Just kidding. This isn’t a 1990s commencement speech at a Northeast liberal arts college where the students wanted David Foster Wallace but got the president of the local credit union instead. Nope, this is a renewables and cleantech investing blog that nobody reads yet (if you're here in June/July 2025, you're one of the first!). Let’s talk about risk.
As a renewable energy investor, I haven’t seen a lot of good sources on risk – specifically the kinds of risks that should be evaluated and understood in order to confidently underwrite investment in developing greenfield renewables projects. So I decided to take a shot at it myself.
Summary
Here are the basics if you’re pressed for time or just lazy:
Severity * probability = magnitude. The two components of risk are severity and probability. The product of these is magnitude, or “expected loss” (i.e. a negative expected value).
It’s useful to specify which component of the risk equation is being discussed to enable clearer communication and better decision-making. People often speak broadly about risk without specifying whether they are speaking about severity, probability, or magnitude, which leaves room for misinterpretation and therefore bad decisions and bad outcomes.
Some project risks are binary and others are non-binary. Binary means that the feared outcome would kill the project if it came to pass. Non-binary means that there is a range of possible bad outcomes, each of which would do a certain amount of harm to the project’s returns, timeline, or probability of completion, without (necessarily) killing the project outright.
I identify three “functional categories” of risk: Physical, permitting, and commercial. Physical: Can you build and operate the project? Permitting: Are you allowed to build and operate it? Commercial: Will doing so actually make you any money?
Policy risk might deserve to be a fourth “functional category.” But the blog was getting long and there’s a lot to unpack on policy, so I’m leaving it out for now. Plus, this is more of a macro risk than anything project-specific.
Read on for the whole shebang.
image credit: scienceabc.com
Risk as Expected Loss
If I tell you I will pay you $10 if you flip a fair coin and get heads, and nothing if you get tails, your expected value is $5: (0.5 * $10) + (0.5*$0) = $5. Now flip it (the direction of the payment, not the coin), and use the same scenario, except you have to pay me the $10 if the coin shows heads – in other words, your expected value is now -$5, or an expected loss. In risk terms, this expected loss is “magnitude,” the amount of loss we expect to suffer per coin flip, which we can calculate by multiplying the severity (-$10, the amount of loss in the case that the loss occurs) by the probability (0.5, the likelihood that the loss occurs).
Which Component Are We Talking About?
The above severity * probability = magnitude formula seems almost painfully obvious, but it’s important when talking about project development risk to clarify which of the three terms in the risk equation is being discussed. For example, a developer may say something like, “there’s a major risk that we run over budget to obtain full site control for this project because a landowner is considering holding out for a signing bonus.” Which element of risk is “major” in this case? The developer’s statement could mean that:
Probability is high: The landowner is very likely to demand a signing bonus. Not great news, but not too far out of the ordinary.
Severity is high: If the landowner requests a signing bonus, it will be very high relative to the project’s other projected or actual real estate and development costs, possibly driven by competition from other developers for the same land or by the landowner’s confidence that their specific piece of property is required for the project to go forward at all. Potential red flag.
Severity and probability are both high: The landowner is very likely to demand a signing bonus, and the amount of this bonus will be very large. Very bad news for our projected development multiple if we're a develop-and-flip shop (calculated as a standard multiple on invested capital, using anticipated project sale proceeds at ready-to-build date divided by development expenses up until then) or project-level returns if we're an IPP (calculated using a discounted cash flow analysis to ensure the project meets our equity return target, i.e. is a positive-NPV investment).
To avoid confusion when evaluating a project-level risk, I’ve learned to split out probability from severity and gather information on both from my developer partners. If it’s not clear which component is contributing to their risk assessment, I clarify by asking directly: How likely is this bad outcome? If it did occur, how bad would it be? And how much should I worry about this based on the combination of those two things?
Binary or Non-Binary Risk?
