Kestrel Precision Components: a risk register that cannot support a board decision

Design failures (the architecture is wrong)

• No risk taxonomy aligned to value drivers, so risks are recorded as a flat list of 62 items rather than grouped into strategic, operational, financial and compliance categories that the board can own.
• Ordinal 5x5 scoring with no defined scales. Two scorers can rate the same risk differently, and the resulting numbers cannot be aggregated, compared to covenant headroom or used to size insurance retentions.
• No correlation or dependency mapping. The supplier failure and the £4m liquidated damages claim are the same event, but the register scores them separately and therefore understates the combined exposure.
• No appetite architecture. 'Low appetite' has no metric, threshold or consequence, so a 'high' rating triggers no decision. Appetite must be translated into tolerances such as EBITDA at risk, maximum single-source revenue dependence and minimum covenant headroom.
• No key risk indicators, escalation triggers or defined risk owners at executive level. Ownership by a part-time head of health and safety is a design choice that guarantees the register is not a management tool.

Operational failures (the design is not being executed)

• The register is nine months stale, so it describes the past, not the current exposure.
• Ranking is internally inconsistent: a supplier loss that stops two programmes ranks below a head-office fire, which suggests no calibration or challenge.
• There is no evidence of validation, independent review or board challenge recorded against individual risks.

Why it fails as a decision input A board needs to answer three questions: how much risk are we running against capacity, which risks are correlated, and what would change our mind. A heat-mapped list answers none of them. It cannot be compared with the £120m facility covenants, it hides single points of failure, and it gives no view of velocity or volatility. The result is that capital, insurance and contract decisions are taken without a risk-adjusted input.

Recommendation: do not approve the full £400,000 now. The platform would automate a process that is currently mis-specified. A model built on ordinal, uncorrelated, stale data will produce precise-looking outputs that are less trustworthy than the current heat map, and it will absorb management attention that is needed for the underlying fix.

Sequence

• Months 0-3: architecture and ownership. Appoint an accountable executive risk owner (not a part-time specialist). Agree a taxonomy mapped to the strategy and to the covenant definitions. Rewrite appetite into qualitative statements plus quantitative tolerances: for example, covenant headroom must not fall below 15%, no single-source component may represent more than 5% of forecast EBITDA at risk, and no customer may exceed 25% of revenue. Re-score the top 15 risks with defined scales and evidence.
• Months 3-6: quantification where it matters. Run scenario and correlation analysis on the crystallised top risks, starting with the titanium supplier. Model the combined EBITDA and cash effect of supplier loss plus liquidated damages, and compare that with covenant headroom. Build KRIs and escalation thresholds with named owners.
• Months 6-12: embedding. Link the output to the budget, capital allocation, contract pricing, insurance renewal and the three-year plan. Require risk-adjusted appraisal for investments above a materiality threshold. Clarify the three lines model so that the first line owns risk and the second line challenges.
• Months 12-18: tooling. Only now specify requirements. A platform may be justified, but on a business case tied to named decisions: covenant compliance, insurance limit setting, supplier contract terms. Consider a pilot licence or a narrower modelling capability at £80,000-£120,000 before committing £400,000.

Test for the committee Approve only if the proposal states which decision will be different, what data will feed it, who owns the data, and how accuracy will be validated. Otherwise the spend is a substitute for governance, not an improvement in it.

Calibrate before setting a number Start from risk capacity, not preference. Capacity is bounded by covenant headroom, liquidity and the £4m liquidated damages exposure. A sensible approach is to express the appetite in the same units the board already manages: EBITDA at risk and weeks of disruption.

Suggested architecture:

• Metric: forecast EBITDA at risk from a stoppage at any single-source supplier, plus contractual liabilities triggered.
• Green: under £1.5m EBITDA at risk and a qualified alternative source within 8 weeks.
• Amber: £1.5m-£3m, or 8-12 weeks to qualify an alternative. Requires a funded mitigation plan and quarterly board reporting.
• Red: above £3m or more than 12 weeks to qualify. Requires board decision to treat, transfer or exit the exposure; tolerating red must be an explicit, minuted choice, not a default.
• Velocity and persistence: weight the tolerance by how quickly the event would bite and how long it would last. A stoppage that halts two programmes in week one is worse than a slower-burning exposure of the same expected value.

Treatment options to evaluate

• Tolerate: build buffer stock (for example 10-12 weeks of forging inventory), monitor the supplier's financial health quarterly, and pre-agree customer communication. Cost is working capital and storage.
• Treat: qualify a second source. In aerospace this may take 9-18 months and require customer approval, so start now and treat it as a programme, not a procurement task. Consider redesigning one SKU to a dual-qualified material.
• Transfer: review contractual remedies and business interruption insurance. Note that liquidated damages owed to Kestrel's customers are unlikely to be recoverable from a small supplier, and insurance will not cover reputational or programme delays.
• Terminate/avoid: exit the product line or re-scope the contract, which may be value-destroying but is the only option consistent with a genuinely low appetite if treatment cannot be funded.

Judgement The board should adopt the tolerance, fund immediate buffer stock and supplier monitoring, and approve a 12-month dual-sourcing programme. That converts a rank-19 register entry into a governed exposure with an owner, a budget and a reporting line.