Financial Risk Management for a Small Business, Line by Line

Financial risk management for a small business is mostly a count of concentrations: one large customer, one bank, one payments provider, one currency, one floating rate, one person who can move the money. Each failure lands in the same place, the next year’s cash. Count them, spread the cheap ones and hold cash against the rest.

US accounting already defines the test: under ASC 275, a company discloses a concentration that could cause a severe impact within one year. The standard presumes that any customer can be lost in that time. From 1994 to 2022, only 49.2% of new US employer establishments survived five years (SBA Office of Advocacy, 2026). This piece applies that test to six risks and prices each for a hypothetical company.

Exhibit 1. Financial risk management for a small business: six risks, five of them concentrations

Risk	The concentration	How it reaches cash	First measure	Usual remedy
Customer	A few customers carry most revenue	A lost contract or unpaid invoice	Largest share; effective number of customers	More customers; a reserve
Bank and counterparty	Cash at one bank; payroll through one provider	Uninsured balances frozen; a payroll run that never arrives	Balance above $250,000; cash held by third parties	A second bank; knowing who holds the money
Currency	Revenue and costs in different currencies	A margin lost overnight	Net exposure per currency	Invoicing in the cost currency; forwards
Interest rate	Debt priced off one floating rate	Interest rises with prime	Floating debt times a 5-point rise	A fixed or capped rate
Fraud	Payment authority in one person	Diverted payments, found a year later	People needed to release a payment	Dual approval; independent reconciliation
Liquidity	Cash against the five lines above	A payroll the balance cannot meet	Months of operating costs in cash	A reserve sized to the largest line

Source: CX Cash synthesis; measures defined below.

Financial risk management in a small firm is a count of concentrations

Sorting risk into credit, liquidity, market and operational categories suits banks and funds that hold thousands of positions. A small business holds a handful: perhaps 40 customers, one bank, one payroll provider and one line of credit. With so few positions, the main risk is that one of them fails, which is what a concentration is. ASC 275 defines the vulnerability as the case where an entity “is exposed to a greater risk of loss than if it had mitigated that risk through diversification” (PwC Viewpoint on ASC 275).

The standard sets three conditions for disclosure: the concentration exists at the balance-sheet date, it could cause a near-term severe impact, and that impact is at least reasonably possible. Near term means within one year. A severe impact is “a significant financially disruptive effect” on normal functioning, a higher bar than a material one. The standard also settles the likeliest question in advance: it is “always considered at least reasonably possible that any customer, grantor, or contributor will be lost in the near term”.

SEC rules ask the same of smaller public companies. Regulation S-K tells a smaller reporting company to describe, where material, any “dependence on one or a few major customers” (17 CFR 229.101). Few small businesses publish accounts, but the test travels, because it asks one question of every dependency: if this failed within a year, could the company still function?

The answer usually falls on the owner: in the Federal Reserve Banks’ 2025 Small Business Credit Survey, 59% of employer firms with debt had secured it with a personal guarantee. The survey is a convenience sample of 6,525 firms (Federal Reserve Banks, 2026).

Where a concentration cannot be removed, the answer is cash. The IMF, which lends to countries that cannot borrow elsewhere, says it “has limited ability to diversify its loan portfolio”. High credit concentration, it adds, is “a likely consequence of the IMF’s mandate”. It holds precautionary balances and a 20% liquidity cushion against that exposure (IMF, 2015). A small firm is nothing like the IMF in scale, but a dominant customer it cannot replace this year puts it in the same position: a concentration that only cash can offset.

A customer list with a 40% customer behaves like five equal customers

Antitrust law has a standard measure of concentration. The 2023 Merger Guidelines of the Justice Department and the Federal Trade Commission use the Herfindahl-Hirschman Index (HHI), “the sum of the squares of the market shares”. Markets above 1,800 count as highly concentrated (DOJ and FTC, 2023). The reciprocal of the index is the effective number: the count of equal-sized customers that would produce the same concentration (Wikipedia, Herfindahl-Hirschman index).

Edward Simpson introduced the same formula in 1949, a year before Orris Herfindahl, and ecologists still call it the Simpson index (Wikipedia, Diversity index). Simpson’s reading gives the index a meaning a founder can use. It is “the probability that two entities taken at random from the dataset of interest represent the same type”: draw two dollars of revenue at random, with replacement, and the index is the chance that both came from one customer.

Consider a hypothetical customer list of 40 names. The largest buys 40% of its revenue, the next two 15% and 10%, and the other 37 share the remaining 35% equally.

