Editorial note: This version preserves the original article's depth and argument, while tightening technical language around CSRP, adding global evidence and integrating Clybourne's IVS-compliant valuation reporting capability.

Here's the strange fact about business valuation

Two companies can have the exact same revenue, the same margins and the same growth forecast — and still be worth meaningfully different amounts.

Not because anyone did the math wrong.

Because one company might have a single customer responsible for 60% of its revenue. Another might have 200 customers. One might depend heavily on its founder. The other might have a deep management team and documented processes.

The financial projections may look identical.

The risk isn't.

And the valuation model has to account for that difference somewhere.

That “somewhere” often has a name: Company-Specific Risk Premium — CSRP.

It is one of the most judgment-heavy components of a private company valuation. And that's precisely what makes it interesting — and difficult.

Why This Number Gets Treated Like an Afterthought

Most components of a valuation discount rate have observable market evidence behind them.

Beta is derived from market price movements. The equity risk premium is supported by observed market returns and capital-market research. Country risk premiums can be informed by sovereign spreads and other market indicators.

CSRP is different.

There is no market index that tells you: “This company deserves an additional 3.7% because 58% of its revenue depends on one customer.”

That is where professional judgment enters the valuation process.

And professional judgment is not the problem.

Unsupported judgment is.

It is easy to type “3%” into a spreadsheet. It is considerably harder to explain why the appropriate premium is 3% rather than 5%, demonstrate what risk the premium represents, and show that the same risk has not already been reflected somewhere else in the valuation.

That distinction matters because CSRP directly affects the discount rate — and the discount rate directly affects the present value of future cash flows in a DCF valuation.

A higher discount rate generally means a lower present value. A seemingly small change in the discount rate can therefore create a meaningful difference in business value.

What Is a Company-Specific Risk Premium?

At its simplest, a company-specific risk premium is an additional return adjustment intended to reflect risks that are specific to the subject company and are not adequately captured by other components of the discount rate.

The key phrase is: not adequately captured elsewhere.

That qualification is critical.

A valuation analyst should not simply identify every business risk and add a percentage for each one. The objective is to understand the company's overall risk profile and determine which risks remain unaccounted for after considering the other elements of the valuation methodology.

This is particularly relevant in private company valuation, where the subject company may have characteristics that differ substantially from the larger public companies used to establish market-based inputs.

What Is CSRP Actually Trying to Answer?

Strip away the mechanics and CSRP is trying to address a practical question:

What additional return, if any, would be appropriate given the risks that are unique to this particular company and are not already reflected elsewhere in the valuation?

That is different from asking, “How risky is this industry?” Industry risk should already be considered through the broader cost-of-capital framework.

It is also different from asking, “How risky is the economy?” Macroeconomic and market risks are addressed through other valuation inputs.

CSRP is about what remains at the company level.

Relevant factors can include operating history, customer concentration, supplier concentration, earnings volatility, competitive position, management depth, key-person risk, access to capital, operational exposure, technology dependence and geographic or regulatory concentration.

What Does Global Research Say About Company-Specific Risk?

This isn't simply a theoretical debate among valuation practitioners.

A 2021 peer-reviewed study published in the Journal of Forensic Accounting Research examined private-company transactions and the relationship between transaction characteristics, capitalization rates, industry risk premiums and company-specific risk.

The study found that company-specific risk accounted for at least 50% of the capitalization rate in its sample. It also found that the industry risk premium represented less than 2% of the capitalization rate, while still being significantly associated with company-specific risk.

That finding is significant.

But it needs to be interpreted correctly.

It does not mean that every private company should receive a CSRP equal to 50% of its capitalization rate. It means that, within the study's sample and methodology, company-specific risk represented a substantial component of the capitalization rates observed.

Good valuation analysis isn't about turning one research statistic into a universal rule. It is about understanding what the evidence actually says.

The Academic Debate: Does Company-Specific Risk Deserve a Premium?

CSRP is not universally accepted as a simple plug-in adjustment.

