Professional services risk management: the top risks 56 professional services firms disclose
Good professional services risk management starts with knowing which risks your peers actually face. Consultancies, staffing firms and engineering services businesses sell people’s time and expertise. Their risk profile follows: talent, clients, contracts and data. We counted how many of 56 US-listed professional services firms disclose each risk in their latest annual report and compared the result with fourteen other industries.
The most widely disclosed risks for professional services firms are cyberattack (84%), intense competition (80%) and acquisitions that fail to deliver (79%). The clearest distinctive risk is talent: 71% disclose a risk of failing to attract and retain skilled staff.
- Cyberattack exposing data and disrupting operations: 84% of firms (85% on average in the other fourteen industries).
- Failure to attract and retain skilled staff: 71%, against 26% elsewhere — one of only two distinctive risks for the sector.
- Economic downturn reducing client demand: 70% (30% elsewhere).
- Evolving privacy laws: 64%, well above the 40% average elsewhere.
- Customer churn and non-renewal (50% vs 13%), fixed-price contract overruns (38% vs 4%) and rising wage costs (34% vs 9%) are much more common than in most sectors.
Turn this list into your own risk registerRisk Samurai starts you with the risks typical for professional services firms, then helps you score them, assign owners and track actions.
Get early accessHow we built this. We took the Risk Factors section of the latest annual report of 56 US-listed professional services firms on SEC EDGAR (filed 29 September 2025 to 26 June 2026), recorded every disclosed risk and grouped equivalent risks across companies. “Share” is the percentage of professional services firms whose filing discloses the risk. Disclosure is not likelihood: filings are written by lawyers, are over-inclusive and come from public companies that are mostly larger than a typical small business, and shares are approximate. Full method and caveats.
Who is in the sample
The benchmark covers 56 professional services firms: all 56 filed a Form 10-K, with filing dates between 29 September 2025 and 26 June 2026. By SEC industry code (SIC), the group is made up of 26 management consulting (8742), 17 help supply (staffing) (7363), 6 engineering services (8711), 3 employment agencies (7361), 3 management services (8741) and 1 legal services (8111).
In plain words, the sample is a mix of mid-sized consulting, staffing and engineering firms. Median annual revenue is about $536 million; the smallest firm reports around $2.1 million and the largest around $18 billion. The median filing yields 53 distinct risks (range 23–96). More than a third of the firms are staffing businesses (help supply services and employment agencies), so labour cost and client demand risks weigh more heavily than they would for a sample of pure advisory firms.
| Measure | Value |
|---|---|
| Companies | 56 |
| Annual reports | 56 × 10-K |
| Filing dates | 29 September 2025 – 26 June 2026 |
| Annual revenue | median $536 million; smallest $2.1 million; largest $18 billion |
| Risks identified per filing | median 53 (range 23–96) |
| Company-level risks the filing explicitly calls new this year | 4.3% |
The top 30 risks professional services firms disclose
The table ranks risks by the share of professional services firms whose annual report discloses them. The last column is the average share across the other fourteen industries in our study, so you can see at a glance whether a risk is generic to listed companies or particular to this sector. Risks marked distinctive are disclosed by at least 20% of professional services firms and by at least 15 percentage points more than in any other industry.
