Confidential — for the exclusive use of the board of directors

Risk report to the board of directors

Helvetia Métal SA · Industry / precision machining · Period 2026-Q3

Prepared by C. Berger, Head of Risk · on 05.09.2026

1. Executive summary

The register holds 9 risks: 0 critical, 2 high, 7 medium, 0 low. The overall trend, weighted by severity, is rising (calculated against 2026-Q2, on 8 risks present in both periods). 2 risks above the appetite set by the board (net level ≥ 12) — decision required (§4). No mitigation is behind schedule.

Movements vs 2026-Q2 — 1 entered · 1 exited · 3 worsened · 2 improved

Worsened: R-01 Information system outage (ransomware) (9 → 12) · R-05 Supply disruption (steel, single supplier) (6 → 9) · R-08 Regulatory tightening (emissions) (4 → 6)
Improved: R-02 FADP non-compliance (HR data) (9 → 6) · R-06 Seasonal cash-flow strain (9 → 6)
Entered the register: R-09 Occupational accident (production line) (level 8)
Left the register: R-10 Strike at the logistics carrier (was 6)

Priority risks

R-01Information system outage (ransomware) · IT (external provider)12 · High
R-03Customer concentration (38 % of revenue) · Sales management12 · High
R-05Supply disruption (steel, single supplier) · Procurement9 · Medium

2. Risk map (residual risk)

Impact ↓ · Likelihood →

	2 5–10 years	3 3–5 years
5 Critical
4 Major	R-04R-09	R-01R-03
3 Moderate	R-02R-06R-07R-08	R-05
2 Minor
1 Negligible

Low (1-4)Medium (5-9)High (10-14)Critical (15-25)

Beyond the board's appetite (≥ 12) — decision required

3. Risk register

Code	Risk	Owner	Gross	Net	Controls
R-01	Information system outage (ransomware) Cyber/IT	IT (external provider)	20	12 · High	EDR deployed, partial MFA, daily backups.
R-03	Customer concentration (38 % of revenue) Strategic	Sales management	15	12 · High	Commercial diversification plan under way.
R-05	Supply disruption (steel, single supplier) Third parties	Procurement	12	9 · Medium	Four-week buffer stock.
R-04	Departure of a key person (production manager) HR	HR Director	12	8 · Medium	Documentation of processes under way.
R-09	Occupational accident (production line) Health & safety (OHS)	QHSE / OHS Manager	12	8 · Medium	MSST/CFST directive 6508 in place, PPE, periodic inspections.
R-02	FADP non-compliance (HR data) Compliance	HR	12	6 · Medium	Privacy policy published, register in progress.
R-06	Seasonal cash-flow strain Financial	Finance Director	12	6 · Medium	Confirmed credit line, 13-week forecast.
R-07	Product non-quality / reputational damage Reputation	QHSE Manager	8	6 · Medium	ISO 9001 certification, sampling checks.
R-08	Regulatory tightening (emissions) Operational	QHSE Manager	6	6 · Medium	Regulatory monitoring in place.

4. Decisions requested from the board

R-01 — Information system outage (ransomware) (net level 12 ≥ appetite 12). Decision requested on: Test the full restoration of backups ; Segment the OT/IT network.
ApprovedRefusedPostponed
R-03 — Customer concentration (38 % of revenue) (net level 12 ≥ appetite 12). Decision requested on: Convert 3 new accounts above 5 % of revenue.
ApprovedRefusedPostponed

5. Action plan tracking

R-06 Renegotiate supplier payment terms over the Q4 peak · CFO · 15.09.2026Done
R-01 Test the full restoration of backups · IT · 30.09.2026In progress
R-02 Finalise the record of processing activities + sign supplier DPAs · HR · 15.10.2026To do
R-01 Segment the OT/IT network · IT · 31.10.2026To do
R-05 Qualify a second steel supplier · Procurement · 31.10.2026In progress
R-09 Audit the machine guards + refresh safety training (SUVA) · QHSE · 15.11.2026In progress
R-04 Document critical processes and train a back-up · HR Director · 30.11.2026To do
R-03 Convert 3 new accounts above 5 % of revenue · Sales management · 31.12.2026In progress
R-08 Audit emissions compliance and cost the upgrade · QHSE · 31.01.2027To do

6. Occupational health and safety (OHS)

Over the period: 2 accident(s) of which 2 with lost time, 1 near miss(es), 1 occupational illness(es), 10 lost day(s). Frequency rate 88.1, severity rate 0.4 (based on 22'700 hours worked).

OHS risks in the register

R-09Occupational accident (production line) · QHSE / OHS Manager8 · Medium

7. Human capital (HR)

Headcount at end of period: 48 person(s) (45 FTE). Movements over the period: 3 hire(s), 2 departure(s) of which 1 regretted.

Turnover rate: 4.2 %
Share of regretted departures: 50 %
Absenteeism rate: 2.2 %
Average employment level: 93.8 %
Vacancy rate: 4 %
Net change in headcount: +1 people

Indicators calculated from the source data entered (formulas in the appendix of the HR module); the accident rates (frequency / severity) appear in the OHS section.

8. Emerging risks — horizon scanning

2 theme(s) under active watch and 1 added to the register, on the basis of the horizon framework (environmental, societal, technological, geopolitical, economic, regulatory).

V-05Shortage of skilled labour and demographics · SocietalUnder watch
Linked to R-04 (key person): 4 polymechanics retire by 2029.
V-10Industrialised cybercrime · TechnologicalAdded to the register
Covered by R-01 (ransomware) — deepfake scenario to be added to the next crisis exercise.
V-14Strong franc and currency volatility · EconomicUnder watch
Partial currency hedging (60 % of export revenue) — quarterly review with the bank.

Appendix — Assessment scales

Risk level = Likelihood × Impact. Thresholds: 1-4 low · 5-9 medium · 10-14 high · 15-25 critical. Board appetite: 12.

Impact

1 — Negligible : Less than CHF 50'000 · no significant operational disruption · no external impact.
2 — Minor : CHF 50'000 to 200'000 · disruption of less than 2 days · isolated customer complaint.
3 — Moderate : CHF 200'000 to 500'000 · disruption of 2 days to 1 week · complaint from a major customer.
4 — Major : CHF 0.5 to 2 million · shutdown of 1 to 2 weeks · regional press coverage · investigation by an authority.
5 — Critical : More than CHF 2 million · shutdown of more than 2 weeks · national press · business continuity at stake.

Likelihood

1 — Rare : Less than once in 10 years · no known precedent in the industry.
2 — Unlikely : Once every 5 to 10 years · precedent known elsewhere in the industry.
3 — Possible : Once every 3 to 5 years · has already occurred in a comparable company.
4 — Likely : Once every 1 to 3 years · has already occurred in the company.
5 — Almost certain : At least once a year · occurrence expected during the financial year.