failed was not the risk identification process. What failed was the organizational willingness to act on what the risk assessment was telling them.
This story is not about NASA. It is about the difference between going through the motions of risk assessment and actually using it as a decision-making tool. The distance between those two things is where projects fail.
Why Owners Avoid the Conversation
The reluctance to engage seriously with risk is not irrational. It has a logic to it, and understanding that logic is the first step toward replacing it with something more useful.
The most common reason is emotional. A project that has generated excitement, that has passed validation, that has a compelling business case, feels like something to protect. Spending serious time on what could go wrong feels like an act of disloyalty to the idea, or worse, like inviting failure by giving it too much attention. There is a superstitious quality to the avoidance that most owners would not admit to but many recognize when it is named.
The second reason is practical. Risk assessment, as it is typically presented in project management literature, looks like work. Probability matrices. Impact scores. Risk registers with dozens of entries. For a small business owner who is already wearing too many hats, the prospect of adding a structured analytical exercise to an already crowded plate is genuinely unappealing.
The third reason is experiential. Many owners have sat through risk assessment exercises in corporate settings that produced lengthy documents nobody read and changed nothing about how the project was executed. The skepticism that results from those experiences is earned. Bureaucratic risk assessment is not useful. But the answer to bureaucratic risk assessment is not no risk assessment. It is better risk assessment.
What Risk Assessment Actually Is
Strip away the matrices and the registers and the formal language, and risk assessment is a simple discipline: before you commit, think carefully about what could go wrong, how likely it is, how serious it would be, and what you would do about it.
That is the entire framework. Everything else is detail.
The value of the exercise is not that it prevents bad things from happening. Projects encounter unexpected problems regardless of how carefully they were planned. The value is that it converts surprises into scenarios. A problem you have thought about in advance, even loosely, is a problem you can respond to with some degree of composure and direction. A problem that arrives without any prior consideration tends to produce panic, poor decisions made under pressure, and the particular paralysis of not knowing which way to turn.
The Challenger engineers who identified the O-ring risk were not wrong to identify it. They were failed by a system that did not act on what they found. For a small business owner, that system is you. You are the engineer and the decision maker simultaneously. The risk assessment you conduct is the one you will use, which means it needs to be honest rather than comprehensive, and practical rather than formal.
The Six Areas Where Risk Actually Lives
Project risk for small businesses tends to concentrate in six areas. They are not equally likely or equally serious for every project, but they are consistent enough across different types of businesses and different types of projects that examining each one deliberately will surface the vast majority of meaningful risks before they become expensive surprises.
Market Risk
This is the risk that the demand you are counting on does not materialize the way you expect. It is closely related to the validation work discussed earlier in this series, but it goes beyond validation. Validation tells you whether demand exists today. Market risk asks what could change that would affect that demand tomorrow.
Consumer behavior shifts. Economic conditions change. A competing product enters the market. A regulatory change alters the landscape. A trend that was driving demand reverses. None of these are reasons to abandon a well-validated project. All of them are worth naming as possibilities and thinking through in terms of what you would do if they occurred.
Financial Risk
This is the risk that the numbers do not work the way you planned. It is the most commonly discussed risk category and also the one most often examined superficially. Owners tend to focus on whether the revenue projections are achievable and spend less time on the scenarios where costs exceed estimates, revenue arrives later than expected, or the cash flow timing creates a gap that the business cannot bridge.
The financial risk question is not just "will this be profitable?" It is "what happens to the business if this takes twice as long to generate revenue as I am planning, and costs thirty percent more to execute?" The answer to that question tells you how much runway you actually need, which is almost always more than the initial estimate suggests.
Operational Risk
This is the risk that something in the execution breaks down. A key supplier fails to deliver. A critical team member leaves. Equipment breaks at a bad moment. A process that worked at small scale does not work at larger scale. A technology dependency turns out to be less reliable than assumed.
Operational risks are often the most predictable and the most neglected. They tend to be unglamorous — nobody wants to spend time planning for the possibility that their packaging supplier has a four-week backlog — but they are frequently the risks that actually derail projects that were otherwise well conceived.
Competitive Risk
This is the risk that the competitive landscape changes in ways that affect your position. A well-funded competitor enters your market. An existing competitor copies your approach. A technology shift makes your advantage less relevant. A new business model disrupts the category you are operating in.
The competitive risk conversation is not about predicting the future. It is about honestly assessing how durable your advantage actually is and what you would do if it came under pressure sooner than expected.
Personal Risk
This is the risk category that project management frameworks almost never address and that small business owners most need to examine. Because in a small business, the project and the person running it are not separate systems. They are the same system.
What happens to the project if you get sick? If a family emergency demands your attention for an extended period? If the personal financial pressure of a project that is taking longer than planned becomes unsustainable? If the energy and focus required to drive the project forward while simultaneously running the existing business proves to be more than one person can sustain?
These are not comfortable questions. They are essential ones. A project plan that does not account for the human capacity of the person executing it is not a realistic plan. It is an optimistic one.
External Risk
This is the risk that factors entirely outside your control affect the project. Regulatory changes. Economic downturns. Supply chain disruptions. Technology shifts. Geopolitical events that affect your market or your inputs.
External risks are by definition the hardest to manage because they are the least within your control. The appropriate response is not to try to predict them but to build enough flexibility into the project plan that the business can adapt when the unexpected arrives, as it always does.
The Question That Changes Everything
For each of the six risk areas, there is a sequence of three questions that turns a vague worry into a manageable scenario.
The first question is: what specifically could go wrong here? Not in general terms. Specifically. Not "demand might be lower than expected" but "the corporate clients I am targeting might reduce their discretionary spending in response to an economic slowdown, cutting my addressable market by forty percent in the first year."
The second question is: how likely is this, honestly? Not a precise probability. A gut-level honest assessment. Is this something that happens regularly in businesses like mine? Is there evidence in the market right now that makes it more or less likely? The goal is not precision. The goal is honest relative weighting.
The third question is: what would I do if this happened? This is the most important question and the one most often skipped. It forces the owner from passive worry into active planning. It converts a risk from a threat into a scenario with a response. And it reveals, in many cases, that the thing they were most worried about is something they could actually handle, which is more useful than any amount of probability estimation.
What Good Risk Assessment Looks Like in Practice
It does not look like a spreadsheet. It does not look like a formal document. For a small business owner planning a project, it looks like an honest conversation, either with yourself or with a trusted advisor, that works through each of the six areas with genuine candor.
It takes two to three hours for a moderately complex project. It produces a short document, perhaps one page, that names the significant risks, assesses them honestly, and describes a response for each one. It is revisited as the project progresses and new information arrives.
The owners who do this work consistently describe the same experience. Not that it prevented everything from going wrong. But that when things went wrong, they had already thought about it, and that made the difference between a setback that was managed and one that became a crisis.
What Comes Next
Naming your risks is the first part of the risk conversation. The second part is understanding which ones deserve the most attention, and why the risks that actually derail projects are so often not the ones that were most prominent in the planning stage.
That conversation starts with the one risk category that small business owners understand the least and worry about the most: financial risk. The numbers tell a story. Learning to read it clearly, without an accounting degree, is one of the most practical skills a small business owner can develop.
That is where we are headed next.