| # | Risk | Prof. services companies | Other industries (avg) |
|---|---|---|---|
| 1 | Cyberattack exposing data and disrupting operations Hacking, malware or ransomware against company systems exposes confidential or personal data and disrupts operations, causing liability, regulatory penalties, financial loss and reputational damage. | 84% | 85% |
| 2 | Intense competition eroding share and pricing Larger, lower-cost, private-label or new competitors undercut prices or outperform on products, causing loss of customers, market share and margins. | 80% | 69% |
| 3 | Acquisitions fail to integrate or deliver benefits Poor selection, valuation or integration of acquired businesses diverts management and disrupts operations, so expected synergies and returns are not realised and results suffer. | 79% | 73% |
| 4 | Failure to attract and retain skilled staff distinctive Intense competition for scarce skilled personnel may prevent recruitment and retention of needed staff, impairing operations, strategy execution and growth. | 71% | 26% |
| 5 | Economic downturn reducing customer demand Recession, inflation, tariffs or geopolitical shocks lead customers to cut or delay spending, reducing demand, volumes, prices and revenue. | 70% | 30% |
| 6 | Evolving privacy laws raising compliance costs New, changing and inconsistent privacy laws across jurisdictions require costly changes to systems and practices, raising compliance costs and exposure to penalties. | 64% | 40% |
| 7 | Loss of senior executives or key employees Unexpected departure of senior executives or key employees without ready replacements could disrupt operations, impair strategy execution and harm financial results. | 62% | 55% |
| 8 | Debt covenant restrictions and breach Restrictive covenants constrain operations, and a breach or cross-default allows lenders to accelerate debt, halt funding and enforce security over assets. | 59% | 40% |
| 9 | General insurance inadequate, unavailable or costly Insurance limits, exclusions, insurer disputes, rising premiums or unavailability leave property, catastrophe and liability losses uninsured and increase costs. | 57% | 40% |
| 10 | Adverse changes in tax laws and rates Changes in domestic or foreign tax laws, rates or interpretations increase effective tax rates and cash taxes, reducing earnings and cash flow. | 55% | 53% |
| 11 | Internal IT system failure or outage Failure, defect or interruption of internal information systems could halt transaction processing and services, causing financial loss, data loss and reputational harm. | 55% | 43% |
| 12 | Goodwill and intangible asset impairment Weaker performance, forecasts or market valuations reduce the fair value of goodwill and intangible assets, requiring non-cash impairment charges that reduce earnings and equity. | 50% | 33% |
| 13 | Customer churn and non-renewal Customer dissatisfaction, price rises or short-notice terminations lead clients to cancel, downsize or not renew, reducing recurring revenue and utilisation. | 50% | 13% |
| 14 | Loss of major customers Revenue concentrated in a few large customers means their loss, reduced orders, non-renewal or default could materially reduce revenue, profitability and cash flow. | 50% | 23% |
| 15 | Evolving AI laws and liability New, divergent AI laws and flawed AI outputs may restrict AI use, require costly compliance changes and expose the company to fines and liability. | 46% | 41% |
| 16 | Adverse litigation and legal proceedings Lawsuits, claims and legal proceedings may produce adverse judgments, settlements and defence costs exceeding insurance, diverting management and harming reputation. | 46% | 64% |
| 17 | Political and legal risks of foreign operations Operating across foreign jurisdictions exposes the business to political instability, differing laws, tax, currency and expropriation, increasing costs and reducing profitability. | 45% | 32% |
| 18 | Inadequate protection of own intellectual property Weak registration, protection or enforcement of proprietary technology and rights allows competitors to copy or misappropriate it, eroding competitive advantage and revenue. | 41% | 43% |
| 19 | Ineffective internal control over financial reporting Weak internal controls or unremediated material weaknesses may cause misstated or late financial reports and restatements, leading to sanctions and loss of investor confidence. | 39% | 54% |
| 20 | Volatile quarterly results missing expectations Uneven order timing, fixed costs and other variable factors cause quarterly results to fluctuate and miss guidance, undermining forecasts and the share price. | 39% | 29% |
| 21 | Fixed-price contract cost overruns Inaccurate cost or scope estimates on fixed-price contracts, or unapproved extra work, cause overruns and unrecovered costs, eroding margins or creating losses. | 38% | 4% |
| 22 | Customer non-payment of trade receivables Customer financial distress, disputes or economic weakness lead to late or non-payment of invoices, causing bad debts, write-offs and reduced operating cash flow. | 38% | 15% |
| 23 | Inability to raise additional capital Adverse market or company conditions prevent raising debt or equity on acceptable terms, forcing curtailed growth or operations, or dilutive and restrictive financing. | 38% | 49% |
| 24 | Substantial indebtedness constraining cash flow High leverage, including further permitted borrowing, diverts cash flow to debt service and limits flexibility, increasing vulnerability to downturns and default. | 38% | 42% |
| 25 | Pandemic disruption to operations and demand A pandemic or public health crisis and related restrictions could disrupt workforce, suppliers and customer demand, reducing revenue and straining liquidity. | 36% | 34% |
| 26 | Government contracting compliance and audits Breaches of procurement rules or adverse government audits may lead to cost disallowance, False Claims liability, termination and debarment. | 34% | 6% |
| 27 | Cyber insurance inadequate or unavailable Cyber insurance limits, exclusions, denial or unavailability leave security incident losses and liabilities uninsured, causing unexpected costs. | 34% | 32% |
| 28 | Rising wage and labour costs Wage pressure, minimum wage laws, payroll taxes and labour shortages raise employment costs that cannot be fully recovered, reducing margins. | 34% | 9% |
| 29 | Rapid growth straining management and controls Rapid growth outpaces management capacity, systems, staffing and controls, causing operational errors, service decline, higher costs and failure to execute plans. | 34% | 26% |
| 30 | Third-party vendor breach exposing company data Weak security at vendors or service providers holding company, customer or employee data leads to a breach, causing data exposure, regulatory liability, litigation and reputational harm. | 32% | 32% |
Professional services risk is mostly about the people who deliver the work and the clients who pay for it. Beyond talent, the list includes loss of senior executives or key employees (62%), loss of major customers (50%), customer churn and non-renewal (50%) and non-payment of invoices (38%). For firms that sell hours, revenue is only as stable as the client book and the bench.