Exhibit 2. A hypothetical 40-customer list behaves like five equal customers

Customer list	Largest share	HHI (points)	Chance two revenue dollars share a customer	Effective customers
Hypothetical company: 40%, 15%, 10%, then 37 at 0.95% each	40.0%	1,958	19.6%	5.1
The same company after losing its largest customer	25.0%	995	9.9%	10.1
40 equal customers	2.5%	250	2.5%	40.0
5 equal customers	20.0%	2,000	20.0%	5.0

Source: hypothetical company; our calculation. HHI as in the 2023 Merger Guidelines: shares in percent, squared and summed. Effective customers = 10,000 ÷ HHI.

The list has 40 names, yet its revenue behaves like 5.1 equal customers (our arithmetic). Its index sits above the 1,800 line for a highly concentrated market. The second row shows why the index alone misleads: losing the largest customer doubles the effective number to 10.1 while cutting revenue by 40%. The index measures the shape of the exposure, and Exhibit 4 measures its size.

Among listed companies, lenders and investors price the shape: Dan Dhaliwal and co-authors found “a positive association between customer concentration and a supplier’s cost of equity” among US listed companies. They found the same for the cost of debt (Dhaliwal et al., 2016). Small firms carry the same exposure: in the 2024 survey, 45% of employer firms counted other businesses among the customer types that each bring in 10% or more of sales. For 15% it was state and local governments, for 7% the federal government (Federal Reserve Banks, 2025). The survey counts customer types, not single customers, so it bounds the problem without measuring it.

Banks and payment processors concentrate cash where the balance sheet does not show it

Spreading customers takes years, but the cash they pay sits with a counterparty from the day it arrives. FDIC insurance covers “$250,000 per depositor, per FDIC-insured bank, for each account ownership category” (FDIC). Any operating balance above that is an uninsured claim on one bank.

Silicon Valley Bank showed that the bank can carry a concentration of its own. The Federal Reserve’s review lists “a highly concentrated business model, and a reliance on uninsured deposits” among its vulnerabilities, and venture-backed companies held more than half of its deposits at the end of 2022 (Federal Reserve, 2023). Its customers’ cash was concentrated in a bank whose own deposits were concentrated in them.

Money in transit is harder to see. MyPayrollHR, a payroll company owned by ValueWise of Clifton Park, New York, was meant to pass employers’ payroll to their staff through a trust account at a processor. Its owner, Michael Mann, changed the payment files to send the money to accounts he controlled. When Pioneer Bank froze those accounts on or about 30 August 2019, the freeze “caused several thousand people across the country to not receive a payroll payment”. Hundreds of small businesses were left with payroll and tax payments unprocessed. Mann was sentenced in 2021 to 144 months for a scheme that caused more than $100 million in losses (US Attorney, Northern District of New York, 2021).

Neither exposure shows in the victims’ accounts in advance. Both show in a list of where each dollar sits overnight and who can move it. A second bank for operating cash costs little; so does asking a payroll provider how long it holds the company’s money, and in whose name.

Currency and rate risk are concentrations in a price the company does not set

Some concentrations are bets on a single price, and small firms make more of them than the bank taxonomy suggests. Small businesses are 97.2% of US exporters (SBA Office of Advocacy, 2026). In the 2025 credit survey, 48% of employer firms bought some inputs abroad, and 14% bought most of them there (Federal Reserve Banks, 2026).

A central bank’s promise is no substitute for a hedge. On 6 September 2011 the Swiss National Bank set a floor of CHF 1.20 per euro and announced that it “will enforce this minimum rate with the utmost determination and is prepared to buy foreign currency in unlimited quantities” (SNB, 2011). On 15 January 2015, 1,227 days later, it announced that it “is discontinuing the minimum exchange rate of CHF 1.20 per euro” (SNB, 2015). The ECB’s reference rate fell from 1.201 francs per euro on 14 January to 1.028 the next day (ECB). A Swiss exporter invoicing in euros lost 14.4% of its franc revenue overnight (our arithmetic), on an exposure a central bank had promised to cap.

Rates move more slowly. JPMorgan Chase’s posted prime rate stood at 3.25% from March 2020 and reached 8.50% on 27 July 2023, 16 months after the first increase (JPMorgan Chase). The SBA’s 7(a) loans follow it: their rates are capped at a spread over prime or an optional peg rate, fixed or variable (SBA). On a hypothetical $400,000 credit line at prime plus 2 points, annual interest went from $21,000 to $42,000.

Rising rates also sank Silicon Valley Bank, which the Fed found “failed to assess and manage the interest rate risk (IRR) in its rapidly growing securities portfolio” (Federal Reserve, 2023). For a small firm the remedies are standard: invoice in the currency of the costs, buy currency forward for known payments, and fix or cap the rate on long debt.

