Business risk and profitability

Abstract#

This chapter examines the relationship between business risk and profitability — from the origins of the concept to contemporary quantitative models and to behavioural finance, which explains why real decisions depart from those models. The theoretical part traces the development of the concept of risk through several fundamental breakthroughs: Knight’s distinction between risk and uncertainty (1921), Markowitz’s portfolio theory and variance as a measure of risk (1952), Sharpe’s capital asset pricing model and the beta coefficient (1964), Kahneman and Tversky’s prospect theory and the behavioural finance revolution (1979), and the “fat tails” critique of Mandelbrot and Taleb. This historical development is synthesised into a system of five levels of risk ontology (probabilistic, loss, systemic, behavioural, ontological-organisational), which shows why different participants assess one and the same situation in fundamentally different ways. The chapter presents the dichotomy of systematic and unsystematic risk together with its limits (the problem of shifting correlations in a crisis, “diworseification”), and a classification of business risks by origin and by the scope for managing them, including reputational risk, systemic digital risk and the cascading of risks. It then turns to risk management systems (ISO 31000, COSO ERM) and to ESG as a two-way dimension of risk — both an instrument for reducing risk and an additional source of risk.

The central thesis of the chapter is that business risk is not merely an external list of dangers or a statistical volatility. It is a multi-layered phenomenon covering the objectively measurable dispersion of outcomes, the subjective perception of decision-makers and the institutional context in which risk is transformed into acceptable profitability. Profitability is compensation for risk that has been assumed and correctly assessed, yet this relationship is not constant. The risk premium depends on the phase of the economic cycle, and the beta coefficient is unstable over time, particularly in the small and illiquid markets of the Baltic States and of Central and Eastern Europe. Understanding this relationship requires quantitative models (CAPM, multi-factor models) to be combined with a qualitative perception of uncertainty and with the recognition of seven cognitive biases — from overconfidence to herd behaviour and the planning fallacy.

The analytical part presents the basic instruments for measuring risk and profitability: the standard deviation, beta, CAPM, portfolio variance, the Sortino and Sharpe ratios, the coefficient of variation and the country risk premium. These are illustrated by two case analyses — an assessment of the risk profile of a Lithuanian manufacturing company and an analysis of the behavioural biases of a technology start-up — together with instructions for building an Excel model. The chapter is directly linked to the ontological decomposition of value in Chapter 1 (particularly the risk layer) and to the planning process and the sensitivity of assumptions in Chapter 2. It also prepares the ground for Chapter 4 (methods and indicators of risk analysis), Chapter 5 (diversification and specialisation), Chapter 9 (the analysis of financial statements), Chapter 11 (WACC and the cost of capital) and Chapter 14 (real options and special cases of valuation).

Learning outcomes#

After reading this chapter and completing the exercises, the reader will be able to:

1. Recognise which of the five risk ontologies a particular risk assessment belongs to and whose perspective it reflects, and name the four risk management strategies together with the instruments characteristic of each (recognition).
2. Explain Knight’s distinction between risk and uncertainty and state the conditions under which quantitative models become deceptively precise (comprehension).
3. Calculate the standard deviation, the beta coefficient, the CAPM required return, portfolio variance, the Sortino and Sharpe ratios, the coefficient of variation and CAPM with a country risk premium, and interpret the result for a decision (application).
4. Analyse the assumptions of a risk assessment: distinguish systematic from unsystematic risk, recognise the limits of the normality assumption and identify seven cognitive biases in the text of a business plan (analysis).
5. Justify whether a particular hedging decision creates value for the firm, taking into account the assumptions of Modigliani and Miller, transaction costs and at least one of the three channels of value creation (analysis).
6. Construct the risk profile of a firm in which several different measures are applied to the same data, and explain why their conclusions do not coincide (synthesis).
7. Assess whether the assumptions of CAPM are satisfied in a particular situation, and justify what additions are needed when valuing a private business in a thin market (evaluation).

3.1 Theoretical part#

3.1.1 Historical and conceptual context#

Why the history of risk matters to the business planner#

Risk today looks like a self-evident category of business planning — every business plan has a “risk” section, and every financial model provides for a discount rate that indirectly reflects a risk premium. Yet what we now call “business risk” is the result of several centuries of intellectual evolution, and understanding that evolution is not mere academic curiosity.

The different schools of risk — the quantitative (statistical), the behavioural (psychological) and the ontological (philosophical) — did not replace one another in sequence; they coexist in contemporary practice. A manager who reduces risk to a single figure (a standard deviation or a beta coefficient) and ignores the psychological and institutional dimensions runs the risk of creating an illusion of “mathematical safety”. An entrepreneur who rejects any quantitative assessment of risk “because the numbers do not reflect reality anyway” loses the ability to structure decisions and to compare alternatives. Both make the same mistake — they apply one paradigm where several are needed.

The purpose of this section is to trace how the concept of business risk was formed and changed, and to show that effective contemporary risk assessment is a synthesis of several intellectual traditions, in which quantitative models, behavioural insights and institutional perspectives do not compete but complement one another.

The pre-classical period: from fatalism to calculation#

Etymologically the word “risk” derives from the Italian risicare — “to dare” — or from the Arabic risq, denoting that which is allotted from heaven (Bernstein, 1996). In the medieval context risk was inseparable from maritime trade: the loss of a ship in a storm was the principal source of business uncertainty. The first insurance contracts, which appeared in fourteenth-century Genoa, formalised the transfer of risk as an economic operation — this was the first step from a fatalistic understanding of risk towards an instrumental one.

The intellectual breakthrough came in the seventeenth century, when Blaise Pascal and Pierre de Fermat created the theory of probability and Daniel Bernoulli (1738) formulated the concept of expected utility. In solving the famous St Petersburg paradox, Bernoulli showed that a rational decision-maker evaluates not the absolute gain but its utility, which diminishes as wealth increases (diminishing marginal utility). This was the first formal model of risk aversion — it explained why people choose a smaller but guaranteed sum rather than a larger expected value accompanied by uncertainty (Bernoulli, 1738/1954). Bernoulli’s line of thought matters because it helps to understand why the relationship between risk and return in later financial theory became inseparable from the assumption of risk aversion.

Knight’s breakthrough: risk versus uncertainty (1921)#

The formal analysis of business risk was begun by Frank Knight in his 1921 work Risk, Uncertainty and Profit, in which he formulated one of the most fundamental distinctions in the history of economics and management:

• Risk is a situation in which the probabilities of the possible outcomes are known or can reasonably be calculated from experience. An insurance company holding 100 000 policies, for example, can forecast the size of its annual payouts fairly accurately.
• Uncertainty is a situation in which neither the possible outcomes nor their probabilities are known. An example is forecasting the market acceptance of an entirely new product category (the first smartphone in 2007).

Knight argued that business profit arises precisely from uncertainty and not from risk: measurable risk can be insured or diversified, and therefore yields no lasting economic rent. The function of the entrepreneur is to take decisions under conditions of uncertainty, where others are unwilling or unable to do so (Knight, 1921).

Knight’s distinction matters for three reasons. First, it shows that not all indeterminacy is of the same kind — and that different situations therefore require different management instruments. Second, it explains why standard financial models (DCF, Monte Carlo simulations, sensitivity analysis) work well in the zone of risk but become deceptively precise in the zone of uncertainty — which connects directly with the phenomenon of spurious precision discussed in Chapter 2. Third, it helps to distinguish situations in which risk can be diversified or insured from those in which it cannot. A new product in an unknown market, a geopolitical rupture, a regulatory revolution or a technological upheaval are often closer to Knightian uncertainty than to stochastic risk.

Markowitz: risk as variance (1952)#

Harry Markowitz’s article Portfolio Selection, published in 1952 in The Journal of Finance, fundamentally changed the science of finance — risk ceased to be an intuitive “sense of danger” and became a mathematically defined object. Markowitz proposed three revolutionary ideas:

1. Measuring risk by variance (or by the standard deviation) — the dispersion of returns around the expected mean.
2. The portfolio effect — by combining assets whose returns are not perfectly correlated, the overall risk of the portfolio can be reduced without reducing the expected return.
3. The efficient frontier — the curve of optimal portfolios, above which a higher return cannot be obtained without assuming additional risk.

Markowitz’s principal insight is that what matters to an investor is not the risk of an individual asset in itself but its contribution to the risk of the whole portfolio. Risk depends not only on the dispersion of individual outcomes but also on the correlation between the returns of the assets. This idea became the theoretical foundation of diversification (Markowitz, 1952).

Markowitz’s model, however, rests on strong assumptions: returns are normally distributed, investors consider only the mean and the variance (mean-variance), and the correlations between assets are stable over time. Each of these assumptions later became the object of serious academic criticism — yet the principle of variance as a measure of risk became the “basis of the language” of financial theory, used even where its assumptions are not strictly satisfied.

Sharpe, Lintner and Mossin: asset pricing and systematic risk (1964)#

Markowitz’s portfolio theory was normative — it indicated how a rational investor ought to construct a portfolio. William Sharpe (1964), John Lintner (1965) and Jan Mossin (1966) independently transformed it into a positive theory — how the market prices risk. The Capital Asset Pricing Model (CAPM) they created formulated two fundamental propositions:

1. The market compensates only systematic risk — that part of risk which cannot be eliminated by diversifying the portfolio. Unsystematic (specific, idiosyncratic) risk can be removed by the investor at no cost whatever.
2. The beta coefficient ($\beta$) is the only significant measure of an asset’s risk — it shows the sensitivity of the asset to movements of the market.

This breakthrough matters not only for financial markets but also for business planning: if a particular risk can be reduced by diversification, it should not be valued in the same way as risk arising from the economy as a whole, from interest rates or from geopolitical tension. CAPM introduced a disciplined language about which risks the market pays for and which it does not. The application of CAPM to the calculation of the discount rate and of the weighted average cost of capital (WACC) is discussed more fully in Chapter 11 (Sharpe, 1964).

The behavioural breakthrough: prospect theory (1979)#

All the models discussed so far rested on the assumption of a rational agent — the investor maximises expected utility, the assessment of risk is objective, and the market price reflects all available information. Daniel Kahneman and Amos Tversky’s prospect theory of 1979 fundamentally shook this assumption by showing how people actually take decisions under conditions of risk:

• Loss aversion: a loss psychologically “weighs” roughly 2–2.5 times more than an equivalent gain. An entrepreneur who may either win or lose EUR 100 000 evaluates this gamble psychologically as a losing one, although mathematically its expected value is zero.
• Reference dependence: decisions are evaluated not by the final position of wealth but by changes from a reference point.
• The probability weighting function: people overweight small probabilities (which is why they buy lottery tickets and insurance against rare catastrophes) and underweight medium and large probabilities.

The significance of prospect theory for business planning is practical: it explains why managers systematically forecast revenue too optimistically (overconfidence), why projects in which losses have already been incurred are continued for too long (the sunk cost fallacy), and why the assessment of risk in an organisation is never entirely “objective” (Kahneman & Tversky, 1979). These biases are examined in more detail in section 3.1.3.

Mandelbrot and Taleb: the “fat tails” revolution#

Classical financial models rely on the normality assumption to differing degrees: Markowitz’s portfolio theory needs only the mean and the variance (normality is convenient but not a necessary condition), the Black-Scholes model assumes a lognormal distribution of prices, that is, normal logarithmic returns, while CAPM does not formally require normality, although its empirical tests and risk measures do rely on it. What they have in common is that all of them cope badly with fat tails. As early as 1963 Benoît Mandelbrot, studying series of cotton prices, showed empirically that their changes have “fat tails” — extreme events occur far more often than the normal distribution predicts (Mandelbrot, 1963). Later studies found the same regularity in the markets for equities, currencies and commodities.

Nassim Nicholas Taleb extended this line of criticism to the epistemological level: his concept of the Black Swan describes rare, unpredictable but powerful events that change an entire system. Taleb argues that standard risk management models create a deceptive sense of security: they work well between black swans, but they are powerless against the swans themselves (Taleb, 2007).

Figure 3.1. The evolution of the concept of risk: the principal intellectual breakthroughs

timeline
    title The development of the concept of risk in financial theory
    1738 : Bernoulli
         : Expected utility
         : Formalisation of risk aversion
    1921 : Knight
         : Risk and uncertainty
         : The origin of entrepreneurial profit
    1952 : Markowitz
         : Portfolio theory
         : Variance as a measure of risk
    1963 : Mandelbrot
         : Fat tails
         : Criticism of the normality assumption
    1964 : Sharpe, Lintner and Mossin (CAPM)
         : Systematic and unsystematic risk
         : The beta coefficient
    1979 : Kahneman and Tversky
         : Prospect theory
         : Loss aversion
    2007 : Taleb
         : Black swans
         : The impact of unpredictable events

These intellectual traditions form the conceptual foundation on which business risk can be analysed from several perspectives. None of them is sufficient on its own: Knight reminds us that not all uncertainty can be calculated; Markowitz and CAPM provide a quantitative language; Kahneman and Tversky show that people systematically depart from quantitative logic; Mandelbrot and Taleb warn that even quantitative logic itself rests on assumptions that may collapse. The contemporary business planner must be able to combine all these perspectives — that is the central message of Chapter 3.

The pluralism of risk ontologies: five levels#

The historical development reveals not one but several competing ontologies of risk — different answers to the question “what is risk?” These ontologies complement rather than replace one another: Miller and Reuer (1996) present measures of loss as an alternative to the variance-based approach, but nothing prevents the two from being used together. Nor is the distinction between risk and uncertainty binary — De Groot and Thurik (2018), who examined risk measurement tasks in behavioural experiments, argue that the continuum between them is the very object of measurement, and that in real life uncertainty is encountered more often than measured risk. Synthetically they can be grouped into five levels:

1. The probabilistic level: risk as a distribution of possible outcomes. This is the paradigm of Markowitz and CAPM — risk is measured by variance or by the standard deviation.
2. The loss level: risk as the probability and the magnitude of undesirable outcomes. Here the asymmetric side is emphasised — VaR, CVaR, the Sortino ratio.
3. The systemic level: risk as a relationship with the wider economic and organisational environment. This is CAPM beta, but also systemic contagion risk, which cannot be eliminated by diversification.
4. The behavioural level: risk as the perception and assessment of decision-makers. The paradigm of Kahneman and Tversky — reference dependence, loss aversion.
5. The ontological-organisational level: risk as structural vulnerability and as a constraint on value creation. Here managerial judgement, the institutional context and organisational culture are integrated.

This fivefold system explains why the same situations can be assessed in very different ways: to a bank analyst risk is variance (level 1), to an insurer it is the probability of loss (level 2), to a macroprudential regulator it is a systemic threat (level 3), and to an entrepreneur it is personal perception and organisational preparedness (levels 4–5).

The social and cultural context of risk perception#

The assessment of risk is not merely an individual cognitive process — it is shaped by social identity, the cultural environment and the information space. Stapel et al. (1994) showed that belonging to a social group changes the perception of risk through the availability heuristic: events observed in one’s immediate environment are judged to be more probable. Vaughan and Seifert (1992) found that the same object of risk may be interpreted differently depending on how it is framed — which has a direct implication for the communication of business plans: the information about risk presented to investors is not “objective”, it is always framed. Kahneman and Tversky’s (1979) prospect theory supplements this perspective: low-probability, high-impact events are psychologically structured differently from everyday sources of risk — probabilities are weighted non-linearly, which explains why organisations react disproportionately to “vivid” risks and ignore latent ones.

