Strategic Business Leader · Managing, monitoring and mitigating risk

Types of Risk Faced by Organisations in ACCA SBL

Updated 11 October 2026 · Fact-checked

Organisations face strategic, operational, financial, compliance, reputational, technological and other risks. To handle them in SBL, read the case, find each uncertain event, name its category, explain the cause and effect on this business, and link it to the objectives it threatens. Always apply the risk to the scenario.

Understand Types of Risk Faced by Organisations

A risk is the possibility that something uncertain will affect the organisation's objectives. In most business settings the effect is negative, but risk can also bring opportunity. Risk comes from uncertainty about the future. If you know exactly what will happen, there is no risk.

We group risks into types so that we can spot them and manage them. The main groups are:

Strategic risk: the chosen strategy fails, or the environment changes so the strategy no longer fits. Examples: entering a new market, a disruptive competitor, a failed acquisition.
Operational risk: failure of internal processes, people or systems in day-to-day work. Examples: supply chain breakdown, staff error, fraud, machine failure.
Financial risk: risk linked to money and funding. Examples: exchange rate moves, interest rate moves, credit risk (customers do not pay), liquidity risk, and gearing that is too high.
Compliance risk: breaking laws, regulations, codes or contracts, leading to fines, penalties or loss of licence.
Reputational risk: damage to how stakeholders see the organisation. It is usually a result of another risk, such as a safety failure, a data breach or an ethics scandal.
Technological risk: systems failure, cyber attack, obsolete technology, or failure to adopt new technology.

Other risks you may meet include environmental and climate risk, political risk, human resource risk (loss of key staff), and project risk. Some texts call these sub-types or sources of the main groups.

A common student question is the difference between business risk and financial risk. Business risk is the risk from the nature of the business and its environment: demand, competition, costs, operations. Financial risk is the extra risk to shareholders from how the business is financed and from market prices, such as debt, interest and currency. Business risk exists even with no debt.

Risks overlap. One event can be several types. A data breach is technological, may be a compliance risk (data protection law), and causes reputational damage. In the exam, name the main type, then show the knock-on effects. That shows analysis, which earns professional skills marks.

Key rules to remember

Basic risk definition: Risk = uncertainty about events that affect objectives; Link every risk you identify to an objective of the organisation in the case.
Main risk categories: Strategic | Operational | Financial | Compliance | Reputational | Technological | Other; Use as a checklist when scanning a case. Other includes environmental, political, human resource and project risks.
Business risk vs financial risk: Business risk = from operations and environment; Financial risk = from financing and market prices; Business risk exists with no debt. Financial risk adds to it when debt or foreign currency is used.
Risk description pattern: Cause → Event → Effect on objective; Write each risk in this three-part form so it is specific, not generic.

How to solve Types of Risk Faced by Organisations questions

Use this method for any SBL requirement that asks you to identify, classify or discuss risks in a case.

1Read the requirement. Check whether it asks you to identify, classify, assess or recommend. Note the role you are in and the audience.
2Scan the case for signals of uncertainty: new markets, big debts, foreign suppliers, key people, new systems, regulation, press attention, weak controls.
3List each risk as cause, event and effect, using facts from the case. Do not write generic risks.
4Classify each risk (strategic, operational, financial, compliance, reputational, technological, other). Note any overlap and the knock-on effects.
5Link each risk to the objective or stakeholder it threatens, and say which risks matter most and why.
6Add a brief, practical comment or recommendation if the requirement asks for one, such as a response or a control.
7Write in the required format with short headed points, and show professional skills: analysis, scepticism, commercial awareness.

Quickest way: Scan with a six-letter checklist

When to use it: Use when time is short, or when reading the pre-seen or the exam case for the first time.

Underline every fact that suggests uncertainty as you read.
Tag each underlined fact with S, O, F, C, R or T for the main types.
Pick the three or four risks with the biggest effect on the objectives.
For each, write one line: cause, event, effect, type.
Add one sentence on the knock-on effect, often reputational.