This flows conveniently into the next layer. Is the nature of the risk:
Binary, meaning that the damage or cost from a bad outcome would render the project unviable?
Non-binary, meaning that a bad outcome would make the project somewhat less attractive but still potentially worth developing?
Here are some examples of binary and non-binary risks, framed as questions about the project: Of course, the distinction between binary and non-binary risk can be arbitrary. For example let’s take an extreme case with an extreme proposed intervention: If buildability constraints due to steep slopes on the site are going to double my solar capex because I need to literally move tons of earth or build a massive platforms on stilts with concrete anchors to hold the panels, I could find a construction firm able to build this – it’s just that, in almost all cases, a doubling of capex is an automatic project killer, all else equal.
If all else is not equal – let’s say, for example, I’m in a very sunny climate and my energy off-taker is a mine operator willing to pay me $250 per megawatt-hour for a behind-the-meter power purchase agreement (PPA) with no interconnection process to navigate – then maybe the capex bump is not a project-killer. But for your standard grid-connected utility-scale solar project with a 20-30% first year AC net capacity factor, claiming 30% investment tax credit (ITC), with debt at about 2% above the risk-free rate, and contracted revenues via hub-settled virtual PPA at ~$40-$60/MWh, a 100% increase in capex puts the project well below the equity hurdle rate of ~10-12%. This cookie-cutter hypothetical project is what I’m using as a reference point when I say something is a project-killer, “all else equal.”
Risks By Function
There’s one more dimension to add to the puzzle, which I’m choosing to call “function.” The functions I have in mind are Physical, Permitting, and Commercial.
Physical
Physical risks are risks to the ability to physically construct, operate, or maintain the project. For example, if the project is in an area with unstable topsoil and steep slopes, buildability on the proposed project site could be a significant source of physical risk. Similarly, if the project is in a flood zone, and it is not economically viable to raise the height of the panels and power electronics onsite (assuming we’re talking about solar; not a lot of onshore wind projects are sited in flood zones!), panel inundation during a flood event is a physical risk. Basically, if you have doubts about your ability to install the thing, operate it, or get insurance for it given the site's combination of topography, geology, weather conditions, and natural disaster exposure, you're probably chewing on physical risk.
Permitting
Permitting risks are risks to the ability to obtain, and to manage the costs of obtaining, the necessary approvals and permits to legally build and operate the project. I see three subtypes here:
Construction and land use
Environmental
Interconnection
Construction and land use permitting risks are possible threats to the ability to prove that your land is where you say it is, that it contains what you think it does, and that you can do what you want with it. To limit and eventually remove these risks, developers have to complete tasks like title commitment, ALTA surveys, mineral rights confirmation, DoD and FAA clearances, and local zoning and building code approvals processes.
Environmental permitting risks have to do with a project’s potential proximity to or overlap with endangered species habitats, migratory bird flight paths, waterways, and other protected areas designated and enforced by state and federal environmental authorities like EPA, the Department of the Interior, and (to pick out just one state-level agency among many) the Arizona Department of Environmental Quality.
The extent to which these two types of permitting risks overlap with physical risks depends on the jurisdiction. Some counties and states will pretty much let developers build whatever they want, where they want, and make it the developer’s problem if what they build breaks, catches on fire, washes away in a flood, etc. Others have strict building and zoning codes, with many layers of approval to navigate and very specific planning and environmental requirements that, if not followed to a T, will result in rejected permitting applications.
Interconnection permitting risks are risks to the project’s ability to secure connection to the grid – the right to “turn it on and plug it in.” Interconnection permitting processes vary from place to place and depend more on who operates the grid near your project than on what state your project is in. Different ISO/RTOs (in restructured wholesale markets) and utilities (in vertically integrated markets) have different rules, costs, timelines, and study processes that developers must navigate to execute an interconnection agreement that allows them to connect to the grid.
