A risk is something that could happen but hasn't happened yet. A signal is something that is already happening. Risks are handled with plans and scenarios. Signals require action and decisions. A risk can sit in a report for years. A signal has to be handled now, often before anyone else can see it clearly.
Where the two get mixed up
Most businesses have a risk list — in a spreadsheet, in a report, or on the CFO's desk. It contains scenarios: what happens if customers drop off, if raw material prices rise, if a key employee leaves. Those are real and necessary questions.
The problem starts when a signal gets treated like a risk instead of moving onto the decision list. A large customer has started talking to a competitor. That's no longer a risk — it's a signal. The lender has asked for monthly reporting. That's not a risk — it's a signal. When signals get treated as risks, they get handled with plans instead of with decisions.
How to tell them apart in practice
Three questions to see the difference:
- Has something already happened in the real world? If yes, it's a signal — not a risk.
- Can you put a date on the first sign? If yes, it's a signal.
- Would an outsider describe it as a problem to act on — or a scenario to consider? The first is a signal. The second is a risk.
Why it matters
A risk can exist for a long time without costing the business anything. Signals start costing you from the moment they appear. Every month a signal gets treated as a risk usually costs the business something concrete — in liquidity, in customers, in options.
The most important exercise an owner-CEO can run every quarter is to go through the risk list and ask: which of these have already happened? Those are the ones to stop analysing and start acting on immediately. That's often where businesses lose time they don't get back.