3.1.2 Principal theories and models#

Systematic and unsystematic risk: the logic of diversification#

One of the most important contributions of CAPM is the formal decomposition of risk into two fundamentally different components:

• Unsystematic risk (idiosyncratic risk) is specific to a particular firm or sector. Examples: the unexpected departure of a manager, a fire at a plant, a product recall, the loss of a single major customer. This risk is eliminated by diversifying the portfolio — negatively correlated or uncorrelated assets “smooth out” each other’s fluctuations.
• Systematic risk (market risk) affects the whole market or economy. Examples: changes in interest rates, inflation, recession, a pandemic, geopolitical shocks. This risk cannot be diversified away — and it is precisely for it that the market compensates with an additional return (a risk premium).

Formally, the variance of an asset’s return is decomposed as:

where $\beta_i^2 \sigma_m^2$ is the systematic risk component and $\sigma_{\varepsilon_i}^2$ is the unsystematic risk component.

The implication for business planning. A diversified investor in the financial markets prices only systematic risk. The owner of a private business, however, whose wealth is concentrated in a single firm, cannot diversify unsystematic risk — and therefore effectively bears a higher risk premium. This problem is particularly relevant when valuing private businesses (Chapter 14) and when planning exit strategies (Chapter 18), where the possibility of diversification is one of the factors that creates value.

Diversification has limits which, in a business context, are often more important than in portfolio theory. First, during crises the correlations between assets rise dramatically — precisely when diversification is most needed (Campbell, Koedijk & Kofman, 2002). This is particularly relevant to international diversification, about which there is an open dispute in the finance literature. The classical argument holds that investing in different countries reduces the risk of a national economy, because national cycles do not coincide. The counter-argument is that as markets integrate their correlations increase over time, and during crises they increase still further, so that international diversification yields the least benefit precisely when it is most needed. For Lithuanian business a practical conclusion follows from this dispute: diversifying export markets reduces the demand risk of a particular market, but it does not protect against a general European downturn. These are two different layers of risk, and in plans they are often treated as one. Second, excessive diversification of a business may reduce value through the loss of managerial attention and the dispersion of resources — this is called the conglomerate discount; Berger and Ofek (1995) found that diversified firms trade at a discount of roughly 13–15 % compared with the sum of the specialised businesses.

Peter Lynch, together with John Rothchild (1989), called this problem “diworseification” in One Up on Wall Street — a play on the words diversification and worse, denoting a situation in which diversification does not reduce risk but destroys value. (In the later literature the shortened form diworsification became widespread; here Lynch’s spelling is used.) The principal mechanisms are increased managerial complexity, a lack of synergies and the inefficient allocation of capital. This is an important warning for business planners, and it is worth formulating precisely. Portfolio diversification reduces unsystematic risk — that is the content of formula (3.4). But corporate diversification creates value for the shareholder only when it delivers what a diversified investor cannot achieve alone in their own portfolio: synergies, cheaper capital or new capabilities. If there is no such increment, all that remains is increased managerial costs, and that is exactly what “diworseification” is. Decisions on diversification and specialisation are discussed more fully in Chapter 5.

The risk–return relationship: CAPM and its extensions#

A fundamental principle of finance states: an investor demands compensation for the risk assumed. This compensation is called the risk premium:

CAPM formalises this principle so that the risk premium depends only on systematic risk, measured by the beta coefficient:

where $R_f$ is the risk-free rate, $\beta_i$ is the sensitivity of the asset to market movements, and $E(R_m) - R_f$ is the equity risk premium (ERP). The interpretation of beta: $\beta = 1$ means that the asset moves with the market; $\beta > 1$ means it is more sensitive than the market; $\beta < 1$ means it is less sensitive.

Empirical research, however, has revealed systematic anomalies that CAPM is unable to explain. Eugene Fama and Kenneth French (1993) proposed a three-factor model, supplementing the market factor with two empirically grounded risk factors:

• SMB (Small Minus Big) — the difference in returns between small and large firms (the size premium).
• HML (High Minus Low) — the difference in returns between firms with a high and a low book-to-market ratio, that is, the ratio of the accounting book value of equity to its market value (the value premium).

In 2015 Fama and French extended the model to five factors, adding profitability (RMW — Robust Minus Weak) and investment (CMA — Conservative Minus Aggressive). Whether the additional factors reflect compensation for risk or market inefficiency remains an open question: Fama and French interpret them as risk factors, while proponents of behavioural finance argue that they are a consequence of investors’ cognitive errors (Fama & French, 1993, 2015; Lakonishok, Shleifer & Vishny, 1994).

An alternative to the CAPM approach was proposed by Stephen Ross (1976) with Arbitrage Pricing Theory (APT), which allows several sources of systematic risk without requiring the “market portfolio” to be identified. The advantage of APT is its flexibility; its drawback is that the theory does not state which factors are important — that is left to empirical research. That this gap is not merely theoretical is shown by the first empirical tests. Roll and Ross (1980) found that the returns on US equities in 1962–1972 are explained by at least three, and probably four, priced factors. Cho (1984), applying inter-battery factor analysis — a factor-analytic method for comparing two sets of variables — did not confirm this number: he pointed to a shortcoming in Roll and Ross’s methodology and obtained five or six common factors. Both studies agree that there is no basis for rejecting APT, but not on the number of factors — and it is precisely that disagreement which best shows what a theory that does not name its factors means (Ross, 1976; Roll & Ross, 1980; Cho, 1984).

The equity premium puzzle and the regime-dependent nature of the risk premium#

One of the most intriguing empirical facts is the equity premium puzzle: Mehra and Prescott (1985, p. 147) showed that the average annual premium on the US equity market in 1889–1978 — 6.18 percentage points above the return on short-term debt instruments — is too large to be explained by standard utility models with realistic coefficients of relative risk aversion. The coefficient $\gamma$ measures the extent to which an investor avoids risk: the larger it is, the stronger the aversion, and empirical estimates are $\gamma \approx 1{-}2$ (ibid., p. 154). When the coefficient is restricted to empirically grounded values, their model yields a premium of only about 0.35 percentage points. The difference between this figure and the observed one is the puzzle.

Several theoretical explanations have been proposed over the past decades:

• Habit formation: in the model of Campbell and Cochrane (1999) the investor’s utility depends not only on current consumption but also on the previous level of consumption (the habit). This makes it possible to explain a high premium with a lower coefficient of risk aversion, because a fall of consumption below the habit causes a disproportionately large negative utility.
• The rare disasters model: Barro (2006) argued that investors expect rare but catastrophic economic downturns (world wars, depressions), and therefore demand a high premium even in periods when no catastrophe materialises.

Nor is the risk premium a constant quantity — it depends on the phase of the economic cycle and on calendar periods. Corhay et al. (1987) found that the risk premium exhibits features of seasonality (for example, the January effect). That expected return varies over time is also shown indirectly by forecasting research: Nyberg (2011) showed that the sign of the excess return on the US equity market can be forecast by binary probit models, among whose explanatory variables are indicators of recession. If the premium were constant, there would be nothing to forecast. This means that the assumption of a constant risk premium, used in standard CAPM, is a simplification that may systematically distort business valuation depending on the economic cycle.

The instability of the beta coefficient#

Another important empirical problem is the instability of the beta coefficient over time. Standard CAPM rests on the assumption that beta is constant, yet Huang (2001) showed that it is non-stationary: over different time horizons the same asset may have a very different beta. The question of the return measurement interval adds to this. Handa et al. (1993) carried out multivariate tests of the Sharpe–Lintner CAPM with monthly and with annual returns and obtained opposite conclusions: with monthly data the model is rejected, with annual data it is not. It follows that the answer to the question whether CAPM works depends in part on how frequently the return is measured. This is particularly relevant in the Baltic and Central and Eastern European (CEE) markets, where Dajčman et al. (2013) carried out a multiscale CAPM test — one conducted over several time horizons at once — in three CEE markets and found that in small-capitalisation, low-liquidity markets CAPM performs considerably worse — pricing is affected by illiquidity, segmentation and institutional factors. In the Baltic context this means that the application of CAPM requires caution and supplementary adjustments — multi-factor models or scenario-based approaches may be superior (Dajčman et al., 2013).

The formulas of CAPM, Fama-French and APT are discussed in more detail in section 3.2 (analytical models), and their practical application to the calculation of the discount rate and WACC in Chapter 11.

A classification of business risks#

Effective risk management begins with structured identification. Without a systematic classification, risks are either ignored or analysed unsystematically. Business risks may be classified according to two criteria.

By source of origin:

Figure 3.2. A taxonomy of business risks by source of origin

graph TD
    R["Business risk"]
    R --> E["External risks"]
    R --> I["Internal risks"]

    E --> E1["Macroeconomic<br/><i>GDP, inflation, interest rates</i>"]
    E --> E2["Regulatory and legal<br/><i>GDPR, the EU Taxonomy, the Lithuanian Labour Code</i>"]
    E --> E3["Technological<br/><i>Disruptive innovations</i>"]
    E --> E4["Geopolitical<br/><i>Sanctions, trade wars</i>"]

    I --> I1["Operational<br/><i>Processes, systems, people</i>"]
    I --> I2["Strategic<br/><i>Choice of market, M&A</i>"]
    I --> I3["Financial<br/><i>Liquidity, credit, currency</i>"]

    style R fill:#4a90d9,color:#fff
    style E fill:#e8705a,color:#fff
    style I fill:#50b5a9,color:#fff

The Lithuanian context: Lithuania, as a small open economy, is particularly sensitive to fluctuations in external demand. The energy crisis of 2022 that followed Russia’s invasion of Ukraine raised production costs and caused a wave of double-digit inflation. China’s trade blockade of 2021, prompted by the opening of a Taiwanese representative office, showed how geopolitical decisions can directly affect export markets. Clayton Christensen (1997), in The Innovator’s Dilemma, described why it is successful firms that fail: they rationally follow the needs of their most profitable customers and keep improving the existing technology, and therefore undervalue disruptive innovations — which at first are worse, cheaper or simpler — until those mature and take over the market. The regularity also applies to Lithuanian manufacturing: the share of low value-added production is considerably higher than the EU average, and of the five largest sectors only chemicals exceeded the EU average productivity in 2022 (Ministry of the Economy and Innovation, 2026).

By scope for management:

Risk transfer and retention: hedging, insurance and self-insurance#

The third and fourth rows of the table lead in practice to the risk management question most often asked: should we hedge the risk or retain it? The answer is not self-evident, and for that very reason it is worth setting out.

Pure and speculative risk. Which instrument fits is determined in the first place not by the size of the risk but by its nature. Pure risk has only two outcomes — a loss or no loss: fire, a natural disaster, equipment failure. Speculative risk moves in both directions and may produce either a loss or a gain: raw material prices, exchange rates, interest rates. Dionne (2013) describes how it was precisely this difference that historically divided risk management into two fields: market insurance covers pure risks that the firm cannot cover itself, while derivatives, which spread from the 1970s onwards, protect against unanticipated financial losses. The practical consequence is simple: a fire is insured, whereas the price of a raw material is hedged.

Two types of hedging. Hedging is the management of risk through a transaction or an operational decision whose result moves in the opposite direction to the position being protected. It divides into two fundamentally different approaches. Natural hedging transfers risk to no one — it reduces risk through the structure of the business itself: a firm that exports to the United States and buys its raw materials there receives revenue and incurs costs in dollars, and thereby essentially closes its currency position. That position rarely disappears completely — a residue of mismatch in maturities, amounts and pricing remains. Financial hedging transfers the risk to another market participant through derivative instruments — forwards, futures, swaps and options. The difference is not technical but economic: natural hedging requires no premium to be paid, but it costs operational flexibility and forgone opportunities, whereas financial hedging can be applied without changing operations yet has a cost of its own. In an option that cost is visible at once as the premium; when the price is fixed with forwards or futures there is no separate premium, but transaction costs, the bid-ask spread, margin requirements and the forgone additional profit — if the price were to move in the firm’s favour — remain. In planning, the sequence is a natural one: first a natural match is sought, and financial hedging is applied only to that part of the open position which has not been closed.

The Modigliani–Miller challenge: why should a firm hedge at all? The logic of Modigliani and Miller (1958) raises an awkward question. If capital markets are perfect, the shareholder can hedge on their own — and more cheaply, because they do not have to cover the firm’s transaction costs. In that case the firm’s hedging creates nothing: it merely repeats what the investor can already do in their own portfolio, and pays a commission for doing so. This is the same argument that is used in Chapter 5 against corporate diversification, only applied to the transfer of risk.

The way out is not to reject the argument but to notice its condition: markets are not perfect. The same market imperfections that in Chapter 11 explain why capital structure does after all matter — taxes, bankruptcy costs, information asymmetry and agency conflicts — explain here when hedging creates value. It was precisely three value-creation channels that Smith and Stulz (1985) formalised as the determinants of hedging policy:

1. The costs of financial distress. Hedging a shareholder’s portfolio does not reduce the probability that the firm itself will become insolvent. Bankruptcy is irreversible and has costs of its own — customers lost, employees gone, assets sold under duress. Hedging that reduces the volatility of cash flows also reduces the probability of entering that zone.
2. Tax asymmetry. Profit is taxed, whereas a loss is not always recovered, and not immediately. Two volatile years — a large profit and a large loss — therefore pay more tax than two stable average years with the same total.
3. Underinvestment. A firm whose cash flow has fallen abandons even those investments that create value, because external financing is at that moment at its most expensive. A stable flow allows the investment plan to be carried out independently of the market cycle. This channel was developed in most detail by Froot, Scharfstein and Stein (1993): when external financing is costly, the purpose of risk management is not to reduce volatility for its own sake but to ensure that internal funds suffice for investment at the moment when investment is most valuable.

From the point of view of a business plan a specific requirement follows: a hedging decision must be justified by one of these three reasons, and not by a reference to the fact that “the risk is large”. If none of them applies, the cost of hedging is a pure leakage of value.

Self-insurance. Self-insurance is the formalised form of the fourth row of the table — the acceptance of risk: the firm deliberately does not buy insurance cover but creates a liquid reserve to cover possible losses itself (Dionne, 2013). The logic is simple: a commercial insurance premium is usually larger than the expected loss, because it includes the insurer’s administrative costs and margin. Therefore, for frequent, small and predictable losses self-insurance is cheaper — the firm does not pay a margin for a risk it can forecast itself. This rule has an exception: where part of the premium is compensated by the state or the European Union (in Lithuania this is how the compensation of crop and livestock insurance premiums works), the premium the firm actually pays may be smaller than the expected loss, and insuring is then worthwhile even for small risks. And conversely: rare, large events exceeding the limit the firm can absorb should never be retained, because what matters here is not the expected value but whether the firm would survive a single realisation. It is precisely this difference — between the average loss and the worst case — that is the practical criterion for the decision, and in Chapter 4 it is operationalised through VaR and CVaR.

A fifth possibility — the exploitation of risk — does not belong in this table, because it does not reduce uncertainty but takes advantage of its asymmetry: by deferring a decision one acquires the right to invest only when the assumptions are confirmed. This is the logic of real options, discussed in Chapter 14.