Data is the other big theme. Firms hold their clients’ confidential and personal information, so a breach is both a data protection matter and a breach of client trust. Evolving privacy laws (64%), internal IT failures (55%), inadequate cyber insurance (34%) and vendor breaches (32%) all rank in the top 30.
Contract economics show up too. Fixed-price contract overruns (38%) and government contracting compliance and audits (34%) reflect the engineering and public-sector consulting firms in the sample: pricing errors and audit findings land directly on margin. Debt covenants (59%) and goodwill impairment (50%) follow from the acquisitive growth model many listed firms use, and inadequate or costly insurance (57%) covers the professional liability that every adviser carries.
What is distinctive about professional services firms
Only two risks meet our strict test for being distinctive to professional services (disclosed by at least 20% of firms and at least 15 percentage points more often than in any other industry). The sector shares most of its risk profile with others, and several of its characteristic risks are disclosed even more often by construction or hospitality companies. We cover the two distinctive risks, plus three that do not meet the test but are far more common here than in most industries.
Failure to attract and retain skilled staff
71% of professional services firms disclose it, against 26% on average in the other industries.
In a business that sells expertise, staff are the product. High attrition raises recruitment and training costs, weakens delivery quality and puts client relationships at risk when the people who own them leave. Useful controls include succession plans for key client relationships, retention arrangements for scarce skills, utilisation and wellbeing monitoring to catch burnout early, and exit interviews that are actually analysed.
AI-driven competitive disruption
27% of professional services firms disclose it, against 3% on average in the other industries.
Generative AI can do part of what junior consultants, analysts and researchers do, and clients know it. The risk is pricing pressure on hourly work and loss of routine engagements to competitors who adopt AI faster or to clients who do the work themselves, rather than sudden obsolescence. Firms that respond well tend to redesign offers around outcomes, build AI into delivery under clear quality controls and track how much revenue comes from work that clients could most easily bring in-house with AI tools.
Client churn and concentration (not formally distinctive)
“Customer churn and non-renewal”: 50% (other industries 13%). “Loss of major customers”: 50% (other industries 23%).
Many consulting and staffing agreements can be ended on short notice or simply not renewed, leaving people on the bench and costs unrecovered, and a few large clients often account for a big slice of revenue. Contract terms (minimum notice, termination fees, payment for work in progress), a pipeline deep enough to redeploy staff quickly and an agreed ceiling on the share of revenue from any one client are the main levers.
Fixed-price contract cost overruns (not formally distinctive)
38% of professional services firms disclose it, against 4% on average in the other industries.
Construction firms disclose this risk even more often, so it fails our distinctiveness test, but it is far more common in professional services than in most industries. The cause is almost always estimation: scope that was never pinned down, optimistic effort assumptions and change requests that were absorbed rather than priced. Bid reviews with a second estimator, explicit contingency, and change control that requires a signed variation before extra work begins all reduce it.
Rising wage and labour costs (not formally distinctive)
34% of professional services firms disclose it, against 9% on average in the other industries.
For staffing firms in particular, wages are most of the cost base, and bill rates are often fixed for the term of a contract while minimum wages, benefits and market pay move. Hospitality companies disclose this risk more often, but it is several times more common here than the average elsewhere. Index-linked or reopener clauses in longer contracts, regular repricing of rate cards and margin tracking by client keep wage inflation from eating the margin unnoticed.
