Risk Strategy

Your Budget Is Already a Risk Assessment. You Just Have Not Called It One.

The plan rests on a handful of assumptions that could break it. Risk belongs in the planning process before those assumptions become commitments.

By Eric Kennedy · Thu Aug 13 2026 · 8 min read

The budget says revenue grows eight percent.

Underneath that number sits a set of statements about the world. The top three customers renew at historical rates. The sole-source supplier keeps delivering at current lead times. Three critical hires land by March. Input costs stay inside the range finance modeled. The automation project delivers the savings in its business case. Pricing holds.

Those are not just budget inputs. They are exposures with dollar figures already attached to them, assembled by the finance team, reviewed by the executive team, and approved by the board. The company has just assembled the raw material for one of the most detailed risk assessments it could produce all year, and filed it under planning.

Then, usually a quarter later, someone circulates the risk register.

The sequencing problem

The issue is not that companies fail to think about risk. It is when they do it.

By the time a formal risk review happens, the plan is often locked. Headcount is allocated to specific teams. Capital projects are approved and staffed. EBITDA targets are committed to the board and, in many companies, to management's incentive plan. At that point risk work becomes commentary on decisions that have already been made.

The AICPA and NC State 2025 State of Risk Oversight, a survey of 273 US organizations, found that only 30 percent integrate risk exposure into capital allocation decisions. In the same study, 61 percent said the volume and complexity of risks had changed "mostly" or "extensively" over the prior five years, and only 32 percent rated their risk oversight as mature or robust.

Read those together and the picture is a set of companies that believe risk is increasing, spend considerable effort building financial plans, and mostly do not connect the two.

The assumptions in a plan are wrong in a predictable direction

There is a body of research on this, and it is older and more uncomfortable than most people expect.

Bent Flyvbjerg and colleagues examined 258 transport infrastructure projects across twenty countries and found that 86 percent exceeded their cost estimates. Average overruns ran to 45 percent for rail, 34 percent for bridges and tunnels, and 20 percent for roads. The finding that matters most is not the size of the misses. It is that cost estimates had not improved over the seventy years the data covered.

If the errors were honest mistakes, they would be random, they would fall on both sides of the estimate, and they would shrink as organizations learned. They do none of those things. The authors concluded that the pattern could not be explained by forecasting error, and in that 2002 study they argued that strategic misrepresentation best fit the evidence: estimates get shaped by what needs to be approved. Later work by Flyvbjerg examined optimism bias as a contributor as well, meaning people genuinely expect their own plan to go better than comparable plans went, and proposed reference class forecasting as the corrective. Rather than reasoning from inside your own plan, you look at what happened to a class of comparable efforts and position yours in that distribution.

Two honest limits. This research is about capital projects, not annual operating budgets, and extending it is reasoned inference rather than proof. And the underlying claim is contested: a recent review of the reference class forecasting literature found the evidence for optimism bias mixed, with some studies finding none and a few finding the opposite.

What survives the argument is narrower and still useful. Plans are built from the inside, by the people who want them to work, and the assumptions underneath them are the least examined part of the document.

The Assumption-to-Exposure Test

Integrating enterprise risk management into budgeting means testing the material assumptions underneath the financial plan for exposure, break points, early signals, and pre-agreed decisions before the plan is approved.

You do not need to challenge the whole budget. Most of it is fine, and most of it does not matter much if it moves. What matters is the small number of assumptions that would materially change EBITDA, cash, or the strategic plan if they turned out to be wrong. For each of those, five questions.

1. What are we assuming? Stated plainly, as a sentence someone could disagree with. "Revenue grows eight percent" is a target. "Our top three accounts renew at historical rates and account concentration stays at current levels" is an assumption.

2. What exposure sits underneath it? Name the risk in the business, not the line item. Customer concentration. Single-source dependency. Key-person reliance. Covenant headroom.

3. How wrong can it be before the plan breaks? This is the question that turns a discussion into a decision. Not "is this risky," but at what point does the plan stop working. Losing one top-three account reduces EBITDA by how much. Input costs moving how far erases the margin assumption.

4. What would tell us early? The observable thing that moves before the outcome does. This is where a key risk indicator actually belongs, attached to a specific assumption in the plan rather than floating on a dashboard.

5. What decision changes if it happens? Agreed now, while nobody is under pressure. A hiring pause. A delayed capital release. A pricing action. Drawing on the facility. If the honest answer is that the company would discuss it at the next quarterly meeting, the first four answers were an academic exercise.

What it looks like filled in

The test is worth almost nothing described in the abstract and quite a lot completed. Here is one assumption run all the way through. The figures are illustrative; the sequence is the point.

Assumption. Our top three accounts renew at historical rates and concentration stays where it is.

Exposure. Customer concentration. Those three accounts are 38 percent of revenue.

Break point. Losing one of the three takes EBITDA below the covenant threshold in Q3.

Signal. Renewal stage slipping, usage declining, pricing concessions requested, executive sponsor going quiet.

Decision. Discretionary capital pauses, the account gets an executive owner, and we model the covenant waiver conversation before we need it.

Note what the fifth answer does. It converts a risk conversation into a pre-agreed decision, which means that when the signal appears in month four, the argument about what to do has already happened.

Five places to start

For most mid-market companies, the assumptions worth this treatment sit in the same five places.

The pattern is that all five of these numbers already exist in the plan. Nobody has to build anything to find them. What is missing is the second half of each row: the exposure named, the break point calculated, and the decision agreed in advance.

What this changes about the capital decision

The objection to all of this is that risk management means saying no to things, and a CFO trying to grow a business has heard enough of that.

The most useful result is often not a yes-or-no investment decision. Risk information can change the shape of the investment.

A four million dollar automation project with a high execution dependency does not get rejected because the dependency exists. It gets released in tranches against milestones, with a contingency reserve sized to the realistic downside rather than to a round percentage, and a defined trigger that pauses the next tranche. Same strategic objective, different funding structure. That is a better decision than either approving it as presented or declining it.

This is also what makes the risk work legible to a board. Twenty-five risks with ratings alongside a separate budget presentation gives directors two documents and no connection between them. The plan, the handful of assumptions capable of breaking it, the financial exposure attached to each, and the pre-agreed action is one document that supports a decision. If you are building toward board-ready reporting, this is the version that survives contact with a real agenda.

When to do it

Before the plan is approved, which in most calendars means late summer or early autumn, while the assumptions are still being argued about rather than defended.

The work itself is not large. Five assumptions, five questions, one session with the executives who own the numbers. What makes it hard is not analysis. It is that the conversation has to happen while the answers can still change something, and that is a scheduling decision rather than a risk management one.

Where to Start

If you are heading into a planning cycle and want to know whether your risk process is capable of feeding it, the fastest read is where the reporting stands today.

The KRG scorecard gives you a tier-level assessment in seven questions and about two minutes, with no email required to see your score.

If you want the assumptions in this year's plan tested before it is locked, the Risk Clarity Sprint is a four-to-six week engagement that produces a ranked, owned set of exposures your leadership team can act on.

Take the Board-Reporting Scorecard{.cta-primary} Explore the Risk Clarity Sprint{.cta-secondary}