The taxonomy of business risks by source of origin (Figure 3.2) is worth supplementing with three categories that are becoming ever more relevant in contemporary business:

• Reputational risk: Benn, Abratt and Kleyn (2016) defined it as the risk of losing trust, legitimacy and social capital, arising from a failure to meet the expectations of stakeholders. It affects customer loyalty, the attraction of employees and the terms of financing. Reputational risk is particularly insidious, because it often arises as a secondary consequence of the realisation of other risks (an operational error, for example, causes a reputational crisis).
• Systemic digital risk: Curran (2020) showed that the interconnectedness of digital infrastructure creates a new form of systemic risk — a local disruption (a cyber attack, the failure of a cloud service) may become a failure of the whole system. This is particularly relevant for firms whose business processes depend on the digital platforms of third parties.
• Risk cascading: risks are rarely realised in isolation — an initial shock changes behaviour, which changes the probabilities of other risks and amplifies secondary consequences. Lu et al. (2024) developed a cascading model for large construction projects, applying structural equation modelling and Bayesian networks. Langley (2013) emphasised that stress testing is the principal conceptual instrument for modelling low-probability, high-impact events — which is particularly important for organisations that depend on financing, supply chains or the stability of the regulatory environment. Maps of causal chains (rather than risk registers alone) are a more effective way of identifying cascade paths.

Bankruptcy risk and systematic risk#

Dichev (1998) raised a fundamental question: is bankruptcy risk systematic? If it is, CAPM ought to compensate it with a higher expected return. Dichev, however, found empirically that firms with a high probability of bankruptcy do not have a correspondingly higher return — since 1980 the return of such firms has actually been lower than average. Dichev’s conclusion is stronger than it appears at first sight: a risk-based explanation does not account for this regularity, and the bankruptcy risk anomaly therefore remains without an agreed theoretical foundation. For the business planner this means that assessing bankruptcy risk requires separate analytical instruments (liquidity analysis, the Altman Z-score — see Chapter 9), and not the beta coefficient alone.

Asymmetric risk and downside measures#

The traditional standard deviation treats positive and negative deviations symmetrically. In business practice, however, losses are asymmetrically more important — bankruptcy is irreversible, whereas “too much” profit is not a problem. Several measures of asymmetric risk formalise this intuition:

• The Sortino ratio — analogous to the Sharpe ratio (formula (3.8)), but using in the denominator only the downside standard deviation (deviations below a minimum acceptable level of return).
• Value at Risk (VaR) — a quantile of the loss distribution: the threshold which, over a chosen period and at a given confidence level, the actual loss should not exceed (for example, “a one-day 99 % VaR of EUR 50 000” means that on 99 days out of 100 the loss will not exceed EUR 50 000).
• Conditional Value at Risk (CVaR; also Expected Shortfall, ES) — the average loss given that it exceeds the VaR threshold. Formally: $CVaR_\alpha = E[L \mid L > VaR_\alpha]$, where $L$ is the loss and $\alpha$ is the confidence level. CVaR is a coherent risk measure satisfying the property of subadditivity, which VaR lacks — this means that the CVaR of a portfolio is always less than or equal to the sum of the CVaRs of the individual assets, whereas VaR does not have this property (Artzner et al., 1999). CVaR captures “tail” risk better and is therefore a superior measure for organisations for which the critical question is not “what loss is expected” but “what loss is possible in the worst case”.

The formulas, with numerical examples, are presented in section 3.2.

Risk management systems: ISO 31000 and ERM#

The ISO 31000:2018 standard sets out a universal yet systematic risk management process applicable to organisations of any type:

Figure 3.3. The ISO 31000 risk management process

The diagram shows two different logics. The six numbered components follow in sequence: from establishing the scope and the criteria to risk treatment and reporting. Two components — monitoring and review, and communication and consultation — are shown as dotted lines, because they are not stages: they take place continuously and in parallel with all the others. It is precisely this difference that is most often simplified in practice — risk management is turned into a procedure carried out once a year rather than a continuous process.

flowchart LR
    A["1. Scope, context<br/>and criteria"] --> B["2. Risk<br/>identification"]
    B --> C["3. Risk<br/>analysis"]
    C --> D["4. Risk<br/>evaluation"]
    D --> E["5. Risk<br/>treatment"]
    E --> H["6. Recording and<br/>reporting"]

    F["Monitoring and review"] -.-> A
    F -.-> B
    F -.-> C
    F -.-> D
    F -.-> E
    F -.-> H

    G["Communication and consultation"] -.-> A
    G -.-> B
    G -.-> C
    G -.-> D
    G -.-> E
    G -.-> H

    style A fill:#4a90d9,color:#fff
    style B fill:#4a90d9,color:#fff
    style C fill:#4a90d9,color:#fff
    style D fill:#4a90d9,color:#fff
    style E fill:#4a90d9,color:#fff
    style F fill:#f5a623,color:#fff
    style G fill:#50b5a9,color:#fff

The COSO (Committee of Sponsoring Organizations of the Treadway Commission) ERM Framework (2017) extends this process to the strategic level, integrating risk management with the organisation’s strategy and objective-setting. The system consists of five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting. The difference from the ISO 31000 process is significant: ISO describes how risk is managed, whereas COSO describes where in the organisation that management lives. The first component is not first by accident: in COSO’s logic, risk management without the support of governance and culture remains a procedure that can be performed as a formality. Crawford and Jabbour (2024) studied the link between enterprise risk management (ERM) and managerial decision-making and found that ERM acts as an integrating lens, joining strategy, operations, capital structure, reputation and regulatory legitimacy. Their principal conclusion: risk is not merely a financial measure — it cuts across the whole chain of value creation, and the effectiveness of its management depends on the quality of managerial judgement, the institutional environment and cognitive constraints. The regulatory environment shapes management decisions no less than financial data do (Crawford & Jabbour, 2024).

The costs of implementation, however, are high, and for smaller Lithuanian firms the principle of ISO 31000 is therefore often enough — what matters is not the size of the formal system but the embedding of systematic thinking about risk (ISO, 2018; COSO, 2017). Specific methods of risk analysis (sensitivity analysis, scenario analysis, Monte Carlo simulations, decision trees) are discussed in more detail in Chapter 4.

ESG as a new dimension of risk#

Environmental, social and governance (ESG) risks have over the past decade become an independent category affecting all the layers of business value:

• Environmental risk (E): the physical hazards of climate change (floods, droughts), transition risk (carbon taxes, tighter regulation), the reputational risk of greenwashing.
• Social risk (S): breaches of labour rights in the supply chain, resistance from communities, employee health and safety incidents.
• Governance risk (G): a lack of independence on the board of directors, the misalignment of executive remuneration with results, corruption.

Friede, Busch and Bassen (2015) reviewed more than 2 200 empirical studies and found that roughly 90 % of them show no negative relationship between ESG and financial return (p. 217). The share of studies recording a positive relationship depends on which stream is taken: in vote-count studies, which simply count how many studies found a positive result, it is about 48 %, and in meta-analyses 62.6 % (pp. 217, 219). Causality, however, remains debatable — it may be that well-managed businesses simply invest more both in ESG and in other measures of efficiency.

The most recent research refines this relationship in two directions. Liu and Song (2025) found that better ESG performance reduces a firm’s risk through three mechanisms: it eases financing constraints, improves reputation and lowers the probability of sanctions — which is particularly relevant under conditions of environmental uncertainty. Galdos-Urbizu, Ortas and Alvarez-Etxeberria (2025), however, showed the opposite side as well: a high ESG risk exposure (not performance, but impact) strengthens the negative influence of market volatility and increases firm-specific risk — the effect is non-linear and grows stronger among already volatile stocks. This means that ESG works in two directions — as an instrument for reducing risk (when a firm actively manages ESG) and as an additional source of risk (when ESG factors act on the firm from outside). The integration of ESG into business valuation is discussed in Chapter 1 (intangible capital) and in Chapter 10 (the evaluation of investment decisions).

The relationship between risk and the ontological structure of value#

The five-layer ontological decomposition of business value presented in Chapter 1 is directly related to the dimensions of risk:

The incompatibility of these five ontologies also has a practical resolution. ISO 31000 defines risk as the effect of uncertainty on objectives (ISO, 2018). The definition looks abstract, but it does a specific job: it shifts the question from “how much does it fluctuate?” to “what does it harm?” The standard deviation measures fluctuation without asking what the firm is aiming at; the ISO definition requires the objective to be named first and only then measured. For a business plan this is convenient, because a plan already has its objectives formulated — risk then becomes not a separate section but a question attached to every assumption. At the same time the definition is broad enough to include a positive deviation: the effect of uncertainty may also be favourable, and this distinguishes the ISO approach from a purely loss-based ontology.

This relationship shows that risk is not a homogeneous dimension — every layer of value has its own risk profile and requires different instruments of management and measurement. Chapter 3 acts as an ontological bridge between the concept of value in Chapter 1 and the instrumental methods of Chapter 4.

3.1.3 Critical analysis and discussion#

CAPM: an elegant theory, a problematic empirical record#

CAPM became the standard for calculating the cost of equity not because its assumptions are realistic but because it created a disciplined language about systematic risk. Criticism of the model, however, has two axes — theoretical and empirical.

Theoretical criticism. Richard Roll (1977) demonstrated a fundamental testing problem: the true “market portfolio” that CAPM requires would have to include all the wealth in the world — equities, bonds, real estate, human capital. Such a portfolio is unobservable, and therefore any empirical test of CAPM in fact tests not the model itself but the suitability of the market index used (the S&P 500, for example) as an approximation of the market portfolio (Roll, 1977).

Empirical criticism. Fama and French (1992) concluded that the empirical success of CAPM is poor: the beta coefficient alone explains only a small part of the cross-sectional variation in asset returns. Three well-documented anomalies:

• The size effect: the returns of small-capitalisation firms systematically exceed the predictions of CAPM (Banz, 1981).
• The value effect: firms with a high book-to-market ratio earn more than CAPM predicts (Fama & French, 1992).
• The momentum effect: assets that have performed well recently tend to continue doing so (Jegadeesh & Titman, 1993).

Lithuanian evidence. These anomalies were identified in large, liquid markets, and the question therefore arises whether the dispute is relevant at all in the Baltic context. It is relevant, and all the more so: the multiscale CAPM test of Dajčman and colleagues (2013) in three Central and Eastern European markets showed that in markets with small capitalisation and low liquidity the explanatory power of the model is smaller still, while pricing is additionally affected by illiquidity, market segmentation and institutional factors. In practical terms this means that for a Lithuanian firm the limits of CAPM are not a theoretical remark but an everyday valuation problem — how this is handled is discussed in section 3.1.5.

An important methodological conclusion: CAPM is not “the truth about the world” but a normative model that makes it possible to think in a structured way about the relationship between risk and return. Its limits show that the ontology of risk cannot be reduced to $\beta$ alone — which is why in practice CAPM is supplemented by a country premium, a size premium, a liquidity adjustment and other ad hoc additions that partly compensate for the limitations of a single-factor model (see Chapter 11).

The illusion of the normal distribution and model risk#

As shown in section 3.1.1, Markowitz’s portfolio theory, CAPM and Black-Scholes option pricing rely on the assumption of a normal (Gaussian) distribution unevenly — some directly, others through their empirical tests and risk measures — but all of them carry that assumption somewhere. It is mathematically convenient, but empirically problematic.

It is worth returning to Mandelbrot’s (1963) “fat tails” (section 3.1.1) with a number.

How much more often — that can be calculated. Under the normal distribution, the probability that a value will depart from the mean by more than five standard deviations in one direction is 2.87 · 10⁻⁷; with roughly 250 trading days in a year, such an event ought to occur once in almost 14 000 years. In financial markets they occur inconceivably more often. It is important to understand that this is not Mandelbrot’s number but a consequence of the normality assumption: Mandelbrot himself argued, on the contrary, that a stable Pareto distribution, whose variance is infinite, is more appropriate for price changes — and in such a model “five standard deviations” has no meaning at all. That is why the figure is given here not as a measure of risk but as a test of an assumption.

This creates model risk — an error arising not from reality itself but from the form in which it is represented. A business plan may be mathematically “tidy” yet ontologically fragile: if the model has no place for an extreme scenario, it systematically underestimates the need for capital buffers, liquidity reserves and strategic flexibility. As the financial crisis of 2008 illustrated: risk management models based on the assumption of a normal distribution showed that banks’ portfolios were safe — for as long as the assumption they rested on held.

Lithuanian evidence. This dispute need not be illustrated by the crisis of 2008 alone — a closer and better documented example is the year 2022. In December 2021 the Bank of Lithuania forecast average annual inflation of 5.1 % for 2022, measured by the Harmonised Index of Consumer Prices (HICP), and the Ministry of Finance forecast 4.0 %; actual inflation reached 18.9 % (Bank of Lithuania, 2021, 2023b; Ministry of Finance of the Republic of Lithuania, 2021). The deviations were about 13.8 and 14.9 percentage points.

This figure should not be read as proof that institutions forecast badly: the energy price shock occurred after both forecasts had been published, so this is a single shock year rather than a typical deviation. The lesson is a different one, and it corresponds exactly to the argument of this section: a deviation of this magnitude is not a “five-sigma event” that the model would have classified as impossible — it is the expiry of the assumption on which the model rested. In a business plan this means that an assumption is worth writing down together with the condition whose change would make it no longer valid (see Chapter 2 for more).

A practical conclusion for the business planner: quantitative risk models are necessary, but they are not sufficient. They must be supplemented by stress testing and scenario analysis (Chapter 4), which also covers “impossible” scenarios.

Behavioural biases in risk assessment#

Prospect theory (Kahneman & Tversky, 1979) showed that people’s assessment of risk departs systematically from the rational model. In the context of business planning and risk management, seven cognitive biases are particularly important:

1. Overconfidence. This bias takes three forms: overestimation of one’s abilities, overplacement of one’s position relative to others, and overprecision — the last of which directly produces confidence intervals in financial forecasts that are too narrow. Managers systematically judge uncertainty too narrowly — their 90 % confidence intervals contain the true value in only about 50 % of cases (Russo & Schoemaker, 1992). In business planning this shows itself in over-optimistic revenue forecasts and in ranges of risk that are too narrow.

2. Loss aversion and the sunk cost fallacy. Once a project has already incurred losses, managers tend to invest further in the hope of “recouping” — even where the rational decision would be to stop. This is particularly relevant in long-term investment projects (Chapter 10).

3. The availability heuristic. Risks that are more easily recalled (recently experienced, vivid, emotionally affecting) are judged to be more probable. After a well-known cyber incident an organisation may disproportionately increase its IT security budget while at the same time ignoring latent supply chain risk.

4. Anchoring. Initial information — even if unrelated — influences the final decision disproportionately. In business valuation: the first price offered “anchors” the negotiation and shapes the subsequent range of expectations (Tversky & Kahneman, 1974).

5. Groupthink. Irving Janis (1972) described the phenomenon in which the strong unanimity of a group suppresses critical thinking and the consideration of alternatives. Boards of directors or investment committees dominated by conformity may systematically underestimate strategic risks.

6. Herd behaviour. When individual decision-makers follow the actions of others, believing that the others have better information, an informational cascade arises (Bikhchandani, Hirshleifer and Welch, 1992) — each individually rational decision becomes collectively irrational. Herd behaviour also has a reputational dimension: it is often safer for managers to be wrong together with everyone else than to be right alone — which reinforces conformity in investment decisions.

Herd behaviour is the principal mechanism by which bubbles form. Charles Kindleberger (1978), in his classic work Manias, Panics, and Crashes (later updated together with Robert Aliber), described the evolution of bubbles in a five-stage model:

Historical examples — tulip mania (1637), the dot-com bubble (2000), the property bubble (2008) — show that this model recurs with striking similarity; only the object of the bubble changes (Kindleberger & Aliber, 2005).

