Good startup due diligence covers the most important parts of a business that investors need to understand before making an investment decision. This typically includes the team, product, market, competition, go-to-market strategy, intellectual property and competitive moats, financials, legal issues, exit strategy, and deal terms. Most of the time, these categories are sufficient for pre-seed and seed-stage diligence.
But looking back at my own portfolio, I've noticed that some of the companies that failed did so for reasons I never anticipated. In many cases, I couldn't have predicted exactly what would happen, and neither could the founders. These failures sometimes seemed to come out of left field, caused by factors that weren't part of the company's business strategy or even on our diligence checklist.
What's missing is a structured look at the external factors that could impact the success of the business.
Think about the collapse of Silicon Valley Bank in 2023. Startups with great teams, products, and business models suddenly found themselves unable to access their cash, putting payroll and even their survival at risk. The problem had nothing to do with whether their underlying businesses were good investments. It was an external risk that few investors had anticipated.
While some external risks come up during the normal due diligence process, particularly when identifying key risks or assessing valuations using risk-based methods, the coverage can be hit or miss.
Many strategic planners use the STEEPL framework, which looks at Social, Technological, Economic, Environmental, Political, and Legal factors that could affect a business. It's a good way to take a broader view of the world in which a startup operates, rather than focusing entirely on the company itself.
You can also add industry-specific categories, such as regulatory risk for life science companies, supply chain dependencies for hardware startups, or changing reimbursement policies for healthcare companies.
The goal isn't simply to identify more risks. It's to understand which external changes could seriously affect the company's prospects, how likely they are, and whether the company has the resilience to survive them.
You'll never identify every risk, no matter how good your frameworks are or how hard your due diligence team works. And some risks really will come out of left field.
A good external risk assessment doesn't need to be complicated. For each significant risk, ask four questions: What could go wrong? How likely is it to happen? How serious would the consequences be? And what has management done to mitigate the risk? These questions help investors distinguish between risks that are merely possible and those that could materially affect the investment outcome. They also reveal something important about how well management anticipates and prepares for challenges beyond its control.
But just because you can't predict every external risk doesn't mean you shouldn't systematically look for them.
Adding a structured external risk assessment to your diligence process is a relatively simple step that could help you avoid some very expensive surprises.
.jpg)
