Top 3 risks + mitigations
Name the three biggest risks to the business right now, each with a mitigation already underway, not a plan to make a plan.
This is the slide that earns a founder credibility; Suster argues boards trust founders who name risk plainly more than founders who present only good news.
- Exactly 3 risks, ranked by severity
- A specific mitigation in progress for each, with an owner
- Risks that are actually uncomfortable, not softballs
- Risks with no mitigation attached
- Generic macro risks ('the economy') that avoid naming a company-specific problem
- The listed risks are all external and none are things the team controls
- A known risk from last quarter's deck has vanished with no update
- Listing 6+ risks so the real one gets diluted
- Naming a risk with no owner assigned to the mitigation
- · Would a skeptical director agree these are the top 3 risks, or spot a bigger one missing?
- · Does every risk from last quarter's deck get a status update, even if just 'resolved'?
[Risk]: [why it matters]. Mitigation: [specific action], owner [name], by [date].
"Market conditions remain uncertain and there is always execution risk in a competitive space."
"Risk: 6-month runway (cash-out Aug 2026) with burn at $312K/mo against $280K budget. Mitigation: hiring freeze on 2 open roles starting Sept, CFO cutting burn to $270K/mo by Nov, owner: CEO."
Nimbus ties the risk directly to the runway number from the dashboard, with a dated fix and a named owner, not a vague promise to 'watch it closely.'
Quick quiz
1. What must accompany each of the three risks?
- ○ A severity color
- ✓ A specific mitigation already in progress, with an owner
- ○ A comparison to a competitor
- ○ Nothing, naming it is enough
A risk without a mitigation is just an admission, not a plan.
2. Why cap this slide at exactly 3 risks?
- ○ Boards can't count higher
- ✓ Forcing a ranked top 3 makes founders prioritize instead of listing everything vaguely risky
- ○ It's a template rule with no real reason
- ○ Legal requires a maximum of 3
A list of 8 risks reads as unprioritized; a ranked 3 reads as a founder in control of the picture.