The example closest to the Lithuanian reader is the Baltic property cycle of 2005–2008. All five stages can be recognised in it: displacement (accession to the European Union in 2004 and a sharp rise in the availability of credit), the expansion of credit, euphoria accompanied by the expectation that prices would continue to rise, the realisation of profit, and the sudden fall of 2008–2009. What matters for business planning is not the history itself but the fact that the business plans drawn up during that cycle rested on the assumption of continued price growth — not because their authors were poor analysts, but because the assumption appeared to be confirmed by several years of data. That is exactly how a behavioural bias enters a plan: not as a mistaken calculation but as an unquestioned assumption.

7. The planning fallacy. The phenomenon described by Kahneman and Lovallo (1993), in which the duration and the cost of projects are systematically underestimated because they are assessed from an “inside” rather than an “outside” point of view. Empirical data show that nine out of ten megaprojects exceed their budget, and that the average overrun in real terms reaches 44.7 % in rail projects and 20.4 % in road projects (Flyvbjerg, 2014, p. 9); in information technology projects the average overrun is smaller, about 27 % (Flyvbjerg & Budzier, 2011), yet one in six such projects deviates so severely that its costs are exceeded by an average of 200 % (Flyvbjerg, 2014, p. 10).

The agency problem and organisational distortion of risk#

The agency theory of Jensen and Meckling (1976) shows that hired managers and owners have different interests with respect to risk. A manager whose remuneration depends on short-term results may assume too much risk (in pursuit of bonuses) or, on the contrary, too little (if their job depends on avoiding “mistakes”). Kahneman and Lovallo (1993) supplemented this perspective with organisational optimism: the initiators of projects have a personal interest in presenting optimistic forecasts; decision-makers would like projects to succeed; and organisational culture often punishes “pessimism”.

This agency dynamic explains why risk management must be institutionalised (formalised processes, an independent risk function, oversight by the board of directors) rather than left to the individual judgement of a manager.

Debiasing strategies#

The academic literature and practice offer several structural debiasing strategies:

• Reference class forecasting (also called comparison class forecasting, RCF): the forecast is made not “from the inside” (the specifics of the project) but “from the outside” — on the basis of how similar projects have fared historically. Flyvbjerg (2006) showed that infrastructure projects systematically exceed their budgets and proposed a reference class correction factor.
• Pre-mortem analysis (Klein, 2007): before a decision is taken, the team imagines that the project has already failed and generates the possible causes of that failure. This legitimises pessimism and reduces the effect of groupthink.
• Structured adversarial discussion (red team / devil’s advocate): the formal assignment of a role of opposition within the decision process, reducing confirmation bias — the tendency to seek out and value only that information which confirms an opinion already held — and other group biases.
• Scenario planning: requires several radically different future scenarios to be considered, forcing decision-makers out of a “single-point” forecast (Schwartz, 1991; see Chapter 4 for more).
• Stress testing: Langley (2013) defined stress testing as a conceptual instrument allowing low-probability, high-impact events to be modelled — precisely those that standard models do not cover. Stress testing is particularly important for organisations dependent on external factors (financing, supply chains, the stability of the regulatory environment), and it should cover not only the direct impact of a shock but also its cascading consequences (see risk cascading in section 3.1.2). The methodology of stress testing is discussed in more detail in Chapter 4.

Risk appetite, tolerance and capacity#

Every organisation has — often unexpressed — an attitude towards risk, which can be defined at three hierarchical levels:

• Risk appetite: the organisation’s general readiness to assume risk in pursuit of its objectives. This is a strategic, board-level decision.
• Risk tolerance: the acceptable variation of outcomes for a particular objective or process.
• Risk capacity: the maximum risk the organisation can assume without facing an existential threat.

The fundamental rule: appetite ≤ capacity. An organisation may wish to assume more risk than it can — one of the most frequent mistakes of start-ups and aggressively growing businesses.

Principle 7 of the COSO ERM framework requires the organisation to define its risk appetite (COSO, 2017, p. 10), but does not prescribe the form. In practice it is formalised either quantitatively or qualitatively; the examples that follow are illustrative and are not COSO’s text: a quantitative one — “the acceptable maximum annual fluctuation of profit is ±15 % from plan”; a qualitative one — “we shall not operate in countries whose corruption index is below 40 out of 100”. In the context of Lithuanian SMEs risk appetite is most often not formalised and depends on the owner’s personal position — which provides flexibility but at the same time creates a risk of inconsistency and subjectivity.

A synthesis of the objective and subjective perspectives#

Summing up the critical discussion, a contemporary understanding of business risk requires the synthesis of two parallel traditions:

Neither the objective nor the subjective perspective is sufficient on its own. A business planner who uses only quantitative models misses the psychological and institutional dimensions of risk. A planner who relies only on intuition has no means of comparing alternatives in a structured way. Effective risk management is a continuous navigation between these two paradigms, using quantitative models as a structural support and behavioural insights as a corrective mechanism.

3.1.4 The technology perspective#

The development of theories of risk and profitability is inseparable from the evolution of computing technology. Many of the models presented in this chapter were born as theoretical constructs, but they became applicable in practice only when technology made the necessary calculations possible.

The era of computerisation (1970–1995): theories become practice#

Markowitz’s portfolio theory (1952) is a textbook example of the interaction between technology and theory. Computing the variance-covariance matrix for a portfolio of 100 assets requires 5 050 unique elements to be processed. By hand this was an almost impossible task — and so from 1952 until roughly the 1970s portfolio theory remained in part an academic construct, while practitioners continued to be guided by intuition and by simple rules.

The arrival of computers changed everything. Sharpe’s CAPM (1964) became not only a theoretical model but a practically computable tool: beta coefficients began to be published regularly (Value Line, Merrill Lynch), and investors were able for the first time to assess systematic risk quantitatively. Another essential technological revolution came in 1973, when Black and Scholes published their option pricing formula and the Chicago Board Options Exchange (CBOE) began operating in the same year. Traders quickly adapted the formula, “sewing” it into programmable calculators — above all the Hewlett-Packard HP-67, which became the first widely used Black-Scholes computing device on the CBOE trading floors (MacKenzie, 2006). For the first time risk assessment became a real-time operation, moving from the analyst’s notebook into a digital format.

This era also saw the appearance of the first commercial risk modelling tools: @RISK (Palisade Corporation, 1987) and other Monte Carlo add-ins for spreadsheets. This democratised risk analysis — it became available not only to investment banks but also to the finance departments of corporations.

The era of the internet and data (1995–2020): from the model to the system#

In 1994 JP Morgan publicly released RiskMetrics — a standardised Value at Risk (VaR) methodology with which any financial institution could assess its own risk portfolios. This was an unprecedented step: for the first time a complex risk model became a publicly available standard rather than a competitive advantage. VaR soon found its way into banks’ capital requirements as well: the Basel Committee’s Market Risk Amendment of 1996 allowed banks to use internal models to calculate capital. The causal link between RiskMetrics and that decision should not be exaggerated — the committee began its work in 1993, responding to a request from the industry, that is, before RiskMetrics was published. But the direction is the same in both cases: risk technology became a regulatory requirement. Over time this regulatory evolution revealed a deepening dialogue between models and institutions. Basel I (1988) relied on simple standardised indicators requiring little technological infrastructure. Basel II (2004) extended internal models from market risk to credit risk through the internal ratings-based (IRB) approach and made them the axis of capital calculation, requiring complex IT infrastructure and teams of risk analysts. After the crisis of 2008, Basel III (2010→) introduced liquidity requirements — the liquidity coverage ratio (LCR) and the net stable funding ratio (NSFR) — and stress tests requiring real-time data processing. The most recent changes — the so-called “Basel IV” with its output floor mechanism — signal the regulators’ scepticism about the reliability of internal models: the paradigm has shifted from “model freely” through “model, but verify” to “do not over-rely on models”.

The internet gave access to data that had previously been available only to professional market participants. Damodaran’s open databases (country risk premiums, beta coefficients, sector statistics) became the de facto standard for academics and practitioners from the 2000s onwards. The Bloomberg and Refinitiv (Thomson Reuters) terminals consolidated real-time market data, making it possible to calculate CAPM parameters not from annual averages but from daily dynamics.

This era, however, also revealed a technological risk within risk management itself. The financial crisis of 2008 showed that VaR models fed with historical data from the comparatively calm period of 2003–2006 systematically underestimated the level of risk. The assumption of a normal distribution (see section 3.1.3) was not only a theoretical but also a technological problem: the models were calibrated on “fair weather” data and could not capture structural breaks. This reinforced Taleb’s (2007) “black swan” critique: the more we trust a model, the more we underestimate what the model does not see.

Another global change is the dominance of algorithmic trading infrastructure. In the US capital markets the use of algorithms is universal, and in the inter-dealer market for Treasury securities principal trading firms — firms that trade as principals for their own account — account for more than half of trading volume (SEC, 2020, pp. 5, 24). The modern microstructure of markets has opened the way to microsecond imbalance crises, and the best-known variant of such a catastrophe is the Flash Crash of 6 May 2010: the main US indices fell by 9–10 % within a few minutes and recovered almost as much (CFTC-SEC, 2010, p. 9). Kirilenko, Kyle, Samadi and Tuzun (2017) analysed this episode in the E-mini S&P 500 futures market, in which the decline began to take shape. This sudden break, occurring without any traditional economic shock, showed that the infrastructure of algorithmic trading creates a new form of systemic liquidity risk that traditional models — both CAPM and fat-tail models — were not built to capture.

This era also saw the rise of RegTech (regulatory technology) innovations: regulatory compliance, know-your-customer (KYC) and anti-money-laundering (AML) processes and VaR calculations moved into automated digital systems, which reduced the risk of human error but created a new dependence on cyber security. In the Lithuanian and Baltic context this change was particularly marked: by the number of electronic money and payment institution licences issued, Lithuania leads the European Union (Bank of Lithuania, 2023a, p. 2), while the Bank of Lithuania’s regulatory sandbox for financial innovation has at the same time become a testing environment for new risk management technologies.

Alongside RegTech innovations, a discourse on the application of distributed ledger technology (DLT) in risk management also took shape. The promises — the reduction of settlement risk through smart contracts, greater traceability of transactions — have so far remained largely at the stage of pilot projects. The growth of the decentralised finance (DeFi) ecosystem, however, has created entirely new categories of risk: the vulnerability of smart contracts, flash loan attacks and the systemic risk of unregulated protocols. The Bank of Lithuania has shown initiative in this field — the LBChain project (2018–2020) was one of the early central bank regulatory sandboxes for blockchain technologies, designed to test DLT solutions in a supervised environment (Bank of Lithuania, 2019).

The era of AI and AI agents (2020→): risk assessment in real time#

Artificial intelligence (AI) is changing risk management at several fundamental levels.

Risk identification. Natural language processing (NLP) models are able to analyse news flows, regulatory documents and social media data, identifying new categories of risk earlier than traditional methods do. Geopolitical risk indices constructed from the analysis of news content, for example, make it possible to assess quantitatively what was previously only a qualitative expert judgement.

Risk modelling. Machine learning algorithms — particularly gradient boosting methods and deep neural networks — are able to capture the non-linear relationships and interactions between risk factors that traditional linear models (CAPM, multi-factor models) miss. Gu, Kelly and Xiu (2020) showed that in asset pricing problems machine learning models can significantly improve predictive accuracy compared with traditional linear variants of factor models. A better forecast, however, does not yet mean a better explanation: the question of interpretation and causality remains open.

Operational risk. AI is transforming the management of operational risk: anomaly detection algorithms identify unusual transactions, payments or processes, while automated stress tests model thousands of scenarios in minutes — a task that would take a human weeks.

AI, however, also raises new dimensions of risk. The opacity of a model (the black box problem): when a risk assessment is performed by a deep learning model, analysts are often unable to explain why the model reached a particular conclusion. This conflicts with regulatory requirements and creates a new agency problem: who is responsible when the “black box” is wrong? Data bias: AI models learn from historical data that may contain systematic biases — credit risk models trained on data reflecting discriminatory practices, for example, may entrench them. Systemic fragility: when many market participants use similar AI models, their decisions become correlated — which may amplify the herd behaviour effect (see section 3.1.3) and create new types of systemic risk. Cyber and regulatory risk: digitalised risk management becomes dependent on cloud infrastructure, data providers and RegTech systems, so that a model error, a cyber incident or the faulty automation of regulatory compliance may itself become a failure of the risk management system.

The position of this textbook is that AI is a powerful instrument of risk analysis, but that it does not remove the fundamental epistemological problems: Knightian uncertainty, the illusion of the normal distribution and behavioural biases. AI can help to manage them, but it cannot eliminate them. In the Lithuanian and Baltic context this tension is particularly marked because of the rapidly digitalising financial sector and an active fintech policy: the innovation ecosystem supported by the Bank of Lithuania increases efficiency, but at the same time it raises questions of cyber, model and third-party infrastructure risk. A deeper analysis of the relationship between technology and risk management, covering a synthesis of all the themes of the book, is presented in Chapter 19.

3.1.5 The Lithuanian context#

The measures discussed in this section were developed by observing deep, liquid markets in which the history of prices goes back decades. The Lithuanian situation differs in three respects, and each of them changes not the validity of the measures but the conditions of their application.

First, market liquidity is insufficient, and beta is therefore unreliable. The capitalisation and the trading volumes of Nasdaq Vilnius are such that the shares of many companies are traded infrequently. In the return series of an infrequently traded asset some days show a zero change simply because there were no transactions, and not because the market valued the asset in the same way. A beta calculated from such a series systematically approaches zero — not because the asset is independent of the market, but because of the structure of the data. This is precisely what the multiscale test of Dajčman and colleagues (2013) in Central and Eastern European markets shows: in small-capitalisation, low-liquidity markets CAPM performs considerably worse. The practical conclusion is not “CAPM is unsuitable for Lithuania” but something more specific: beta must be taken from comparable firms in international markets and adjusted for capital structure, rather than calculated from infrequent local trading.

Second, the structure of business is dominated by the undiversified owner. The CAPM logic described in section 3.1.2 rests on the assumption that the investor is diversified and that unsystematic risk is therefore not compensated. For the owner of a Lithuanian small or medium-sized enterprise this assumption is usually false: their wealth, their income and often even their pension prospects are concentrated in a single firm. When valuing a private business, therefore, the CAPM return is a lower bound, not an answer — size and liquidity premiums are added to it, and this addition is not an “upward correction in the owner’s favour” but the correction of an assumption that is not satisfied.

Third, the country risk premium changes, but the calculation does not. Lithuania’s credit rating is high, and the country risk premium (formula (3.7)) is therefore small. The risk lies not in its size but in habits of use: valuations not infrequently copy across a value observed several years earlier. The premium is an input that must be taken from a current source on the day of the valuation, and its date must be stated in the valuation report. This is the same rule as the one formulated in Chapter 2 about any indicator: every number has a year.

What should not be concluded from this. It does not follow from these three constraints that quantitative risk assessment is meaningless in a thin market. Something simpler follows: a measure must be presented together with the condition under which it is valid. A beta without a note on liquidity, a CAPM without a statement of the diversification assumption and a country premium without a date are not more accurate — merely numbers that look more confident, which is exactly the spurious precision this textbook consistently criticises.

3.2 Analytical models and formulas#

This section presents the principal models for measuring risk and profitability, with their mathematical expressions and numerical examples. Each formula illustrates one of the concepts discussed in the theoretical part.

The standard deviation — the basic measure of risk#

The standard deviation measures the dispersion of returns about the mean and is the most widely used indicator of risk:

where:

• $\sigma$ is the standard deviation (a measure of risk),
• $R_i$ is the return observed in period $i$,
• $\bar{R}$ is the average return across all the periods,
• $n$ is the number of observations.

Numerical example.

