What Is Business Risk?
Michael Whitman
·
Trading since 2017, full-time since 2020
·
YouTube creator, 137K subscribers
·
Published 2026-09-14
·
Updated
Business risk is the danger that a specific company fails or underperforms for reasons particular to it, rather than because of the market. It is the one major risk that diversification genuinely removes, which is why holding a single position is not compensated with a higher expected return.
Some risks come from the market and some come from the company. The distinction is not academic — it decides whether you are being paid for the risk you are carrying.
How it works
Business risk is everything that can go wrong at one company. A failed product, a lost contract, a fraud, a factory fire, a regulatory action, a key person leaving.
None of it is about the market. Rates can be falling and the economy healthy while one company collapses for reasons entirely its own.
And crucially, these events are largely independent of each other. One company’s fire has nothing to do with another’s lawsuit — which is exactly the condition diversification requires.
So spreading across many companies genuinely works here. Not approximately, not in normal conditions only — the mechanism holds, because the events really are separate.
Why you are not paid for it
The market prices risk it cannot escape. Bearing market risk earns a premium because everyone is exposed and nobody can diversify it away.
Business risk can be removed at no cost. Buying thirty companies instead of one removes most of it and changes nothing else — so there is no reason for the market to offer extra return for keeping it.
That is the whole argument in one line. Concentration is not rewarded, because anyone could have diversified and most did.
Which does not mean concentration is irrational. Somebody with genuine information about one company is being paid for the information, not for the risk. The distinction matters, and most concentrated portfolios are not held by people with information.
A worked example
Start with the risk nobody can spread away. The S&P 500, holding hundreds of companies at once, still fell 56.8% between its 2007 peak close of 1565.15 and its 2009 low of 676.53 — that is market risk, and every holder took it.
Now picture a single company falling 40% on a product failure. One holding, one event, and the position is down almost half.
Spread across thirty companies at equal weight, the same 40% failure in one of them costs the portfolio about 1.3%. The event was identical; the exposure was a choice.
And the arithmetic of recovery does the rest. A 40% loss needs 67% to get back; a 1.3% loss needs 1.3%. That asymmetry is what risk of ruin works through, and it is why concentration compounds badly rather than merely being volatile.
Where it hides
In funds that hold the same things. Five funds all overweight the same sector is one position wearing five names.
In employer stock. Holding shares in the company that also pays your salary concentrates business risk and income risk in the same entity — the one case where both halves fail together.
In corporate bonds. A single-name bond carries the issuer’s business risk, ranking above shareholders and still exposed to the company existing.
And in a home market. A portfolio entirely in one country’s companies is diversified across firms and concentrated on one economy.
The original data
What is left once the company-specific part is gone? For the S&P 500 from 1950 to 2026, closes below the prior record on 93% of trading days, and after the January 1973 peak a wait of 1,897 trading days for a new one. That residue is market risk; a broad holding strips out the rest.
Diversifying costs something and not much. Thirty positions instead of one means thirty round trips instead of one — at a hypothetical $1 commission each, $30 rather than $1, spent once to remove a risk nobody was paying you to hold.
How many holdings is enough
Most of the benefit arrives early. Going from one holding to ten removes the great majority of company-specific risk; going from ten to thirty removes most of what is left; beyond that the curve is nearly flat.
Which is why “you need hundreds of stocks” is wrong and so is “five is fine.” The useful range for removing business risk is smaller than most people assume and larger than most concentrated portfolios.
But the count is the wrong question on its own. Thirty holdings that all depend on the same customer, the same commodity or the same regulator are not thirty independent exposures — they are one exposure divided thirty ways.
The test is whether the failures would be independent. If one company’s bad news would plausibly arrive alongside another’s, they are not doing separate work in the portfolio, and adding more of the same kind does not help.
How this connects
Market beta measures the half this page is not about. A stock’s sensitivity to the index is the systematic part, and whatever is left over after it is business risk.
Credit risk is business risk seen from the lender’s side, and a default is the moment a company’s own problems become a bondholder’s loss.
Concentration risk is the portfolio-level name for holding too much of it, whether through one stock, one sector or one employer.
An index fund is the cheapest way to shed it, because owning the whole market leaves only the risk that is actually paid for.
Operational risk is one of its main sources: failed processes, systems and people inside the company rather than anything happening in its market.
Borrowing magnifies it. A high debt-to-equity ratio turns a bad year into a solvency question, because interest is owed whether sales hold up or not.
The annual report is where a company describes it, in a section on risks written by the company itself and worth reading before buying a single name.
And an event study measures it after the fact, separating the abnormal return on the day company news arrives from what the market did that day.
When it fails
The characteristic failure is mistaking a concentrated bet for conviction. Holding one company heavily feels like an expression of research and belief, and the position is sized accordingly. But the market does not distinguish between a well-researched concentrated holding and a careless one — it prices the company, and a single adverse event removes the position regardless of how good the analysis was. Being right about a business and wrong about how much of it to own produces the same outcome as being wrong about the business.
A second failure is counting positions rather than exposures. Thirty holdings in one sector is not thirty independent bets.
A third is assuming diversification protects against everything, when it does nothing against systemic risk.
A fourth is diversifying so widely the portfolio becomes the index while still paying active fees.
The question: One position, one company. Paid for that?
And a fifth is holding employer stock as an investment rather than recognizing it as income and capital concentrated in a single point of failure.
One last distinction worth keeping straight. Business risk is sometimes split into operating risk — the volatility of the company’s earnings from its actual operations — and financial risk, which comes from how much debt sits on top. A stable business with heavy borrowing can be a riskier holding than a volatile one with none, and only the second half of that is visible from the share price.
Related
Systemic risk covers the risk diversification cannot touch. Diversification covers the mechanism that removes this one. And corporate bond covers business risk priced as a credit spread.
How few rivals a company faces can be measured with a concentration ratio, which the Census Bureau publishes for hundreds of US industries.
This is the one risk you can genuinely delete for free, and the argument for doing so is not caution — it is that nobody pays you for keeping it. Holding one company instead of thirty takes on a risk the market has already decided is not worth compensating.
— Michael Whitman
This page is educational, not financial advice. Test every idea on your own charts before risking money.