Common mistakes in Types of Risk Faced by Organisations

Listing generic risks such as 'there is a financial risk' without using the case facts.
Students recall the categories from notes and write them down without reading the scenario closely.
Fix: Use the cause, event, effect pattern with a named fact from the case, such as a supplier, a loan or a regulator.
Confusing business risk with financial risk.
Both involve profit and money, so they seem the same.
Fix: Ask: does the risk come from how the business operates and its market, or from financing and market prices? The first is business risk, the second is financial.
Treating reputational risk as a stand-alone item only.
It is listed as a separate category in notes.
Fix: Show how it follows from another event, such as a safety failure or breach, and say which stakeholders react.
Mixing strategic and operational risk.
Both can affect profits and both can involve decisions.
Fix: Strategic risk concerns the direction and position of the whole organisation. Operational risk concerns failures in processes, people and systems during daily work.
Listing risks but not saying which matter most.
Students aim to cover many points and skip prioritisation.
Fix: Rank the risks by likelihood and impact in the case, and explain your top choices. This shows judgement.
Ignoring opportunities and the upside of risk.
Risk is usually taught as a threat.
Fix: Where relevant, note that taking risk can bring returns, and link it to the organisation's risk appetite.

Worked examples

Example 1

Kavya Foods is a food manufacturer. It has just borrowed in a foreign currency to build a new plant. It buys most raw materials from one supplier in another country. Last month a customer complained publicly about a product labelling error. Identify and classify three risks in the case.

Show the solution

Scan for uncertainty: foreign currency loan, single supplier, public complaint about labelling.
Risk 1: the loan is in a foreign currency. If the home currency weakens, repayments cost more. This is a financial risk (currency risk) and it threatens profit and cash flow.
Risk 2: reliance on one overseas supplier. If it fails or delays, production stops. This is an operational risk (supply chain) and it threatens output and customer delivery.
Risk 3: a labelling error shown in public. This may breach food labelling rules, so it is a compliance risk, and it also damages trust, so there is a reputational risk among customers.
Prioritise: the supplier risk and the labelling issue are likely to have the quickest effect on sales, so they need early attention.

Answer: Financial risk: currency exposure on the foreign loan. Operational risk: dependence on one overseas supplier. Compliance and reputational risk: the labelling error, with possible regulatory action and loss of customer trust.

Example 2

A board member says, 'Our company has no debt, so we face no financial risk and our risks are all business risks.' The company sells software to customers in several countries and receives payment in foreign currencies. Comment on this statement.

Show the solution

State the definitions: business risk comes from operations and the market. Financial risk comes from financing and market prices.
Agree with the part that is correct: having no debt removes the financial risk of gearing and interest costs, so the financial risk is lower.
Challenge the rest: the company sells abroad and receives foreign currency. Exchange rate changes affect the value of its income. That is a financial risk, specifically currency risk.
Also note credit risk: foreign customers may pay late or not at all, and this is financial too.
Conclude and advise: the board should recognise these exposures and decide how much risk it will accept.

Answer: The statement is only partly right. No debt removes gearing and interest risk, but currency and credit risks remain from international sales, so the company still has financial risk alongside its business risks.

Exam tips

Always tie each risk to a named fact in the case. Generic lists earn few marks.
Use the category names the examiner expects, then add the effect on objectives to show analysis.
Where a risk has several effects, state the knock-on effect, for example operational failure leading to reputational damage.
Spend a minute prioritising. Say which risks are most significant and why, as this shows commercial judgement.
Match the format asked for, such as a briefing note or email, and keep the tone professional.

Practice questions from Managing, monitoring and mitigating risk

Types of Risk Faced by Organisations: frequently asked questions

What are the main types of business risk in ACCA SBL?

The common groups are strategic, operational, financial, compliance, reputational and technological risk. Others include environmental, political, human resource and project risk. Use them as a checklist, then apply each one to the case.

What is the difference between strategic and operational risk?

Strategic risk affects the organisation's direction and competitive position, such as a failed market entry or a disruptive rival. Operational risk comes from failures in day-to-day processes, people or systems, such as a supply breakdown or staff error.

What is the difference between business risk and financial risk?

Business risk comes from the nature of the business and its environment, such as demand, competition and costs. Financial risk comes from how the business is funded and from market prices, such as debt, interest rates and currency.

How do I identify risks in an SBL case study?

Read the case and mark facts that suggest uncertainty, such as new markets, debt, single suppliers, new systems, regulation and public attention. Write each as cause, event and effect, classify it, and link it to an objective.