Service · Risk Management

Startup Risk Management

What could knock your company off course? We find the risks that can drain your cash or stop your operations, put a number on each one, and agree with you in advance what to do if it happens.

Built for software & SaaS companies, e-commerce businesses and SMEs in any industry, across Europe and English-speaking markets.

Overview

What is startup risk management?

Startup risk management means finding the few events that could stop a company paying its bills or running its operations, sizing each one in cash terms, and deciding in advance what to do about it. DeFiGure maps liquidity, market, operational and counterparty risk, stress-tests your cash position, and sets the policies, owners and warning triggers.

In plain words, a risk is anything that could cost the company cash or stop it operating. Large companies run enterprise risk programmes with committees and long reports. A startup or SME needs something smaller that actually gets used: a short risk register, meaning a list of the top risks, with the cash impact, the likelihood, an owner and an early-warning trigger for each one.

Most serious risks in a young company show up as a cash problem first. Take an illustrative case: one customer brings in a quarter of revenue and starts paying 60 days late. The profit and loss statement looks unchanged, but two months of that customer's payments are missing from the bank. We work out how many weeks of runway (how long your cash lasts at the current burn rate, the net cash you spend each month) that removes, and what you do on the day payments slip 30 days, not on the day the account runs dry.

Capabilities

Which risks do we cover?

Four risk types, each explained in plain words, with what we do about it.

01

Liquidity risk

The risk of not having the cash to pay bills on time, even when the business is profitable on paper. We build a weekly cash forecast, stress-test it against bad scenarios, and size a cash reserve against your burn rate.

02

Market risk

Losses from prices you do not control: exchange rates, interest rates, input costs and demand. We measure your exposure, for example costs in one currency and revenue in another, and decide what to hedge, what to pass on in pricing, and what to accept.

03

Operational risk

Losses from failed processes, people or systems: a payment sent twice, a key supplier stopping, an outage, or one person holding every bank login. We map these single points of failure and add controls such as dual approval on payments.

04

Credit & counterparty risk

Counterparty risk is the risk that someone you depend on fails to pay or deliver: a customer, a supplier, a payment provider, or the bank holding your cash. We review customer concentration, payment terms and how much cash sits with any one bank.

Also included

What does a startup risk management engagement include?

Compliance and financial controls

We set up the basic controls a growing company needs before an audit or a priced funding round: segregation of duties (no single person controls a payment from start to finish), a written approval matrix with spending limits and documented bookkeeping. The close process and reporting themselves are set up under CFO Advisory & Finance Function. We are not lawyers or tax advisers. Where a question is legal or tax, we say so and work alongside your own advisers.

Crisis management

A short crisis plan, written while things are calm: who decides, which payments are protected first (payroll, tax and the core product), which costs are cut in which order, and what you tell staff, customers, banks and investors. Pre-agreed triggers, such as freezing new hiring when runway falls below nine months, mean the hard decisions are already made when the trigger fires.

Risk dashboards

A one-page monthly view: cash and runway, the weekly cash forecast against actuals, customer concentration, overdue receivables, cash held per bank, and the status of each risk on the register. It is built in the tools you already use, such as a spreadsheet or your reporting software, and owned by someone on your team, not by us.

Method

How does DeFiGure run a risk review?

Research first, then advice, then a ranked plan your leadership team can act on.

01

Research first

We read public signals and your own numbers before we advise: interest rates, exchange rates and how your market and competitors are moving, then your bank statements, ledger, contracts, and customer and supplier lists.

02

Rank by cash impact

Each risk gets a cash impact and a likelihood. Sources are shown and limits are stated, and the list is ranked so the risk that could hurt most comes first.

03

Plan and triggers

For each top risk: a first step, an owner, and a trigger that sets off a pre-agreed action, such as tightening payment terms when collections slip 30 days.

04

Monitor and review

A dashboard your team updates monthly, and a review of the risk register every quarter, or sooner after a fundraise, a lost customer or a cost shock.

Read how DeFiGure works, from research to a ranked plan.

Where to start

Liquidity risk management for SMEs: where to start

For most startups and SMEs, liquidity is the risk to fix first, because running out of cash ends a company faster than anything else on the list. We usually work on three things, in this order.

  1. A 13-week cash flow forecast. Cash in and cash out, week by week, for one rolling quarter, so a shortfall shows up weeks before it happens. Our guide explains what a 13-week cash flow forecast is and how to build one.
  2. A downturn stress test. Base, best and worst cases, with combined shocks in the worst case (lower sales, higher costs and late payments at the same time) to find the week cash runs tightest. See how to stress-test a startup's finances for a downturn.
  3. Treasury risk limits. Treasury means where your cash is held and who can move it; the policy itself is written with our Strategic Advisory treasury work. A one-page policy splits cash by when you will need it, caps how much sits at any one bank, and names who approves transfers. See where a startup should keep its cash, and how to manage treasury risk.

Once cash is under control, the next layer is internal controls: the financial controls a scaleup should add before €5M in recurring revenue. And because people, not spreadsheets, make the final call, we also check key decisions for the behavioural biases that distort financial decisions, such as overconfidence in the base case.

Building the full financial model sits with our Forecasting & Modeling service, and finance-function reporting and close processes sit with CFO Advisory & Finance Function. Terms such as runway, burn rate and receivables are explained in the DeFiGure glossary.

FAQ

Questions founders ask about risk and cash

How do you stress-test a startup's finances for a downturn?

Build three versions of a 13-week cash flow forecast: base, best and worst case. In the worst case, combine shocks instead of testing them one at a time, for example a 20% drop in sales, a 10% rise in costs and customers paying 60 days late, with no new funding. The aim is to find the week your cash runs tightest before you reach it, and to agree now what you will do then.

What is a 13-week cash flow forecast and how do you build one?

A 13-week cash flow forecast projects the actual cash coming into and leaving your bank account, week by week, over one rolling quarter. It uses the direct method: expected customer receipts minus payments for payroll, suppliers, rent and tax, each dated to the week it hits the bank. Every week you compare the forecast with the real balance, correct the assumptions that missed, and roll the forecast forward by one week.

How much cash should a startup keep in one bank account?

Keep about one month of operating expenses in your main account for day-to-day payments. Above that, avoid holding more at any single bank than the deposit-insurance limit, which is €100,000 per depositor per bank in the EU and $250,000 in the US. Spread the rest across several banks or insured deposit networks, or hold it in government money-market funds or short-dated government bills, so one bank failure cannot freeze payroll.

What financial controls should a growing company have before €5M in revenue?

Put five controls in place: segregation of duties, so no single person controls a payment from start to finish; a written approval matrix with spending limits; a monthly close with bank and account reconciliations; regular financial reporting to the board; and access controls on banking and accounting systems. These prevent both fraud and honest error, and they are among the first things investors check in due diligence.

What should a startup cut first in a downturn?

Cut discretionary spend that does not touch revenue or product first: events, non-essential software, agency retainers and travel. Freeze new hiring before touching the existing team. Protect payroll and the core product, because failures there end companies fastest. Deferring and renegotiating payments with suppliers and landlords often gains more room than founders expect, and unlike layoffs it can be reversed.

Insights

Related reading on risk, cash and treasury

Guides from the DeFiGure editorial team on liquidity, treasury, downturn planning and financial decisions.

Know your risks before they cost you cash

Tell us what worries you most about cash, customers or suppliers. We reply within 48 hours, and the first 30-minute call is free.