Under traditional CAPM, investors are assumed to be diversified. Company-specific or unsystematic risk can therefore be diversified away and, theoretically, should not command a separate expected return in the same way systematic market risk does.

That creates a fundamental tension in private-company valuation.

If company-specific risk is theoretically diversifiable, why should it increase the required return?

Valuation practitioners have reasons for considering company-specific adjustments in private-company contexts, particularly where the subject company's characteristics create risks not fully reflected in market-based inputs.

But this is precisely why CSRP remains one of the most debated areas of business valuation methodology.

The question isn't simply whether a risk exists.

The question is: How should that risk be reflected in value — through the cash flows, through the discount rate, through carefully separated treatment of both, or not at all?

That is why a defensible valuation methodology matters.

Case Study 1: When a Court Challenged CSRP

In re Sunbelt Beverage Corp. Shareholder Litigation, the Delaware Court of Chancery considered competing discounted cash flow analyses, including arguments over the propriety and amount of a company-specific risk premium.

The court rejected the proposed CSRP in that case. Among its concerns was that some cited risks were industry-wide rather than company-specific, while the proposed 3% premium lacked a specific quantitative financial analysis supporting its level.

The lesson is not “never use CSRP.”

The lesson is: don't use CSRP as a black box.

If the analyst cannot explain what the risk is, why it is company-specific, how material it is, where it enters the valuation, and why it hasn't already been captured, the premium becomes difficult to defend.

Case Study 2: Company-Specific Risk Can Be Economically Meaningful

Delaware cases also show the other side of the debate. Courts have recognized that company-specific risk can be relevant when supported by facts.

In Coster v. UIP Companies, the court considered key-person risk and the interaction between projected cash flows and a specific-company risk premium. The case is particularly useful because it highlights the double-counting problem: a risk reflected by materially reducing cash flows should not automatically be reflected again through a full discount-rate premium.

The lesson is nuanced: company-specific risk may matter, but the valuation analyst needs to demonstrate how it affects the economics of the business and avoid charging the same risk twice.

Customer Concentration: From Qualitative Risk to Quantitative Analysis

Customer concentration is one of the clearest examples.

Suppose 60% of a company's revenue comes from one customer.

The obvious question is: What happens if that customer leaves?

A rigorous analysis would consider probability of customer loss, contractual protections, renewal history, switching costs, relationship duration, replacement difficulty, gross-margin impact, time required to replace revenue, management's ability to diversify, and whether the forecast already assumes some deterioration.

Recent international valuation work from Willamette Management Associates specifically explores how customer-concentration risk can be incorporated into the CSRP framework by linking modeled cash-flow disruption scenarios to implied discount-rate adjustments.

That is a more defensible conversation than: “Customer concentration looks risky, so let's add 3%.”

The better question becomes: “What is the economic impact of this risk, and what discount-rate adjustment would produce a comparable valuation effect?”

The Biggest Trap: Double-Counting Risk

Suppose a business has significant customer concentration.

An analyst responds by reducing projected revenue because of the risk.

Then the analyst adds a CSRP because of the same customer concentration.

The risk may now be reflected twice.

Once in the cash flows. Again in the discount rate.

That isn't necessarily conservative. It may simply be double-counting.

A robust DCF valuation should therefore ask: Where has this risk already been reflected?

If the forecast already incorporates a lower probability of renewal, a slower growth trajectory or a margin impact associated with customer concentration, the remaining risk should be assessed before adding another discount-rate adjustment.

One economic risk should not automatically become two valuation adjustments.

The Second Trap: Averaging Away the Risk

Imagine a company receives the following assessments:

Operating history — Low
Customer concentration — Very High
Management depth — Medium
Technology exposure — Low
Competitive position — Medium

A simple average might produce “Overall Risk = Medium.”

But averages can hide what matters most.

If 60% of revenue depends on one customer, having an excellent technology stack doesn't make that concentration disappear.

Likewise, fifteen years of operating history doesn't eliminate key-person risk.

A company's risk profile is not always additive. Some risks are simply more consequential than others.