Fraud concentrates payment authority, and small firms concentrate more of it

The last concentration sits inside the company. The Association of Certified Fraud Examiners’ 2024 report covers 1,921 cases of occupational fraud investigated between January 2022 and September 2023 (ACFE, 2024). Organisations with fewer than 100 employees accounted for 21% of cases and a median loss of $141,000, the second-largest of four size bands. Check and payment tampering appeared in 23% of their cases, against 9% elsewhere. The ACFE’s explanation is structural, since a smaller staff “typically means there are fewer checks and balances and less segregation of duties in place”.

Exhibit 3. Organisations with fewer than 100 employees run fewer anti-fraud controls

Control in place	Fewer than 100 employees	100 or more employees
Management review	39%	79%
Hotline	27%	82%
Surprise audits	17%	49%
Job rotation or mandatory vacation	10%	27%

Source: ACFE, Occupational Fraud 2024: A Report to the Nations, Figure 30. Share of victim organisations with each control; cases investigated by Certified Fraud Examiners, not a random sample.

Time multiplies the loss. The median fraud ran for 12 months before detection; frauds caught within six months cost a median $30,000, against $250,000 for those that ran two to three years. Tips uncovered 43% of the ACFE’s cases, which is why the missing hotline matters.

Fraud from outside follows the same logic. The FBI’s Internet Crime Complaint Center recorded 21,442 complaints of business email compromise in 2024 and $2,770,151,146 of reported losses (FBI IC3, 2024). That is about $129,000 per complaint (our arithmetic), and speed decides recovery here as well. The IC3 reports a 66% success rate for its Recovery Asset Team, which froze $469.1 million domestically and $92.5 million abroad against $848.4 million of attempted theft. The remedy is to split authority. Two people release a payment, a call to a known number confirms any new bank details, and someone who cannot pay reconciles the accounts each month.

One page prices each risk in months of operating costs

The six risks need one unit and one page: a line for each thing the company depends on, the cash that line could cost within a year in months of operating costs, and the remedy. That page is financial risk management at small-firm scale. The hypothetical company in Exhibit 4 has $3.0M of annual revenue, operating costs of $240,000 a month and $600,000 in one bank account, or 2.5 months of costs. Its largest customer pays 40% of revenue and can leave on 60 days’ notice. A quarter of its revenue is billed in euros and payroll runs twice a month through an outside provider. It has drawn $400,000 on a credit line at prime plus 2 points.

Exhibit 4. Six concentrations priced for a hypothetical small company, $ thousands

Concentration	Stress within one year	Cash at risk	Months of operating costs	Remedy	Can it be spread now?
Largest customer, 40% of revenue	Leaves on 60 days’ notice; 10 months of lost contribution	700	2.9	A reserve; more customers	Slowly
One bank	Bank fails; balance above $250,000	350	1.5	A second bank or a sweep	Yes
Payment authority	A fraud at the ACFE small-organisation median	141	0.6	Dual approval; reconciliation	Yes
Euro revenue, 25% of revenue	Euro falls 14.4%, as it did against the franc in January 2015	108	0.5	Dollar invoicing; forwards	Yes
Payroll provider	One semi-monthly run lost in transit	78	0.3	Asking who holds the money	Partly
Floating debt of $400k	Prime rises 5.25 points, as in 2022 to 2023	21	0.1	A fixed or capped rate	Yes
Cash on hand		600	2.5

Source: hypothetical company, our calculation. The euro stress borrows an observed one-day move between two other currencies. Lost contribution at 70% of the customer’s revenue (variable costs at 30%). Payroll at 65% of operating costs, paid in two runs a month. Fraud loss: ACFE (2024) median for organisations with fewer than 100 employees. Stresses are applied one at a time, so the lines do not add up.

Three conclusions follow. The bank, fraud, payroll and rate lines put $590,000 at risk between them, and each shrinks with a second account, a second signature, a question to a provider or a fixed rate. The euro line needs a change to invoicing or a forward contract.

The customer line cannot be spread this year. At $700,000 it exceeds the company’s cash by $100,000, or 0.4 months of costs. In ASC 275’s terms it is a near-term severe impact that is always reasonably possible. The answer is the IMF’s: a reserve, a committed credit line or a written plan to cut costs within the notice period, sized to the largest line rather than to an average month.

Carnegie’s one-basket rule holds for seed-stage firms

The best case against all this predates the HHI by 60 years. In 1885 Andrew Carnegie told students at the Curry Commercial College in Pittsburg to “concentrate your energy, thought, and capital exclusively upon the business in which you are engaged”. He called the proverb about eggs and baskets all wrong and offered his own: “put all your eggs in one basket, and then watch that basket” (Carnegie, 1885). Modern evidence takes Carnegie’s side: Panos Patatoukas found that a concentrated customer base goes with higher accounting returns among listed suppliers, “suggesting that efficiencies accrue to suppliers with concentrated customer bases” (Patatoukas, 2012).