For example, the ERCOT interconnection process, for the grid that covers most of Texas, is fairly quick and cheap, partially because ERCOT (the grid operator) farms out the interconnection study grunt work to the local transmission owner (TO) into whose line a project will eventually interconnect. By contrast, many other ISO/RTOs have slow, opaque queues that can take several years and many thousands of dollars to complete, although recent FERC rulemakings have pushed grid operators to streamline their interconnection processes. We’ll see how this shakes out in 2025 and beyond, but I’m not particularly optimistic these efforts will succeed in clearing the backlog of existing projects in the queue, much less accelerating the process for new applicants. That’s too long of a discussion to get into here – stay tuned.
One final point of discussion: You could make a solid argument that interconnection risks are best treated as a separate category, rather than going in the permitting bucket, but at the end of the day, you're paying money and doing studies in order to get permission from a quasi-governmental entity to turn on and plug in your project. For me, that's a permitting risk, even if it is a very specific type of permitting that also carries some impact on capex via interconnection upgrade cost assessments (which I would separate into the commercial risks category, for what it's worth).
Commercial
Commercial risks are risks to the project’s capital costs, operating costs, and revenues as compared to the commercial base case underwritten by the developer or investor. Two basic examples: First, on the cost side, the imposition of import tariffs, as we saw recently in December 2024 with Commerce’s updated anti-dumping rates imposed on certain Southeast Asian nations, could increase solar module pricing by 20% or more, raising project capex. Then, on the revenue side, expected PPA pricing in a project’s ISO/RTO (or in its specific load zone within that ISO/RTO) might decline, reducing the project’s expected revenues, if big-name off-takers like Google, Walmart, and Coca-Cola signal that they have already met their clean electricity procurement targets to power their data centers, warehouses, factories, etc. in that market region. These commercial risks don’t say anything about our ability to obtain the necessary approvals (permitting) and then actually build and operate (physical) the project – rather, they raise the possibility that the project may be less profitable than desired due to changes in the prices at which the project’s inputs are bought and/or its outputs are sold.
Closing Thoughts
To name it is to know it. When I have trouble wrapping my head around a big, hairy topic like development risks, the natural thing for me to do is expend a little time thinking about how to categorize smaller buckets – to chunk it out until the chunks are of a more comprehensible size and scope. I’m going to iterate on how to use this very basic taxonomy in my work, but I already have a couple of ideas on how to use this framework to more effectively navigate conversations with development staff and with counterparties in potential project sale or financing processes.
Policy risk is a topic for another blog. I struggled with where to put it in this framework: As a subset of commercial risk, in its own category, or somewhere else? This also could depend on the specific policy at risk of repeal or modification. Right now, the main policy risk on renewables folks’ radars is a potential repeal or restructuring of the Inflation Reduction Act of 2022, specifically removing or reducing the renewables tax credits provided for in that law. I think we can consider ITC and PTC repeal or reduction to be a commercial risk, since this would negatively impact project capex requirements (ITC) and operational revenues (PTC). Monetization of these tax credits is technically mediated through tax credit transfer and/or tax equity partnership transactions rather than direct changes to costs and revenues, but the effect is nonetheless to reduce investment returns on renewable energy projects.
Your feedback is welcomed. This is a first shot at putting some thoughts to paper in the hope that they might help me, and others, be more systematic in identifying, planning for, and mitigating key sources of risk in renewable energy project investment and development. If I’ve overgeneralized, omitted key considerations, or just flat-out missed the point, or if you have anything else to add to the conversation, drop me a line: cwetherbee@alumni.gsb.stanford.edu.
Standard Disclaimers
This blog is written in my personal capacity and reflects only my own thinking, research, experience, and opinions.
This blog post is not sponsored, endorsed by, or affiliated with my employer, although its content may be informed by some non-confidential aspects of my work.
This blog post is not investment advice and does not constitute any offer, solicitation to offer, or recommendation of any investment product or security.
This blog post is 100% human-drafted and edited. AI tools were not used in any way.