(a) The scenario. The board of a manufacturing company is considering whether the results of the past five years are stable enough to serve as the basis for a business plan for a new production line. The bank is asking not only for the average return but also for an estimate of its variability.

(b) The values. The annual return on equity from the company’s financial statements for 2021–2025: 12 %, 8 %, −4 %, 15 %, 9 %. The average return $\bar{R} = (12 + 8 - 4 + 15 + 9) / 5 = 8.0\%$. The denominator uses $n - 1$, because this is a sample and not the whole population.

(c) The calculation.

(d) Interpretation for the decision. The average annual return is 8 %, and the typical deviation from it is about 7.25 percentage points, that is, almost as much as the return itself. For the board this means two things. First, a plan based on the average is insufficient here: individual years are likely to deviate by several percentage points in either direction, and the bank will ask about it. Second, a sample of five observations is too small for a reliable estimate — the figure shows an order of magnitude, not precision.

The beta coefficient — a measure of systematic risk#

The beta coefficient measures the sensitivity of an asset to movements of the market:

where:

• $\beta_i$ is the beta coefficient of asset $i$,
• $\text{Cov}(R_i, R_m)$ is the covariance of the returns of the asset and of the market,
• $\text{Var}(R_m)$ is the variance of the market return.

Numerical example.

(a) The scenario. A valuer is determining the cost of equity for a Lithuanian manufacturing company and has no price series for the company’s own shares, because it is not listed. Beta is therefore taken from comparable companies in the sector.

(b) The values. The covariance between the returns of comparable companies in the sector and of the market index $\sigma_{im} = 0.0036$; the variance of the market index $\sigma_m^2 = 0.0025$. Both are calculated from the same five-year window of monthly returns — the interval and the window must coincide, because the result depends on them (see the note on the instability of beta in section 3.1.2).

(c) The calculation.

(d) Interpretation for the decision. $\beta = 1.44$ means that when the market return changes by one percentage point, the model associates the company’s return with a change of roughly 1.44 percentage points in the same direction — an aggressive asset with higher systematic risk. It is important not to confuse the two: beta measures only sensitivity to the market, not the whole dispersion of returns. An asset may have a low beta and at the same time a large unsystematic risk — in which case the standard deviation (3.1) will be large even though beta indicates a “calm” asset.

CAPM — the expected return#

The capital asset pricing model (CAPM) links the expected return to systematic risk:

where:

• $E(R_i)$ is the expected return on asset $i$,
• $R_f$ is the risk-free rate,
• $\beta_i$ is the measure of the asset’s systematic risk,
• $E(R_m) - R_f$ is the equity risk premium.

Numerical example. A Lithuanian manufacturing company. The data (January 2026 market data — the same throughout the chapter): the euro area risk-free rate $R_f = 3.5\%$; the mature market equity risk premium $ERP = 4.23\%$ (Damodaran, 2026, January 2026 update); the company’s $\beta = 1.2$.

According to CAPM, an 8.58 % ex ante required return — ex ante meaning expected, before the fact — has been calculated for this company’s equity, corresponding to its systematic risk. It is used in two ways: to discount the expected cash flows to equity, or for comparison with the expected return on an investment of similar risk. The actual return on the shares in a single period may be either higher or lower, but this difference by itself indicates neither value creation nor a persistent alpha.

What this figure may be compared with. The CAPM result is an ex ante required return on equity, so the indicators compared with it must be of the same economic nature. It is compared with the expected return on an equity investment of similar risk, whereas the actual return on shares is only an ex post outcome. Accounting and project indicators are assessed against the cost of capital that corresponds to them:

The relationship between ROIC, WACC and EVA is examined in more detail in Chapter 11, and the accounting indicators themselves in Chapter 9.

A note on alpha. Jensen’s alpha is determined from a regression of periodic excess returns, and not by comparing the actual return of a single period with the CAPM estimate. Its statistical assessment falls outside the scope of this chapter.

Portfolio variance — the diversification effect#

The variance of a two-asset portfolio shows how diversification reduces risk:

where:

• $w_1$, $w_2$ are the weights of the assets in the portfolio ($w_1 + w_2 = 1$),
• $\sigma_1$, $\sigma_2$ are the standard deviations of the assets,
• $\rho_{12}$ is the correlation coefficient between the returns of the two assets.

Numerical example.

(a) The scenario. A company has two business lines and is considering whether the second, less profitable one is worth keeping. The finance director wants to show what the line contributes not to profit but to the stability of results.

(b) The values. Line A: $\sigma_A = 20\%$, share of revenue $w_A = 0.5$. Line B: $\sigma_B = 10\%$, $w_B = 0.5$. The correlation coefficient between their results $\rho_{AB} = 0.2$ — calculated from eight years of quarterly data.

(c) The calculation.

(d) Interpretation for the decision. The risk of the portfolio (12.0 %) is lower than the simple weighted average of the risks of the lines ($0.5 \times 20\% + 0.5 \times 10\% = 15\%$). The difference — three percentage points — is the diversification effect, arising from imperfect correlation. For the finance director this is an argument that the profit and loss account does not show: line B reduces the overall variability of results, and its value is therefore measured not by margin alone. But the argument has a limit — if the correlation were to rise to 1.0 during a crisis, the effect would disappear (see section 3.1.2).

The Sortino ratio — asymmetric risk#

The Sortino ratio, proposed in 1991 by Frank Sortino and Robert van der Meer, assesses risk-adjusted return by counting only downside risk:

where:

• $R_p$ is the average return of the portfolio (or of the project),
• $MAR$ is the minimum acceptable return,
• $\sigma_d$ is the downside standard deviation (calculated only from negative deviations from $MAR$).

The downside variance:

A note: the denominator uses $n$ (the number of all the periods, not only of the negative deviations), because zero deviations also inform the profile of downside risk. This differs from the sample standard deviation (3.1), where $n - 1$ is used.

Numerical example. The same five returns as in formula (3.1) are used: 12 %, 8 %, −4 %, 15 %, 9 %. $MAR = 5\%$. This allows the results of the two measures to be compared directly.

Deviations from MAR: $12-5 = +7$ (ignored), $8-5 = +3$ (ignored), $-4-5 = -9$ (counted), $15-5 = +10$ (ignored), $9-5 = +4$ (ignored).

The average return: $(12 + 8 - 4 + 15 + 9)/5 = 8.0\%$.

Here the full advantage of this measure can be seen. The same data in formula (3.1) gave $\sigma \approx 7.25\%$, whereas the downside deviation is only 4.02 % — which means that almost half of the dispersion falls on the positive side, and that is not a problem for the investor. By way of comparison, the Sharpe ratio (formula (3.8); $R_f = 2\%$, $\sigma = 7.25\%$) would be $(8.0 - 2)/7.25 \approx 0.83$, and the Sortino ratio 0.75. The difference between these two figures is the answer to the question of how much the result of a risk assessment is determined by the choice of the measure itself.

Where the Sortino ratio is fragile. This measure has a drawback that is easy to overlook, because it lies not in the formula but in the data. The standard deviation (3.1) is calculated from all the observations, whereas the downside deviation is calculated only from those below MAR. In the example above that is one return out of five: the entire variance of 16.2 comes from the single figure $(-9)^2 = 81$.

The practical consequence is serious. If that one return had been not −4 % but −10 %, the downside deviation would rise from 4.02 % to 6.71 %, and the Sortino ratio would fall from 0.75 to 0.27 — almost threefold, on a change in one observation out of five. In the same case the standard deviation would rise from 7.25 % to 9.78 % and the Sharpe ratio would fall from 0.83 to 0.49 — that is, it would fall to 59 % of its initial value, whereas the Sortino ratio would fall to 36 %.

The Sortino ratio is therefore not a “better Sharpe” — it is a different measure, and it pays for its advantage in seeing asymmetry with the stability of the estimate. Downside risk measures shift the problem from the assumptions of the measure to the size of the sample: the fewer the observations below MAR, the less reliable the denominator. In business planning, where series are often five years long, this means two practical rules: state how many observations the denominator was calculated from, and do not compare the Sortino ratios of two projects if their samples or their MAR differ. When there are only one or two observations below MAR, the measure shows a direction, not a magnitude.

The coefficient of variation — relative risk#

The coefficient of variation (CV) makes it possible to compare risk across projects with different expected returns:

where $\sigma$ is the standard deviation and $\bar{R}$ is the average return.

Numerical example.

(a) The scenario. A company has funds for one of two investment projects and must choose. Project A promises a higher return but also greater variability; project B is more modest in both respects. Absolute deviations do not give the answer, because the returns of the projects are not the same.

(b) The values. The expected annual return and the standard deviation of both projects come from a scenario analysis (see Chapter 4):

(c) The calculation. $CV = \sigma / \bar{R}$ for each project:

(d) Interpretation for the decision. Although project B has a smaller absolute standard deviation, its relative risk (CV = 0.75) is greater than that of project A (CV = 0.67): for each percentage point of return, B carries more dispersion. In terms of the risk–return relationship A is the more efficient. The decision, however, is not a matter of CV alone: if the company cannot absorb a loss in an individual year, the absolute deviation of A may be decisive, and B is then chosen, deliberately paying in relative efficiency.

The country risk premium adjustment (Damodaran’s method)#

When valuing a company whose activity is significantly exposed to additional sovereign, political, institutional or macroeconomic country risk, a country risk premium may be added to the mature market equity risk premium:

where:

• $ERP_{mature\ market}$ is the equity risk premium of a mature market (that of the United States, for example),
• $CRP$ is the country risk premium, calculated by Damodaran’s method: the default spread on the country’s bonds, adjusted by the coefficient of relative volatility of the equity and bond markets.

Numerical example (the Lithuanian context). The illustrative example assumes that:

• $R_f = 3.5\%$ (the euro area risk-free rate),
• $ERP_{US} = 4.23\%$ (the mature market premium, January 2026 update; Damodaran, 2026),
• $CRP_{LT} \approx 1.1\%$ (the Lithuanian country premium according to Damodaran’s table, January 2026 update; a Moody’s A2 rating — for a specific valuation the current value from the table must be used; Damodaran, 2026),
• $\beta = 1.1$.

What this formula tacitly assumes. The notation $+\,CRP$ implies the assumption that the firm’s exposure to country risk is average. In Damodaran’s notation this corresponds to $\lambda = 1$: λ is a measure of exposure centred on unity, where a value greater than one indicates exposure above the average (Damodaran, 2003). In practice exposure depends not only on where the firm is registered or where its shares are traded, but also on the geographical distribution of revenue, operations, production and assets. A Lithuanian exporter earning 70 % of its revenue in Germany and a retailer working solely for the domestic market are therefore exposed to country risk unequally, even though both are registered in the same state. How λ is estimated numerically and how it is incorporated into the formula is discussed in Chapter 11.

They are easy to conflate, although they operate at different levels.

Problem	What it changes	The appropriate solution
Country risk	the required return	CRP, taking account of the firm’s exposure ($\lambda$)
A thin capital market	the reliability of market data and of beta	a bottom-up beta, built up from comparable listed firms
The lack of marketability of the shareholding being valued	the value of that particular holding	DLOM, where its application is justified

A small or illiquid capital market does not in itself mean a large country risk premium. It primarily makes it harder to establish reliable market data and beta, and that is resolved by the choice of beta, not by increasing CRP. A discount for lack of marketability does not repair an unreliable beta and is applied not to the discount rate but to the value of a particular equity holding. Lithuania is a good counter-example here: its capital market is comparatively small, yet from this nothing can automatically be concluded about the size of the country risk premium — liquidity and country risk are assessed separately (see section 3.1.5 for more).

For a private business a discount for lack of marketability (DLOM) is additionally applied. There is no universal size for it: the average discounts in the studies reviewed range from 13 to 34 % (Finnerty, 2013), while Damodaran (2012, p. 687) suggests starting a valuation from 25 % and stresses that applying fixed discounts to all private firms is the wrong road to take (ibid., pp. 684, 686). How the discount is chosen and justified in a particular case is discussed in section 13.1.5; WACC and the calculation of the cost of capital are discussed more fully in Chapter 11.

The Sharpe ratio — risk-adjusted return#

Up to this point the measures have answered the question “how much risk?” The Sharpe ratio, which Sharpe (1966) first called the reward-to-variability ratio, answers a different one: how much return is obtained per unit of risk. It is a measure of risk-adjusted return, allowing investments whose return and risk both differ to be compared:

where:

• $R_p$ is the average return of the portfolio (or of the project),
• $R_f$ is the risk-free rate,
• $\sigma_p$ is the standard deviation of the portfolio’s returns (formula 3.1).

The numerator contains the excess return — how much has been earned above what a risk-free alternative would have given. The denominator contains the whole dispersion. The Sharpe ratio and the Sortino ratio (3.5) therefore differ in one respect, but a fundamental one: the Sharpe ratio treats positive and negative deviations equally, whereas the Sortino ratio treats only the negative ones.

Numerical example. The same five returns as in formulas (3.1) and (3.5) are used: 12 %, 8 %, −4 %, 15 %, 9 %. The average return is 8.0 %, the standard deviation 7.25 % (3.1), and the risk-free rate $R_f = 2\%$.

The Sortino ratio for the same data is 0.75 (3.5). The difference is small, but its direction is informative: the Sortino ratio is lower because the downside deviation (4.02 %) makes up a larger share of the excess return than the total deviation would suggest. Had the data contained one strongly negative return, the difference would have been several times larger — and then the choice of measure would have changed the decision, not merely the digit after the decimal point.

The limits of the Sharpe ratio. It rests on the assumption that dispersion is adequately described by the standard deviation, and thus indirectly on the normal distribution assumption (section 3.1.3). For asymmetric or fat-tailed distributions it is systematically more favourable than it ought to be, which is why the measures discussed in Chapter 4 (Omega, CVaR) were developed precisely to offset this shortcoming.

Summary of the formulas#

Table 3.1. The formulas of Chapter 3

3.3 Summary#

This chapter has presented the theoretical foundations of the relationship between business risk and profitability, the quantitative models and a critical analysis of them. The principal conclusions:

1. Risk and profitability are inseparable, but their relationship is not a simple one. Quantitative models (CAPM, Fama-French) formalise this relationship, yet they rest on assumptions that do not always correspond to reality. In practice the risk premium reflects not only statistical dispersion but also market psychology, the institutional environment and liquidity conditions.

2. Not all indeterminacy is of the same kind. Knight’s distinction between risk (which can be calculated) and uncertainty (which cannot) remains fundamental: standard models work in the zone of risk but weaken when they meet genuine uncertainty.

3. Part of risk is diversifiable, part is not. The dichotomy of systematic and unsystematic risk is one of the most important insights of financial theory: the market compensates only non-diversifiable risk. The owner of a private business, however, bears both — and that changes the logic of valuation (see Chapter 14).

4. Risk measures have ontological limits. The standard deviation is symmetric, whereas in business practice losses are asymmetrically more important. The assumption of a normal distribution ignores fat tails. Every measure is an approximation of reality, not reality itself.

5. Behavioural biases systematically distort the assessment of risk. Overconfidence, loss aversion, anchoring and groupthink affect not only individual but also organisational decisions. Structural debiasing strategies (pre-mortem, reference class forecasting, the red team) are a necessary corrective mechanism.

6. Hedging creates value only because of market imperfections. In a perfect market a firm’s hedging adds nothing — the shareholder can hedge on their own. Value arises only through specific channels: the costs of financial distress, tax asymmetry and the sufficiency of internal funds for investment. Every hedging decision must therefore be justified by one of them, and not by a reference to the fact that “the risk is large”.

