No Risk It, No Biscuit
Analyzing Risk Factors at public companies
🚨GOAT SPOTTING🐐
I interviewed the Godfather of SaaS metrics, Alex Clayton of Meritech Capital. We went DEEP on LTV to CAC, Net Dollar Retention, and Contribution Margin. This was a benchmarking PalooZa for all the SaaS nerds.
Listen on: Spotify / Apple / Youtube
My love affair with 10K’s started in 2013. My first gig out of college was a consultant in PwC’s risk advisory group. And consultant is a generous term. I was really a lackey for the higher ups… a paper weight who also knew how to get coffee.
My first project was to inventory 10K’s from 100 companies. 10K’s are an annual disclosure that publicly traded companies provide with their financial results to provide background on their business model, the executives working there, and the potential risks you may incur when investing.
As a member of the Risk Advisory group they wanted me to compare how many of the stated risk factors in the 10Ks were overlapping.
About a thousand cups of crappy office coffee later (Flavia, anyone?) I figured out that probably 70% of the risk factors were fluff - CYA’s that were so broad they didn’t mean much.
But there was probably 30% in there that was real signal. It was like a glimpse into what kept an executive up at night.
I figured that if I could separate the signal from the noise, I could better understand how businesses compete and what levers they could pull to go faster.
In many ways, risk factors actually identified the underlying opportunities.
More than ten years later I’ve decided to dust off my 10K boots and go digging for Risk Factors again. So I called the data gurus at Virtua Research to see which Risk Factors were most prevalent, and which were more bespoke to a particular business model or industry.
For our analysis we used a sample of 40 companies:
Risks Related to Business
Unable to maintain/improve revenue growth in future:
100%, 40 / 40
Customer attrition & inability to expand customer base:
100%, 40 / 40
Employee attrition:
100%, 40 / 40
Operational dependency on third parties:
100%, 40 / 40
OK, so up until now, a lot of CTRL + C, CTRL P by the compliance departments…
Failure to maintain and enhance the brand recognition:
65%, 26 / 40
Unfavorable media coverage:
63%, 25 / 40
Alrite, alrite, starting to get interesting…
Declines in renewals or purchases of additional licenses:
48%, 19 / 40
Long and unpredictable sales cycle:
40%, 16 / 40
Seasonality:
40%, 16 / 40
Actual losses may exceed our insurance reserves:
28%, 11 / 40
Confluent
Digital Ocean
DoorDash
Freshworks
Marqeta
Okta
RobinHood
Tenable
Toast
UiPath
Zscaler
I was talking to a CFO about insurance policies last week - past a certain point you are just trying to determine what level of risk you are comfortable with self underwriting as a matter of doing business. It would be too expensive to literally insure everything.
Also, if you are a security company, there really is no insurance policy big enough for you… if you get breached (like a SolarWinds) it’s kind-of-sorta a binary outcome if you go out of business or not, since the nature of your business is security.
Dependency on small number of customers & suppliers (for certain components):
20%, 8 / 40
Cloudflare
Guidewire
Marqeta
Palantir
Samsara
Twilio
UiPath
Veeva
If I recall correctly, Twilio includes a slide in every investor presentation to show top 10 customer revenue concentration.
Failure to meet publicly announced guidance:
18%, 7 / 40
Now we’re cooking!
Damn! 82% of ya’ll are feeling good about your ability to forecast in this dumpster fire of a macro environment! Good for you!
Misconduct by employees:
10%, 4 / 40
Bumble
Okta
Robinhood
Samsara
Hmmmm I guess it makes sense that a dating app company may have more internal misconduct risk than your typical tech firm…
And a password / security company could have employee conduct issues leading to breaches….
While it’s also understandable that a trading platform may have employees with access to inside trading information…
Samsara though…IoT fleet mgmt wasn’t on my bingo card here.
Substantial revenue from limited number of products:
8%, 3 / 40
Autodesk
Freshworks
Peloton
Autodesk is a vertical software for the construction, engineering, and design sector. They have many flavors of pretty much the same design product. This checks out.
Freshworks has a compelling customer service product, but has yet to expand to other verticals within companies.
Peloton does technically have BOTH a bike AND treadmill product, but I guess that isn’t exactly diversification.
Risks associated with our non-marketable securities, including partial or complete loss of invested capital:
5%, 2 / 40
MongoDB
Workday
I’d assume some of these riskier positions are related to investments they’ve made in smaller startups out of their corporate VC arms… Not easy assets to move over night.
Risks related to Market/Industry
Change in local or international economic/political conditions:
100%, 40 / 40
Loss of market share - intense competition:
100%, 40 / 40
Currency fluctuations:
98%, 39 / 40
Challenges associated with international expansion (regulatory/monetary):
98%, 39 / 40
Cryptocurrency's price volatility:
5%, 2 / 40
Marqeta
Robinhood
Insert crypto joke here.
Risks related to Cyber-attacks, Data/Product Safety
Vulnerability to cyber-attack/ data/product safety:
100%, 40 / 40
Inability to obtain, maintain and protect IP:
100%, 40 / 40
40/40 on plagiarism.
Risks related to Ineffective strategy
Ineffective S&M strategy:
33%, 13 / 40
Potential R&D failure, investment in creating new product or platform:
15%, 6 / 40
Autodesk
Bumble
Qualtrics
Salesforce
Uber
Veeva
I think it’s telling that more companies (twice as many) are worried about execution risk (can I sell it?) compared to technical risk (can I build it?)
Risks related to Finance & Accounting
Inability to raise additional capital:
63%, 25 / 40
Substantial indebtedness:
63%, 25 / 40
Inherent challenges in measuring key performance metrics using internal tools:
48%, 19 / 40
Payment processing risk:
15%, 6 / 40
Chewy
Cloudflare
Gitlab
Peloton
Robinhood
Zoom
Risk of non-payment/fraud:
8%, 3 / 40
Palantir
Peloton
Toast
Considering Palantir’s #1 customer is the US Government, I find risk of non-payment/fraud both funny and scary.
Other Risk Factors
Risks related to Laws & regulations:
100%, 40 / 40
Risks related to Ownership/class A common stock:
100%, 40 / 40
Risks related to Lack of innovation/technological advancement:
100%, 40 / 40
Risks related to Natural disasters, pandemics, and other catastrophic events:
100%, 40 / 40
Risks related to Business restructuring:
85%, 34 / 40
Risks related to Defect in product or platform/technical issues:
83%, 33 / 40
And some boiler plate CYA to finish it off.
A word from our sponsor - Tropic
True story - I was on the horn with Tropics VP of Marketing last week, talking newsletter stuff and shooting the breeze. It came up that Q4 is a busy season for more than just sales teams - as a CFO, I find myself buying a lot of software. And at that moment I had a proposal from Gong on the table.
The next thing you know, we were running a price check together on the deal. Fast forward and a few drop downs later (like literally under 90 seconds), I was looking at benchmarks for what someone like me should be paying for the tool, given the package and number of licenses that we wanted.
I’ve always said that he or she who holds the data holds the power. So I went back to Gong and got another 15% chopped off.
Don’t buy before you run a check - you can run one for free today.
Quote I’ve Been Pondering
“If my critics saw me walking on water, they’d say it was because I couldn’t swim.”
-Unknown