The objective should not be to mechanically average risks until every company lands somewhere in the middle. It should be to identify which risks can materially affect the company's ability to generate future cash flows.

Key-Person Risk: The Risk That Doesn't Appear on the Balance Sheet

Consider a founder-led company where one individual owns the major client relationships, approves key decisions, controls pricing, manages the senior team and holds critical technical knowledge.

Financial statements won't necessarily tell you how dependent the business is on that person.

But an investor will.

If that individual leaves, retires or becomes unavailable, the impact could include customer attrition, operational disruption, recruitment costs, delayed decisions, loss of institutional knowledge, lower growth or reduced margins.

That doesn't automatically mean a CSRP should be added.

It means the risk deserves to be identified, assessed and considered within the overall private company valuation.

The question remains: How much of this risk is already reflected in the forecast, and how much remains?

Why “Just Pick a Percentage” Doesn't Work

One of the biggest weaknesses in CSRP analysis is starting with the number instead of the risk.

For example: “Small private company. Add 4%.”

That's not a methodology.

A defensible approach works in the opposite direction:

Identify → Evidence → Assess → Separate → Quantify → Validate

1. Identify: What specific company-level risks exist?
2. Evidence: What facts support the existence and materiality of each risk?
3. Assess: How could the risk affect future cash flows or investor return requirements?
4. Separate: Which portion is already reflected in the projections or other discount-rate components?
5. Quantify: What residual risk remains?
6. Validate: Does the resulting valuation make economic sense relative to comparable companies, transactions and other valuation approaches?

That's the difference between a number and a methodology.

What Makes a CSRP Defensible?

A defensible company-specific risk premium should create a clear chain of reasoning:

Risk identified → Evidence gathered → Potential financial impact assessed → Existing valuation treatment reviewed → Double-counting considered → Residual risk quantified → CSRP determined.

The final percentage is therefore not the starting point.

It is the output of the analysis.

From Valuation Number to Valuation Intelligence

Financial statements tell you what happened.

Forecasts tell you what management expects to happen.

Market data tells you how comparable businesses have historically been priced.

But company-specific risk asks a different question:

What makes this business different?

That's where technology can help.

An AI-powered business valuation platform can help structure information, surface patterns and create consistency across the valuation process.

Where Clybourne Fits In

This is where Clybourne's business valuation methodology can add value.

Clybourne evaluates company-specific risk through defined factors rather than treating CSRP as an arbitrary percentage added at the end of a valuation model.

Each factor is assessed against the company's actual circumstances.

The objective is not to make a business look riskier.

It is to understand where the risk actually sits.

And importantly, the methodology considers the significance of individual risk factors rather than simply averaging every factor into a comfortable middle ground.

Clybourne also provides IVS-compliant, AI powered valuation reports, giving the valuation conclusion a reporting framework aligned with the International Valuation Standards.

The Number Isn't the Point

The irony of CSRP is that everyone wants the number.

“What’s the premium?”

But the number is actually the final step.

The real work happens before it.

What risks does the company face?

Which ones are genuinely company-specific?

Which ones are already reflected in the cash flows?

Which ones are already captured through beta, industry risk, size-related adjustments or other components of the cost of capital?

Which risk could materially change the company's ability to generate future cash flows?

And what evidence supports the conclusion?

Only after answering those questions does the percentage become meaningful.

Because a defensible valuation isn't one where everyone agrees with the number.

It's one where someone can challenge the number — and you can show them exactly how you got there.

That's the difference between a CSRP that is simply calculated and one that can actually be defended.

What This Means for Business Owners, Investors & Advisors

Whether you're evaluating a business for a potential acquisition, preparing for an M&A transaction, conducting a shareholder valuation, assessing enterprise value or trying to understand what your company is actually worth, the discount rate deserves more attention than a single cell in a spreadsheet.

Revenue tells you the size of the business.

Margins tell you how efficiently it operates.

Growth tells you where it could go.

Risk tells you how confidently an investor can believe it will get there.

And that's why company-specific risk belongs in the valuation conversation.