7. Risk management is not merely the limitation of losses — it can be a mechanism of value creation. An organisation that understands and manages risk better than its competitors can assume riskier but more profitable projects — and that is a competitive advantage in the field of risk management.

In the following chapters these concepts will be applied instrumentally: in Chapter 4 — sensitivity analysis, scenario analysis and Monte Carlo simulations; in Chapter 5 — decisions on diversification and specialisation; in Chapter 11 — the calculation of WACC and the discount rate; in Chapter 14 — real options as a strategic instrument of risk management.

3.4 Case studies and worked examples#

Case 1: The risk profile of a Lithuanian manufacturing company#

Case type: [hypothetical]. The company and its figures have been created for teaching purposes; the market data (the risk-free rate, the mature market premium, the country risk premium) are real and taken from Damodaran’s table of January 2026, while the sector proportions reflect Lithuanian metalworking practice.

The situation#

UAB “Baltico Komponentai” (uždaroji akcinė bendrovė — a limited liability company whose shares may not be offered publicly) is a medium-sized manufacturing company operating in the Kaunas region and producing metal components for the Western European automotive industry. The company’s annual turnover is EUR 12 million and it employs 85 people. In 2025 the company is considering an investment of EUR 3.5 million in a new CNC machining line that would allow it to produce to finer tolerances and to enter the electric vehicle component segment. The investment is financed 60 % by a bank loan and 40 % from own funds.

Risk identification and classification#

Applying the risk taxonomy system presented in section 3.1.2, the following principal risks are identified:

External risks:

• Macroeconomic: fluctuations in euro area interest rates directly affect the cost of servicing the loan. The rise in the European Central Bank’s (ECB) main refinancing rate from 0 % (in 2022) to 4.5 % (in 2023) showed the scale of this risk.
• Geopolitical: dependence on the Western European automotive industry, which is itself under competitive pressure from Chinese electric vehicle manufacturers.
• Technological: the specifications of electric vehicle components change faster than those of the traditional automotive industry — the investment may become obsolete sooner than planned.

Internal risks:

• Operational: a shortage of qualified CNC operators in the Kaunas region; the complexity of integration with the existing production lines.
• Financial: fixed and variable interest rates; there is no currency risk (the company operates within the euro area).
• Strategic: concentration risk — three main customers account for 70 % of revenue.

Quantitative calculation of the risk premium#

Formula (3.7), with the country risk adjustment, is applied:

• $R_f = 3.5\%$ (the euro area risk-free rate)
• $ERP = 4.23\%$ (the mature market premium, January 2026)
• $CRP_{LT} = 1.1\%$ (the Lithuanian country risk premium; Damodaran, 2026)
• $\beta = 1.15$ (the beta of the automotive components sector, adjusted for financial leverage)

The assumption that must be stated. The notation $+\,CRP$ here means $\lambda = 1$, that is, an average exposure to country risk (see section 3.2). The company earns most of its revenue in Western Europe, so its actual exposure to Lithuanian risk is probably lower: taking $\lambda \approx 0.6$, the contribution of the country premium would fall from 1.1 to roughly 0.66 percentage points, and the required return to roughly 9.0 %. The case deliberately retains the more conservative assumption $\lambda = 1$, but that assumption is stated: an unwritten assumption is the most frequent error in valuation, and it is precisely the one that is never checked afterwards.

For a private business illiquidity must additionally be assessed. It is methodologically more transparent to apply DLOM at the level of value rather than of the discount rate — that is, first to calculate the value of the business using the discount rate established above, and then to apply the discount to the value obtained (Damodaran, 2012, p. 689). Damodaran also describes the discount rate route, but warns of the risk of double counting (ibid., p. 674). In practice, particularly in the context of a rapid valuation, a heuristic simplification is sometimes used as well — the cost of equity is increased by about 2–4 percentage points, which in this case would give an indicative effective cost of about 11.5–13.5 %. It is important to understand that this is an approximation and not a theoretically rigorous solution (the specific features of valuing a private business are discussed more fully in Chapter 14).

Conclusions#

This case illustrates how theoretical categories of risk turn into specific elements of a plan. The quantitative CAPM calculation provides a base discount rate, yet the qualitative risk profile (customer concentration, technological transformation, a shortage of employees) is no less important. As Knight’s analysis showed, many of these risks — the technological one in particular — are closer to uncertainty than to calculable risk.

Case 2: A technology start-up and behavioural biases#

Case type: [hypothetical]. The company, its team and its figures have been created for teaching purposes; the market data in the CAPM calculation are real, and the description of public support for innovation corresponds to Lithuanian practice.

The situation#

UAB “HealthAI” is a Vilnius start-up developing an artificial intelligence solution for outpatient diagnostics. The team consists of four engineers and one business development manager. The initial investment was EUR 150 thousand (own funds and financing from the Innovation Agency, Lithuania’s state agency for innovation support). After 18 months of operation the start-up is preparing a business plan for a venture capital fund, seeking a Series A investment of EUR 1.2 million.

Identifying the behavioural biases#

An examination of the “HealthAI” business plan identifies several of the biases discussed in section 3.1.3:

1. Overconfidence. The plan assumes that within three years the start-up will capture 5 % of the Lithuanian outpatient diagnostics market. The figure is presented without any support: the team did not carry out reference class forecasting — it did not check how many similar companies reached such a level of market share at all, and how long it took them. In that case 5 % is not a forecast but an aspiration, and the reader of the plan has nothing by which to judge whether it is realistic. That is precisely the trace of overconfidence in a plan — not the figure itself but the absence of support.

2. The availability heuristic. The “risk” section of the plan is dominated by technological risks (the accuracy of the algorithm, data security) — areas the team understands perfectly. Yet regulatory risk (CE marking for a medical device, GDPR compliance) and commercialisation risk (the duration of hospital procurement processes) are encoded in a single sentence. It is worth noting that these are precisely the two the team cannot assess on the basis of its own competence — they lie beyond its experience. The availability heuristic works here exactly as described in section 3.1.3: the structure of the list of risks reflects not the importance of the risks but how easy it is to think about them.

3. Anchoring. The financial forecasts begin with “if we have 1 000 paying users…” — this figure, attractive though it is, is unsubstantiated and serves as an anchor for the whole of the subsequent model.

4. Escalation of commitment. The team has already invested 18 months of work and EUR 150 thousand. This creates psychological pressure to “go all the way”, even if new data were to show that the market assumptions are mistaken.

The pre-mortem analysis#

Applying Gary Klein’s (2007) pre-mortem technique: “Let us imagine that two years from now the start-up has failed. What were the reasons?”

• The CE marking process (the EU conformity certification required before a medical device may be placed on the market) took 14 months (instead of the 6 planned) and exhausted the cash reserves.
• Hospitals do not buy directly — an integration partner is needed, and none was provided for.
• The lead programmer left the team, and the market for a replacement specialist in Lithuania is very narrow.
• The regulator demanded additional clinical trials, which were not included in the budget.

What return will the fund require?#

A venture capital fund considering a Series A investment starts from the same reference point as any investor — the required return. Formula (3.7) is applied with the same market data as in the first case:

• $R_f = 3.5\%$ (the euro area risk-free rate)
• $ERP = 4.23\%$ (the mature market premium, January 2026)
• $CRP_{LT} = 1.1\%$ (the Lithuanian country risk premium; Damodaran, 2026)
• $\beta = 1.3$ (the beta of the software sector; the start-up has no debt, so no leverage adjustment is applied)

The figure obtained — 10.1 % — is exactly the result that is worth comparing with reality: venture capital funds apply rates several times higher to early-stage start-ups. The difference is not an error in the formula. It arises from the fact that (3.7) sees market risk for a diversified investor, whereas the fund faces three things that are not in the formula at all: the probability of complete failure, illiquidity (the investment is frozen for five to seven years) and Knightian uncertainty, to which probabilities cannot be assigned.

In practice, therefore, the fund calculates not a CAPM return but portfolio logic: out of ten investments, a few must cover them all. For the author of a business plan a specific conclusion follows from this — in this case 10.1 % is not the required return but a lower bound, below which the project does not compete even with a passive market index. This is an illustration of the thesis of section 3.1.3: a measure is valid to the extent that its assumptions are valid, and what breaks here is not the calculation but the assumption of a diversified investor.

The Knightian perspective#

This case illustrates Knightian uncertainty exactly: to many of the risks identified we cannot assign meaningful probabilities, because the start-up operates in a new market niche with no historical analogues in Lithuania. The risk management strategy should therefore rest not on precise figures but on the logic of staged investment (investing in stages, assessing at each of them the information that has newly emerged) and on the principle of a minimum viable product (MVP) — this is real options thinking, which will be discussed in more detail in Chapter 14.

Conclusions#

The case shows three things that recur in early-stage business plans.

First, behavioural biases leave textual traces. Overconfidence is recognised not from an optimistic figure but from the absence of support: a 5 % market share without a reference class is an aspiration, not a forecast. The reader of a plan can look for this systematically.

Second, the quantitative apparatus has a limit here. CAPM with a country premium gives 10.1 %, whereas venture capital funds apply rates several times higher to early-stage start-ups. The difference is not an error in the formula — it arises from what is not in the formula at all: the probability of failure, illiquidity and Knightian uncertainty. The result of the model here needs not to be refined but to be framed.

Third, under conditions of uncertainty the object of the decision itself changes. When probabilities cannot be assigned, what is assessed is no longer the outcome of the project but the structure of choices: staged investment, a minimum viable product, exit points. This is real options thinking, to which Chapter 14 returns.

3.5 Building the Excel model#

Objective#

The student constructs a set of risk measurement calculators implementing all eight formulas of section 3.2: the standard deviation, the beta coefficient, CAPM, portfolio variance with the diversification effect, the Sortino ratio, the coefficient of variation, CAPM with a country risk premium and the Sharpe ratio. The purpose of the model is not merely to calculate — it is to show how the same asset looks under different risk measures, and why the conclusion depends on the measure chosen.

The architecture of the model#

The model consists of nine sheets: an “Įvadas” sheet and one sheet for each formula (F3.1–F3.8). This division follows the logic of the chapter. The fourth conclusion of section 3.3 states that every risk measure is an approximation of reality rather than reality itself; a separate sheet for each measure makes it possible to see that statement in numbers: the same data will give an “acceptable” conclusion on one sheet and a “high risk” one on another, and both conclusions will be correct within the limits of their own measure.

Each sheet is made up of the same six blocks: A the heading and a description of the variables, B the situation (what this calculation is needed for), C the data, D the calculations, E the visualisation with a sensitivity curve and table, F the interpretation.

Named ranges. All the inputs and results are named; the formulas refer to names, not to cell addresses. There are 79 of them in the model, and all have the same structure, CH03_F3_<formula>_<variable> — for example, CH03_F3_2_beta is the result of (3.2), and CH03_F3_7_crp is the country risk premium in formula (3.7). (In the published model the sheet and range names are in Lithuanian: Įvadas — introduction; vid — mean, sigma — standard deviation, sigmap — portfolio standard deviation, divef — diversification effect, svert — weighted, isvada — conclusion, sl — threshold; rank — manual, from rankinis, not “rank”.) The rule is simple: if a value is going to be used in another formula, it must have a name.

Automatic conclusions. In block F of every sheet there is a cell ..._isvada, in which a formula itself states an assessment in a sentence. The thresholds by which it decides are kept in separate cells (..._sl_1, ..._sl_2): beta is compared with 1.0, the Sortino and Sharpe ratios with 1.0 and 0, the coefficient of variation with 0.7 and 1.0, the CAPM return (3.3) with 8 % and 15 %, and CAPM with a country premium (3.7) with 8 % and 14 %. These thresholds are conventional points of reference and not norms, and that is precisely why they are kept in cells: when a threshold is changed, the conclusion changes without any editing of the formula.

Step-by-step instructions#

The sheets are filled in from the most general risk measure to the most specialised. At the end of each step there is a check point: a control question whose negative answer means an error in the model and not bad data.

Step 1. How much does the return fluctuate? (the “F3.1” sheet)#

The returns of five years are entered (CH03_F3_1_r1–CH03_F3_1_r5). The mean CH03_F3_1_vid and the sample standard deviation CH03_F3_1_sigma are calculated according to (3.1). The denominator uses $n-1$, not $n$ — this is the sample formula, not the population one.

Check. If all the returns are multiplied by the same number, the standard deviation must increase by the same factor, while the coefficient of variation (F3.6) must remain unchanged. If σ does not change, the formula is calculating the wrong range.

For this check to work, the toggles CH03_F3_6_sigma_rank and CH03_F3_6_vid_rank on the F3.6 sheet must be switched to linked mode — the standard deviation and the mean are then taken from F3.1 rather than entered by hand. By default the model starts with manual values, so that each sheet can be used independently.

Step 2. How much of the risk is systematic? (the “F3.2” and “F3.3” sheets)#

On the F3.2 sheet, CH03_F3_2_beta (3.2) is obtained from the covariance of the returns of the asset and of the market and from the variance of the market. On the F3.3 sheet, beta together with the risk-free interest rate and the equity risk premium gives the required return CH03_F3_3_er (3.3).

Check. A beta equal to one means that the asset moves together with the market; the CAPM return must then coincide with the market return. If it does not, F3.3 is using the wrong premium or the wrong risk-free rate.

Step 3. What does diversification give? (the “F3.4” sheet)#

The weight of the first asset (CH03_F3_4_w1), the standard deviations of both (..._s1, ..._s2) and the correlation coefficient (..._rho) are entered. The portfolio deviation CH03_F3_4_sigmap (3.4), the weighted average of the individual risks ..._svert and the difference between them — the diversification effect CH03_F3_4_divef — are calculated.

Check. When the correlation equals 1, the diversification effect must be equal to zero: the risk of the portfolio is then a simple weighted average. If the effect is non-zero, there is an error in the formula. When ρ is reduced to −1, the effect must reach its largest value — here the whole logic of diversification can be seen in a single cell.

Step 4. Is all dispersion risk? (the “F3.5” sheet)#

In its denominator the Sortino ratio (3.5) uses only the negative deviations from the target return. The sheet uses the same five returns as F3.1, so that both results can be compared directly — and that is the essence of this step: the logic of two measures on the same data: the standard deviation counts the whole dispersion, the Sortino ratio only the negative part.

Check. If all the returns exceed the target value, the denominator is zero and the Sortino ratio is undefined. The model must show a conclusion rather than an error message: an undefined indicator is also information — there is not a single negative deviation in the data, and the measure is therefore not applicable.

Step 5. How much risk is there per unit of return? (the “F3.6” sheet)#

The coefficient of variation (3.6) is the ratio of the standard deviation to the mean. It is the only measure in this chapter that allows projects of different scale to be compared.

Check. When the mean approaches zero, the coefficient of variation grows uncontrollably. This is not an error in the model but a limit of the measure itself, and it must be reflected in the conclusion in block F.

Step 6. How is a Lithuanian asset to be valued? (the “F3.7” sheet)#

The country risk premium CH03_F3_7_crp (3.7) is added to standard CAPM according to Damodaran’s method. The premium is an input, not a constant: it changes together with the rating and must be taken from a current source on the day of the valuation.

Check. When CH03_F3_7_crp is set equal to zero, the result must coincide with the result of F3.3 for the same inputs. If it does not, beta or the market premium differs between the two sheets.

Step 7. How much excess return is there per unit of risk? (the “F3.8” sheet)#

In its numerator the Sharpe ratio (3.8) has the excess return above the risk-free rate (CH03_F3_8_rf), and in its denominator the whole dispersion. The sheet uses the same five returns as F3.1 and F3.5, so that three measures — the standard deviation and the Sortino and Sharpe ratios — can be compared directly.

