Business risk is anything that could damage an organisation's results or survival. The main types are strategic, operational, financial, market, credit, legal and compliance, reputational, technological and cyber, health and safety and environmental. Many are linked, so one event can trigger several.
Types of business risk
| Type | What it is | Example |
|---|---|---|
| Strategic | Wrong strategy or failing to adapt | A retailer ignores online shopping |
| Operational | Failures in processes, people or systems | Production breakdown; fraud |
| Financial | Running out of cash; interest and currency changes | A loan cannot be refinanced |
| Market | Changes in demand, prices or competition | A new low-cost rival enters |
| Credit | Customers do not pay | A major customer goes into administration |
| Legal and compliance | Breaking laws or regulations | A UK GDPR fine |
| Reputational | Loss of trust | A social media storm after poor service |
| Technological and cyber | Out-of-date systems; cyber attack | Ransomware shuts down systems |
| Health and safety | Harm to staff or the public | An accident at a site |
| Environmental | Climate and environmental damage | Flooding damages premises |
Strategic vs operational risk
| Strategic | Operational | |
|---|---|---|
| Source | Big decisions and market position | Day-to-day processes and controls |
| Managed by | Board and senior management | Managers, through internal controls |
| Example | An acquisition that fails | Errors in payroll |
Related risks
Chapter 12 of the book explains that risks are often linked. If risks are positively correlated, one rising pushes the other up: a data breach increases reputational and legal risk. If negatively correlated, one rising pushes the other down. Spotting links matters because one event can trigger several risks at once.
From risk to response
Use the risk matrix to assess them and ERM to manage them across the organisation.
Business risk in ACCA SBL
Risk is syllabus area D. Typical tasks ask you to identify and assess the main risks in the case. Name the type, explain the cause and effect using case facts, rank the risks, and recommend a response. For Historic Places (March 2025 pre-seen), examples include falling donations (financial), climate damage to sites (environmental) and volunteer shortages (operational).
FAQs
What is business risk?
The risk of events or decisions that damage an organisation's results or threaten its survival. Business risks are strategic in nature and affect the whole organisation.
What are the main types of business risk?
Strategic, operational, financial, market, credit, compliance and legal, reputational, technological (including cyber), health and safety, and environmental risk.
What is the difference between strategic and operational risk?
Strategic risk comes from big decisions and the organisation's position in its market, and is managed by the board. Operational risk comes from day-to-day processes and controls, such as fraud or system failure.
What are related risks?
Risks that are connected. With positive correlation, when one rises so does the other; with negative correlation, one rises as the other falls. For example, a cyber attack can lead to reputational risk.
How do you manage business risks?
Identify them, assess likelihood and impact, choose a response (avoid, reduce, transfer or accept), and monitor them through a risk register.