The category mix
Every identified company-level risk is classified into one of nine groups. The table shows how professional services firms’ risk mentions split across them — a rough picture of where their attention goes, not of where losses come from.
| Risk group | Share of risk mentions |
|---|---|
| Strategic | 28.6% |
| Financial | 22.9% |
| Compliance and legal | 19.2% |
| Operational | 13.1% |
| IT and cyber security | 5.6% |
| People | 5.6% |
| ESG and sustainability | 3.2% |
| Reputational | 1.5% |
| Project | 0.3% |
Strategic risks lead at 28.6% of mentions, followed by financial (22.9%) and compliance and legal (19.2%). People risks account for 5.6% of mentions — joint highest of the fifteen industries with construction — which matches the weight of talent in the top 30.
How to use this in your own risk register
A benchmark is a checklist of what peers disclose, not a risk assessment of your business. Use it to spot gaps, then do the real work yourself.
- Pick. Read the distinctive risks and the top ten first. Tick the ones that genuinely apply to your business model, size and markets, and drop the rest. Staffing firms will want the labour cost, churn and receivables items; advisory firms will usually weight talent, client concentration and professional liability more heavily.
- Rewrite for your business. Filing wording is deliberately generic. Turn each risk into a specific statement of cause, event and consequence — see what a risk register is for the format.
- Score likelihood and impact. Score each risk on your own risk matrix. Do not use the share column as a likelihood: it measures how many companies mention a risk, not how often it happens.
- Name an owner and controls. Each risk needs one accountable person and a short list of the controls that actually reduce it today.
- Add indicators. Pick one or two key risk indicators for the risks that score highest, with thresholds that trigger action.
For example, “Failure to attract and retain skilled staff” becomes: “Departure of two of the three senior consultants who lead our largest client accounts results in loss of those accounts at renewal and a fall in billable capacity we cannot backfill within six months.” That version identifies the people, the clients and the time horizon, which is what makes it possible to manage.
Indicators that suit professional services firms include:
- Voluntary attrition among billable staff, rolling 12 months.
- Revenue from the five largest clients as a share of the total.
- Utilisation rate, with thresholds for both under-use and overload.
- Fixed-price projects forecasting a margin below plan.
- Debtor days and invoices more than 90 days overdue.
Because firms hold so much client data, our cybersecurity risk assessment guide and the data breach response plan guide are the most useful companions to this list.
Frequently asked questions
What are the biggest risks for professional services firms?
In 56 US professional services annual reports, the most widely disclosed risks are cyberattack (84% of firms), intense competition (80%), acquisitions that fail to deliver (79%), failure to attract and retain skilled staff (71%) and economic downturn reducing client demand (70%).
What risks are specific to consulting and staffing firms?
Compared with fourteen other industries, only two risks are clearly distinctive: failing to attract and retain skilled staff (71% vs 26%) and AI-driven competitive disruption (27% vs 3%). Several more are much more common than average: customer churn and non-renewal (50% vs 13%), fixed-price contract overruns (38% vs 4%), government contracting compliance (34% vs 6%) and rising wage costs (34% vs 9%).
How should a small consultancy use this list?
Start with talent, client concentration, data protection, professional liability and cash collection, which apply to almost every firm. Rewrite each one for your own clients and people, score them on your risk matrix and assign owners. Listed-company items such as debt covenants and goodwill impairment can usually be left out.
How was this list built?
From the Risk Factors section of the latest annual report of 56 US-listed professional services firms on SEC EDGAR. We recorded every distinct risk each section discloses, grouped equivalent risks across companies and counted the share of companies disclosing each one.
Does a higher share mean a risk is more likely?
No. The share measures how many companies chose to disclose a risk, not how often it happens or how much it costs. Annual reports are written by lawyers to protect the company, so they are over-inclusive: a risk can appear in nearly every filing and still be unlikely in any given year. Score likelihood and impact for your own business separately.
Start your register from this benchmark
Risk Samurai uses this benchmark to suggest the risks companies in your industry typically face — talent, client concentration, data protection and contract risks for a professional services firm — when you build your register. You then rewrite, score and assign owners to them.
Get early access