Check. When the risk-free rate CH03_F3_8_rf is increased, the Sharpe ratio must fall, while the Sortino ratio on F3.5 must remain unchanged: it is based on the target return CH03_F3_5_mar, not on the risk-free rate. If both change, the sheets are sharing the wrong input field, and the two measures then no longer answer two different questions.

How to check the whole model#

1. Change one input in a blue cell — every result that depends on it must be recalculated, including the sensitivity table in block E and the conclusion in block F.
2. No hard-coded number may remain in the formulas apart from structural ones (0, 1, 2), the number of observations and integer powers.
3. Change the threshold ..._sl_1 — the text of the conclusion must change without any editing of the formula.
4. Compare the conclusions of F3.1, F3.5 and F3.6 for the same data. If they do not coincide, that is not an error — that is the lesson of this chapter.
5. Automatic check: python Excel/patikra.py 3.

Files:

• Excel/CH03/Ch03_Formula_Guide.md — a description of all nine sheets with the named ranges and the Excel formulas (a single source of truth)
• Excel/CH03/Ch03_Model_Master.xlsm — the full model with formulas, charts and sensitivity tables

3.6 Questions and exercises#

3.6.1 Facts and concepts (recognition level)#

Question 3.1 [recognition]. Name the five risk ontologies described in section 3.1.1 and state for each whose perspective it reflects.

Question 3.2 [recognition]. List the four risk management strategies (section 3.1.2) and give one instrument for each.

3.6.2 Explanations (comprehension level)#

Question 3.3 [comprehension]. Explain how systematic risk differs from unsystematic risk and why only one of them enters the CAPM formula.

Question 3.4 [comprehension]. Explain why the Sortino ratio and the standard deviation may give a different assessment of risk for the same data.

Question 3.5 [comprehension]. Explain Knight’s distinction between risk and uncertainty and state why it matters for a business plan. Under what conditions does a probability-based calculation become deceptively precise, and what should a planner do when meaningful probabilities cannot be assigned?

3.6.3 Computational exercises (application level)#

The answers are in Appendix C. They are indicative and intended for self-assessment; the exact figures depend on assumptions that the student must write down clearly.

Question 3.6 [application]. The standard deviation and CV. Two investments generate the following annual returns over six years:

• A: 10 %, 14 %, −2 %, 18 %, 6 %, 12 %.
• B: 5 %, 7 %, 3 %, 8 %, 4 %, 6 %.

Calculate for each investment: (a) the average return, (b) the standard deviation, (c) the coefficient of variation. Which investment is the more efficient in risk–return terms?

Question 3.7 [application]. CAPM with a country premium. Calculate the required return on equity for a Latvian food processing company, given that: $R_f = 3.5\%$; $ERP = 4.23\%$ (the mature market premium, as in the examples in the chapter); $\beta = 0.85$; $CRP_{LV} = 1.55\%$ (the Latvian country risk premium; a Moody’s A3 rating, Damodaran, 2026). Why is the Latvian premium larger than the Lithuanian one (1.1 %), although both countries are in the euro area?

Question 3.8 [application]. The diversification effect. A portfolio is made up of two assets: X ($\sigma_X = 25\%$, weight 60 %) and Y ($\sigma_Y = 15\%$, weight 40 %). Calculate the standard deviation of the portfolio for the correlation coefficients: (a) $\rho = 1.0$; (b) $\rho = 0.5$; (c) $\rho = 0.0$; (d) $\rho = -0.5$. Present the results graphically and comment on them.

Question 3.9 [application]. Sortino and Sharpe. Over five years a project generated the returns: 20 %, −8 %, 15 %, −3 %, 25 %. $MAR = 5\%$, $R_f = 2\%$. Calculate: (a) the Sharpe ratio, (b) the Sortino ratio. Why do the results differ? Which measure better reflects the risk profile of this project?

3.6.4 Comparative analysis (analysis level)#

Question 3.10 [analysis]. Why does CAPM state that the market does not compensate unsystematic risk? Does this mean that the owner of a private business whose wealth is concentrated in a single firm is taking an irrational decision? Justify your position.

Question 3.11 [analysis]. Prospect theory states that losses “weigh” about 2.5 times more heavily than gains. How may this asymmetry affect the decisions of a company’s investment committee? What institutional safeguards could you propose?

Question 3.12 [analysis]. An audit of cognitive biases. Find a publicly available business plan (on a crowdfunding platform, for example, or in the descriptions of projects financed by the Innovation Agency). Identify at least 3 possible cognitive biases (overconfidence, anchoring, the availability heuristic and others) and suggest how the authors of the plan could reduce them.

Question 3.13 [analysis]. A company can hedge against significant fluctuations in the price of a raw material, but the hedging transaction has costs. Why, under conditions of a perfect market, would such a decision not in itself increase the value of the firm? Choose one of the channels of value creation discussed in this section and explain in what circumstances of the firm the benefit of hedging could exceed its costs.

3.6.5 Synthesis and original design exercises (synthesis level)#

Question 3.14 [synthesis]. Risk profile analysis. Choose one company listed on the Nasdaq Vilnius exchange. Using five years of historical data, calculate: (a) the annual standard deviation, (b) the beta coefficient (relative to the OMX Vilnius index), (c) the CAPM required return on equity. Then find an expected annual return on an investment in that company’s shares published by analysts, or justify one yourself, and compare it with the required return. Answer the question whether the forecast return compensates the systematic risk adequately.

The conclusion is formulated not as “the company creates value” but as “the expected return exceeds (or falls short of) the compensation required by CAPM for systematic risk”. Explain why this ex ante comparison is not proof that value has actually been created. Finally, assess how reliable the beta you have calculated is, taking into account the problem of trading liquidity discussed in section 3.1.5.

3.6.6 Open discussion questions (evaluation level)#

Question 3.15 [evaluation]. Is Knight’s distinction between risk and uncertainty practically useful, or is it merely a philosophical abstraction? Give an example of a business situation in which this distinction changes the decision.

Question 3.16 [evaluation]. Nassim Taleb argues that standard risk models create a deceptive sense of security. Does this mean that quantitative models should be abandoned? How is the use of models to be reconciled with an awareness of “fat tails”?

Question 3.17 [evaluation]. Lithuania is classed among the countries with a high credit rating (Moody’s A2), yet its equity market is illiquid and concentrated. How does this affect the calculation of the risk premium by Damodaran’s method? Does the country risk premium adequately reflect the true risk?

3.6.7 Decisions with AI#

The earlier questions in this section test whether the student can calculate and interpret risk measures. These two test something else — whether the student notices what the measure does not see at all. The procedure for completing the tasks is described in Appendix A: the course of the extended task — A.1, the verification protocol — A.2, the handover record — A.3, the verdict — A.4, the defence and opposition — A.5, the assessment criteria — A.6, the conditions — A.7. The appendix must be read before starting the task.

Question 3.18 [basic task]. The situation. UAB “Datalogis” (a hypothetical company) develops logistics planning software. The company employs six people; the core of the product was written and is maintained by two programmers. Revenue comes from four customers, but one of them accounts for about 70 % of revenue and the contract with it is renewed annually. The program obtains data through an interface with a state register whose technical requirements are set by the regulator. An investor is considering acquiring 30 % of the company’s shares and has asked an AI assistant to assess the risk profile. Before reading the AI summary, steps 0a and 0b of the protocol (A.2) are written down.

This is a task at level 2 of openness: where to look for the weak point is not indicated. What follows is the kind of summary an AI assistant produces in a few minutes. There are no arithmetical errors in it — there is no point in looking for any.

The risk profile of UAB “Datalogis”. Net profit over five years (EUR thousand): 210; 225; 240; 250; 265. Average net profit — EUR 238 thousand, standard deviation — EUR 21.4 thousand (formula 3.1), coefficient of variation — 0.09 (formula 3.6). The dispersion is very small, and profit grows every year.

Systematic risk is assessed using the beta of comparable IT services companies: $\beta = 0.95$. Applying CAPM with a country risk premium (formula 3.7): $E(R_e) = 3.5\ \% + 0.95 \times 4.23\ \% + 1.1\ \% = 8.62\ \%$.

Conclusion. A coefficient of variation of 0.09 indicates very low relative risk; a beta close to one means that the company moves together with the market and does not exceed it. The risk profile is to be assessed as low to medium, and a discount rate of 8.62 % is adequate. Recommendation: the transaction is acceptable.

The verification protocol (A.2) is applied to the summary. Recalculating the indicators given is obligatory, but recalculation alone is not enough: it is also necessary to answer the question which part of the value of the business these indicators measure at all. For that purpose the value of the company is decomposed according to the five-layer ontological decomposition presented in Chapter 1 (section 1.1.2), and each layer is assigned a dimension of risk and a way of measuring it according to the table in section 3.1.2.

The quantitative part: calculate how the standard deviation and the coefficient of variation would change if in the sixth year the principal customer were to withdraw and net profit were to become EUR −40 thousand (fixed costs remaining). Compare the result obtained with the one given in the summary.

To be submitted: up to two pages — the records of the eight steps of the protocol (0a, 0b and 1–6), a table of the five layers indicating which layers the indicators of the summary cover and which they leave unassessed, the recalculated indicators, and a verdict with a review condition (A.4). One further question is to be answered: does low historical dispersion mean low risk, or only that the risk has not yet materialised?

Question 3.19 [extended task]. This task is intended to answer independently the question in which part of the value of a business the greatest risk of that business lies, and whether it can be measured at all. The student formulates a research question, delegates part of the analytical work to AI tools, checks the results obtained critically and defends the conclusion in a seminar. The general principles are set out in Appendix A, while the mechanics of the task specific to this chapter are detailed here. The basic task does not require an agent environment; for the extended one the AI agent working environment described in Appendix B is recommended — its files are then submitted together with the work (A.3).

Task conditions. The lecturer assigns each student one of the five layers of value (section 1.1.2). The object — a business in which the greatest risk is concentrated in precisely that layer — is found by the student, and this search constitutes the core of the task. According to the levels of openness set out in A.1 this corresponds to level 4; if the lecturer additionally specifies a sector, to level 3; and in the open variant, where the student also chooses the layer, to level 5.

The addressee of the solution is an investor or a creditor who needs an answer not to what the risk is but to how it is to be measured and what the standard indicators will not say about it.

What the defender must prove. What is defended is not that the assigned layer is important in general — all five take part in the value of every business. What is defended is that the centre of gravity of this business’s risk lies precisely in that layer, and the work must therefore contain three things:

1. Proof that the layer is dominant. Why the greatest risk is asserted to be in the assigned layer and not in another. The argument relies on public information about the specific business, not on the general characteristics of the sector.
2. A measurement decision. How the risk of this layer is measured. For layers 1–2 the indicators of the chapter are applied (formulas 3.1–3.7). For layers 3–5 the formulas of the chapter do not apply directly — a proxy indicator is then proposed (customer concentration, the duration of contracts, dependence on individual employees or on a regulatory decision, for example) and what it does not measure is clearly stated.
3. The limits. It is stated when the chosen measure begins to mislead. Without this part the work is regarded as unfinished.

Quantitative justification (obligatory). At least one indicator is calculated from public data (the State Data Agency, Lithuania’s official statistics authority; Nasdaq Vilnius; company annual reports; sector reviews) and is presented in two ways: as a standard procedure would calculate it, and as it looks once the risk residing in the assigned layer has been taken into account. The difference between these two values is the result of the research. If probabilities cannot be assigned to the risk of the layer, this is stated directly and it is explained why calculating an expected value would in this case be spurious precision (section 3.1.3) — such an answer is assessed in exactly the same way as a figure.

The workflow of the task. The task is carried out in accordance with the E1–E7 workflow described in Appendix A (A.1). The examples for this chapter follow; stage E4 needs no separate example (see A.3). In the examples the assigned layer is layer 5 (the intangible layer). The object is a dairy processor listed on Nasdaq Vilnius (the Lithuanian stock exchange) whose exports were affected by Russia’s import bans of 2013–2014: in 2013 a ban on Lithuanian dairy products, and in August 2014 a wider ban on agricultural imports from the EU (Vitunskienė & Serva, 2017). The risk has already materialised, so it can be checked whether the standard indicators showed it in advance.

• E1. Formulating the research problem.

  A formulation to be avoided: “Regulatory risk in the food industry.”

  A recommended formulation (layer 5): “For a dairy processor listed on Nasdaq Vilnius, does the centre of gravity of risk lie in the intangible layer — in trade permits and import restrictions — and did the standard indicators up to and including 2012 show the risk that materialised with Russia’s import bans of 2013–2014?”

• E2. Analytical objective and format of the result.

  Example (qualitative): “A five-layer map of the company is drawn up according to the table in section 3.1.2: for each layer the main source of risk is named, and it is stated whether the indicators of the chapter capture it. The conditions under which the centre of gravity would shift to another layer are stated — for example, if exports were spread over several markets.”

  Example (quantitative): “The standard deviation and the coefficient of variation of sales revenue (formulas 3.1 and 3.6) and the share of exports to Russia in revenue are calculated from the annual reports. The result is presented in two ways, as the quantitative justification requires: the risk shown by the dispersion up to and including 2012, when the analyst did not yet know about the bans, and the risk once 2013–2015 are included in the series.”

• E3. Decomposition into subtasks and assignment to AI. Examples:

  • the search for the company’s annual reports, the structure of its exports and its share price data — assigned to AI as a source finder; every figure is checked against the information the company has published through Nasdaq Vilnius;
  • the calculation of the standard deviation, the coefficient of variation and beta — not assigned to AI: it is done independently in the Excel model (section 3.5), because the whole conclusion depends on these values;
  • the search for comparable companies in developed markets — assigned to AI as a source finder; the student checks whether the selection is justified, compares their beta with the company’s beta calculated from Nasdaq Vilnius prices and explains the difference by the logic of section 3.1.5: infrequent trading pulls beta towards zero;
  • the argument that the layer is dominant and the choice of a proxy indicator — not assigned to AI: this is the core of the research, for which the student is responsible;
  • a summary of the history of the trade restrictions applied to the sector — assigned to AI; every date and the scope of every measure are checked against the original act of the authority that imposed it, because AI tends to confuse dates and the scope of restrictions.

• E5. Verifying the results.

  Example (protocol step 0a): “The hypothesis is put forward that in the periods when the bans were announced — in 2013 and in August 2014 — the company’s share price fell more than the OMX Vilnius index (the index of all shares listed on Nasdaq Vilnius). The reason is that the shock was specific to the sector and to one market rather than to the economy as a whole. If so, the CAPM discount rate (formula 3.7) does not reflect this risk.”

  Example (protocol step 0b): “The hypothesis is regarded as refuted if in those periods the company’s share price fell no more than the OMX Vilnius index: the risk was then systematic (layer 2a), and the centre of gravity is not the intangible layer.”

  Example (protocol step 4 — key driver): “The key driver is the share of exports to Russia in revenue up to and including 2012. If this share had been 20 % rather than 40 %, the fall in revenue in 2013–2015 and the jump in the coefficient of variation would have been roughly half as large, while the indicators up to and including 2012 would have stayed the same. The conclusion is therefore presented as a dependence on this share rather than as a single figure.”

• E6. Research conclusions and review condition.

  Example: “The centre of gravity of the company’s risk is the intangible layer: a trade restriction in one market can wipe out a large share of revenue within a year. Yet neither the dispersion of revenue up to and including 2012 nor the beta of the company and of comparable companies showed this, because in the period without restrictions these indicators were low. The standard indicators tell how the company fluctuates in calm times, but not how much it can lose. The conclusion is to be reviewed if the share of exports to this market were to fall below 15 % or the company were to obtain permits for at least two new markets — the centre of gravity would then shift to the core (the cash-flow layer).”