Carnegie has a point about young companies: a seed-stage firm cannot diversify its way to safety. Its first large customer is often the reason it survives, and chasing small accounts can cost the focus that earns its margins. The evidence for staying concentrated is thinner than it looks. Patatoukas studied listed suppliers, which had survived long enough to list, and Dhaliwal’s team found the same concentration associated with a higher cost of equity and debt. Carnegie’s advice also had a second half and a cash rule. Watching the basket is the one-page list above, and in the same address he told the students to “never indorse beyond your surplus cash fund”. For financial risk management, the lesson is to concentrate on purpose, measure the concentration and hold cash against it.

Seven steps from a list of dependencies to the board pack

1. List every concentration: customers above 10% of revenue, balances above $250,000, providers that hold the company’s money, currencies, floating rates and anyone who can pay alone.
2. Put a cash figure on each line, and send the board that list itself rather than a list of risk categories.
3. Compute the effective number of customers each quarter (10,000 divided by the HHI), and report it beside the largest customer’s share, with how both moved over the year.
4. Shrink the cheap lines now: a second bank, dual approval on payments, a callback before changing a supplier’s bank details, a fixed or capped rate on long debt.
5. Make sure no one person can release a payment, and record who last reconciled the bank accounts.
6. Know where operating cash sits overnight and how much of it is insured.
7. Size the cash reserve or committed credit line to the largest line that cannot be spread this year, and run its failure through the scenario planner below.

Every concentration fails into the same account

Financial risk management for a small business is a short list. Customers, banks, payment providers, currencies, rates and the people who sign payments each fail into the same account. US accounting already supplies the horizon (one year) and the presumption (any customer can leave); the work is to price each concentration in months of costs, spread the cheap ones and hold cash for the one that is not. The page has one limit to keep in view: it applies each stress on its own, so a year in which two lines fail together, say a lost customer and a frozen bank balance, would cost more than any single row shows.

Sources and notes

• Association of Certified Fraud Examiners (2024). Occupational Fraud 2024: A Report to the Nations.
• Board of Governors of the Federal Reserve System (2023). Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank.
• Carnegie, A. (1885). The road to business success: a talk to young men. Address to students of the Curry Commercial College, Pittsburg, 23 June 1885. In The Empire of Business (1902). Toronto: W. Briggs.
• Dhaliwal, D., Judd, J. S., Serfling, M. and Shaikh, S. (2016). Customer concentration risk and the cost of equity capital. Journal of Accounting and Economics 61(1), 23–48. Quoted from the abstract of the SSRN working paper (2014).
• European Central Bank. Euro foreign exchange reference rates, Swiss franc per euro, January 2015 (ECB Data Portal).
• Federal Bureau of Investigation, Internet Crime Complaint Center (2025). Internet Crime Report 2024.
• Federal Deposit Insurance Corporation. Understanding Deposit Insurance.
• Federal Reserve Banks (2025). 2025 Report on Employer Firms: Findings from the 2024 Small Business Credit Survey.
• Federal Reserve Banks (2026). 2026 Report on Employer Firms: Findings from the 2025 Small Business Credit Survey.
• International Monetary Fund (2015). IMF Financial Operations 2015, chapter 6, Financial Risk Management.
• JPMorgan Chase. Historical Prime Rate.
• Patatoukas, P. N. (2012). Customer-base concentration: implications for firm performance and capital markets. The Accounting Review 87(2), 363–392.
• PwC. Financial statement presentation guide, section 24.3, Risks and uncertainties: disclosure (Viewpoint), on FASB ASC 275-10.
• Securities and Exchange Commission. Regulation S-K, Item 101, Description of business (17 CFR 229.101).
• Small Business Administration. Terms, conditions, and eligibility: 7(a) loan program.
• Small Business Administration, Office of Advocacy (2026). Frequently Asked Questions About Small Business.
• Swiss National Bank (2011). Swiss National Bank sets minimum exchange rate at CHF 1.20 per euro. Press release, 6 September 2011.
• Swiss National Bank (2015). Swiss National Bank discontinues minimum exchange rate and lowers interest rate to –0.75%. Press release, 15 January 2015.
• US Attorney’s Office, Northern District of New York (2021). ValueWise CEO Michael Mann sentenced to 144 months in prison for $100 million fraud. Press release of 4 August 2021, as reposted by IRS Criminal Investigation.
• US Department of Justice and Federal Trade Commission (2023). Merger Guidelines.
• Wikipedia. Diversity index; Herfindahl–Hirschman index.

ASC 275 is quoted from PwC’s guide to the standard. The Small Business Credit Survey figures come from convenience samples and the ACFE’s from cases its members investigated, so neither describes a random sample of small firms. Where no source is named, a figure is worked out by CX Cash from the cited data, and the company in Exhibits 2 and 4, with its credit line and its stresses, is hypothetical.