In this paper, in order to examine risk management for small and medium-sized company projects, which have fewer members than large enterprise projects, we first identified risk factors from the descriptions of collected project failure cases, and then conducted risk analysis in accordance with the standard guideline ISO31000. Next, we focused on the frequency of co-occurrence of risk factors in the descriptions and investigated the co-occurrence feature of risk factors through clustering and cooccurrence networks. From the consideration of the results, we were able to find the ideal way of dealing with risks and the direction of concreteness suitable for small and medium-sized company projects, based on the knowledge of the chain of risk factors.