• E7. Defence, critique and reflection. The lecturer forms the pairs so that the layers collide (A.8): a student who defended layer 2a (systematic risk) opposes a student who defended the intangible layer, because these are opposite answers to the question of whether market indicators are enough to assess risk (section 3.1.3).

  Example: a student who defended the intangible layer is opposed by an analyst of systematic risk: “You claim that beta does not show the trade restriction. But an investor with a diversified portfolio diversifies such risk away, so CAPM has no reason to price it. Why, then, should this risk change the investor’s decision? Does your conclusion withstand this argument?”

Submission. Up to 4 pages (records E1–E6), with the handover record and the unedited prompt log in an annex (A.3). After the seminar the defender submits a one-sentence reflection and the opponent a three-sentence summary (A.5, E7).

References#

• Artzner, P., Delbaen, F., Eber, J.-M., & Heath, D. (1999). Coherent measures of risk. Mathematical Finance, 9(3), 203–228.
• Bank of Lithuania. (2019). LBChain: Lietuvos banko blockchain platformos bandomasis projektas [LBChain: the Bank of Lithuania’s blockchain platform pilot project]. https://www.lb.lt/lt/lbchain
• Bank of Lithuania. (2021). Makroekonominės prognozės (2021 m. gruodžio mėn.) [Macroeconomic projections (December 2021)]. https://www.lb.lt/
• Bank of Lithuania. (2023a). Kokias didžiausias rizikas finansų sistemai kelia finansinių technologijų sektorius? [What are the greatest risks that the financial technology sector poses to the financial system?] Topical commentary, 14 March 2023. https://www.lb.lt/uploads/documents/files/Fintech_AK.pdf
• Bank of Lithuania. (2023b). Metų ataskaita (2022 m.) [Annual report (2022)]. https://www.lb.lt/
• Banz, R. W. (1981). The relationship between return and market value of common stocks. Journal of Financial Economics, 9(1), 3–18.
• Barro, R. J. (2006). Rare disasters and asset markets in the twentieth century. The Quarterly Journal of Economics, 121(3), 823–866.
• Benn, S., Abratt, R., & Kleyn, N. (2016). Reducing reputational risk: Evaluating stakeholder salience and prioritising stakeholder claims. Marketing Intelligence & Planning, 34(6), 828–842. https://doi.org/10.1108/MIP-10-2015-0191
• Berger, P. G., & Ofek, E. (1995). Diversification’s effect on firm value. Journal of Financial Economics, 37(1), 39–65.
• Bernoulli, D. (1738/1954). Exposition of a new theory on the measurement of risk. Econometrica, 22(1), 23–36.
• Bernstein, P. L. (1996). Against the Gods: The Remarkable Story of Risk. Wiley.
• Bikhchandani, S., Hirshleifer, D., & Welch, I. (1992). A theory of fads, fashion, custom, and cultural change as informational cascades. Journal of Political Economy, 100(5), 992–1026. https://doi.org/10.1086/261849
• Campbell, J. Y., & Cochrane, J. H. (1999). By force of habit: A consumption-based explanation of aggregate stock market behavior. Journal of Political Economy, 107(2), 205–251.
• Campbell, R., Koedijk, K., & Kofman, P. (2002). Increased correlation in bear markets. Financial Analysts Journal, 58(1), 87–94.
• CFTC-SEC. (2010). Findings regarding the market events of May 6, 2010: Report of the staffs of the CFTC and SEC to the Joint Advisory Committee on Emerging Regulatory Issues. U.S. Commodity Futures Trading Commission & U.S. Securities and Exchange Commission. https://www.sec.gov/news/studies/2010/marketevents-report.pdf
• Cho, D. C. (1984). On testing the arbitrage pricing theory: Inter-battery factor analysis. The Journal of Finance, 39(5), 1485–1502. https://doi.org/10.1111/j.1540-6261.1984.tb04919.x
• Christensen, C. M. (1997). The Innovator’s Dilemma: When New Technologies Cause Great Firms to Fail. Harvard Business School Press.
• Corhay, A., Hawawini, G., & Michel, P. (1987). Seasonality in the risk-return relationship: Some international evidence. The Journal of Finance, 42(1), 49–68.
• COSO. (2017). Enterprise Risk Management – Integrating with Strategy and Performance. Committee of Sponsoring Organizations of the Treadway Commission.
• Crawford, J., & Jabbour, M. (2024). The relationship between enterprise risk management and managerial judgement in decision-making: A systematic literature review. International Journal of Management Reviews, 26(1), 110–136. https://doi.org/10.1111/ijmr.12337
• Curran, D. (2020). Connecting risk: Systemic risk from finance to the digital. Economy and Society, 49(2), 239–264. https://doi.org/10.1080/03085147.2020.1718912
• Dajčman, S., Festić, M., & Kavkler, A. (2013). Multiscale test of CAPM for three Central and Eastern European stock markets. Journal of Business Economics and Management, 14(1), 54–76. https://doi.org/10.3846/16111699.2011.633097
• Damodaran, A. (2003). Measuring company exposure to country risk: Theory and practice. SSRN. https://doi.org/10.2139/ssrn.889388
• Damodaran, A. (2012). Investment Valuation: Tools and Techniques for Determining the Value of Any Asset (3rd ed.). Wiley.
• Damodaran, A. (2026). Country default spreads and risk premiums [data set, January 2026 update]. https://pages.stern.nyu.edu/~adamodar/
• De Groot, K., & Thurik, R. (2018). Disentangling risk and uncertainty: When risk-taking measures are not about risk. Frontiers in Psychology, 9, Article 2194. https://doi.org/10.3389/fpsyg.2018.02194
• Dichev, I. D. (1998). Is the risk of bankruptcy a systematic risk? The Journal of Finance, 53(3), 1131–1147.
• Dionne, G. (2013). Risk management: History, definition, and critique. Risk Management and Insurance Review, 16(2), 147–166. https://doi.org/10.1111/rmir.12016
• Fama, E. F., & French, K. R. (1992). The cross-section of expected stock returns. The Journal of Finance, 47(2), 427–465.
• Fama, E. F., & French, K. R. (1993). Common risk factors in the returns on stocks and bonds. Journal of Financial Economics, 33(1), 3–56.
• Fama, E. F., & French, K. R. (2015). A five-factor asset pricing model. Journal of Financial Economics, 116(1), 1–22.
• Finnerty, J. D. (2013). The impact of stock transfer restrictions on the private placement discount. Financial Management, 42(3), 575–609. https://doi.org/10.1111/fima.12003
• Flyvbjerg, B. (2006). From Nobel Prize to project management: Getting risks right. Project Management Journal, 37(3), 5–15.
• Flyvbjerg, B. (2014). What you should know about megaprojects and why: An overview. Project Management Journal, 45(2), 6–19. https://doi.org/10.1002/pmj.21409
• Flyvbjerg, B., & Budzier, A. (2011). Why your IT project may be riskier than you think. Harvard Business Review, 89(9), 23–25.
• Friede, G., Busch, T., & Bassen, A. (2015). ESG and financial performance: Aggregated evidence from more than 2000 empirical studies. Journal of Sustainable Finance & Investment, 5(4), 210–233. https://doi.org/10.1080/20430795.2015.1118917
• Froot, K. A., Scharfstein, D. S., & Stein, J. C. (1993). Risk management: Coordinating corporate investment and financing policies. The Journal of Finance, 48(5), 1629–1658. https://doi.org/10.1111/j.1540-6261.1993.tb05123.x
• Galdos-Urbizu, L., Ortas, E., & Alvarez-Etxeberria, I. (2025). ESG risk exposure, management and firm risk: New evidence from a panel quantile regression approach. Cogent Business & Management, 12(1), 2585542. https://doi.org/10.1080/23311975.2025.2585542
• Gu, S., Kelly, B., & Xiu, D. (2020). Empirical asset pricing via machine learning. The Review of Financial Studies, 33(5), 2223–2273. https://doi.org/10.1093/rfs/hhaa009
• Handa, P., Kothari, S. P., & Wasley, C. (1993). Sensitivity of multivariate tests of the capital asset-pricing model to the return measurement interval. The Journal of Finance, 48(4), 1543–1551. https://doi.org/10.1111/j.1540-6261.1993.tb04767.x
• Huang, H.-C. (2001). Tests of CAPM with nonstationary beta. International Journal of Finance & Economics, 6(3), 255–268.
• ISO. (2018). ISO 31000:2018 Risk management – Guidelines. International Organization for Standardization.
• Janis, I. L. (1972). Victims of Groupthink: A Psychological Study of Foreign-Policy Decisions and Fiascoes. Houghton Mifflin.
• Jegadeesh, N., & Titman, S. (1993). Returns to buying winners and selling losers: Implications for stock market efficiency. The Journal of Finance, 48(1), 65–91.
• Jensen, M. C., & Meckling, W. H. (1976). Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of Financial Economics, 3(4), 305–360.
• Kahneman, D., & Lovallo, D. (1993). Timid choices and bold forecasts: A cognitive perspective on risk taking. Management Science, 39(1), 17–31.
• Kahneman, D., & Tversky, A. (1979). Prospect theory: An analysis of decision under risk. Econometrica, 47(2), 263–291.
• Kindleberger, C. P. (1978). Manias, Panics, and Crashes: A History of Financial Crises. Basic Books.
• Kindleberger, C. P., & Aliber, R. Z. (2005). Manias, Panics, and Crashes: A History of Financial Crises (5th ed.). Wiley.
• Kirilenko, A., Kyle, A. S., Samadi, M., & Tuzun, T. (2017). The Flash Crash: High-frequency trading in an electronic market. The Journal of Finance, 72(3), 967–998. https://doi.org/10.1111/jofi.12498
• Klein, G. (2007). Performing a project premortem. Harvard Business Review, 85(9), 18–19.
• Knight, F. H. (1921). Risk, Uncertainty and Profit. Houghton Mifflin.
• Lakonishok, J., Shleifer, A., & Vishny, R. W. (1994). Contrarian investment, extrapolation, and risk. The Journal of Finance, 49(5), 1541–1578.
• Langley, P. (2013). Anticipating uncertainty, reviving risk? On the stress testing of finance in crisis. Economy and Society, 42(1), 51–73. https://doi.org/10.1080/03085147.2012.686719
• Lintner, J. (1965). The valuation of risk assets and the selection of risky investments in stock portfolios and capital budgets. The Review of Economics and Statistics, 47(1), 13–37.
• Liu, E. X., & Song, Y. (2025). ESG performance, environmental uncertainty, and firm risk. Journal of International Financial Management & Accounting, 36(2), 292–322. https://doi.org/10.1111/jifm.12227
• Lu, Y., Liu, J., & Yu, W. (2024). Social risk analysis for mega construction projects based on structural equation model and Bayesian network: A risk evolution perspective. Engineering, Construction and Architectural Management, 31(7), 2604–2629. https://doi.org/10.1108/ECAM-04-2022-0319
• Lynch, P., & Rothchild, J. (1989). One Up on Wall Street: How to Use What You Already Know to Make Money in the Market. Simon & Schuster.
• MacKenzie, D. (2006). An Engine, Not a Camera: How Financial Models Shape Markets. MIT Press.
• Mandelbrot, B. B. (1963). The variation of certain speculative prices. The Journal of Business, 36(4), 394–419.
• Markowitz, H. (1952). Portfolio selection. The Journal of Finance, 7(1), 77–91.
• Mehra, R., & Prescott, E. C. (1985). The equity premium: A puzzle. Journal of Monetary Economics, 15(2), 145–161. https://doi.org/10.1016/0304-3932(85)90061-3
• Miller, K. D., & Reuer, J. J. (1996). Measuring organizational downside risk. Strategic Management Journal, 17(9), 671–691.
• Ministry of the Economy and Innovation. (2026). Lietuvos pramonės skaitmeninimo kelrodžio 2020–2030 m. tarpinė apžvalga [Interim review of the Lithuanian industrial digitalisation roadmap 2020–2030]. https://eimin.lrv.lt/public/canonical/1773120394/6407/Lietuvos%20pramon%C4%97s%20skaitmeninimo%20kelrod%C5%BEio%202020%E2%80%932030%20m.%20tarpin%C4%97%20ap%C5%BEvalga%202026%20m.%20sausis.pdf
• Ministry of Finance of the Republic of Lithuania. (2021). Ekonominės raidos scenarijus 2021–2024 metams. 2021 m. gruodis [Economic development scenario for 2021–2024. December 2021]. https://finmin.lrv.lt/
• Modigliani, F., & Miller, M. H. (1958). The cost of capital, corporation finance and the theory of investment. The American Economic Review, 48(3), 261–297.
• Mossin, J. (1966). Equilibrium in a capital asset market. Econometrica, 34(4), 768–783.
• Nyberg, H. (2011). Forecasting the direction of the US stock market with dynamic binary probit models. International Journal of Forecasting, 27(2), 561–578. https://doi.org/10.1016/j.ijforecast.2010.02.008
• Roll, R. (1977). A critique of the asset pricing theory’s tests Part I: On past and potential testability of the theory. Journal of Financial Economics, 4(2), 129–176.
• Roll, R., & Ross, S. A. (1980). An empirical investigation of the arbitrage pricing theory. The Journal of Finance, 35(5), 1073–1103.
• Ross, S. A. (1976). The arbitrage theory of capital asset pricing. Journal of Economic Theory, 13(3), 341–360.
• Russo, J. E., & Schoemaker, P. J. H. (1992). Managing overconfidence. Sloan Management Review, 33(2), 7–17.
• Schwartz, P. (1991). The Art of the Long View: Planning for the Future in an Uncertain World. Currency Doubleday.
• SEC. (2020, 5 August). Staff report on algorithmic trading in U.S. capital markets. U.S. Securities and Exchange Commission. https://www.sec.gov/files/algo_trading_report_2020.pdf
• Sharpe, W. F. (1964). Capital asset prices: A theory of market equilibrium under conditions of risk. The Journal of Finance, 19(3), 425–442.
• Sharpe, W. F. (1966). Mutual fund performance. The Journal of Business, 39(1), 119–138.
• Smith, C. W., & Stulz, R. M. (1985). The determinants of firms’ hedging policies. Journal of Financial and Quantitative Analysis, 20(4), 391–405. https://doi.org/10.2307/2330757
• Sortino, F. A., & van der Meer, R. (1991). Downside risk. The Journal of Portfolio Management, 17(4), 27–31. https://doi.org/10.3905/jpm.1991.409343
• Stapel, D. A., Reicher, S. D., & Spears, R. (1994). Social identity, availability and the perception of risk. Social Cognition, 12(1), 1–17. https://doi.org/10.1521/soco.1994.12.1.1
• Taleb, N. N. (2007). The Black Swan: The Impact of the Highly Improbable. Random House.
• Tversky, A., & Kahneman, D. (1974). Judgment under uncertainty: Heuristics and biases. Science, 185(4157), 1124–1131.
• Vaughan, E., & Seifert, M. (1992). Variability in the framing of risk issues. Journal of Social Issues, 48(4), 119–135. https://doi.org/10.1111/j.1540-4560.1992.tb01948.x
• Vitunskienė, V., & Serva, E. (2017). Lithuanian agri-food industry responses to Russian import ban on agricultural products (Working Paper No. 136/2017). Institute of Economic Research. https://ideas.repec.org/p/pes/wpaper/2017no136.html