Confidential, for the exclusive use of the board of directors
Risk report to the board of directors
Helvetia Métal SA · Industry / precision machining · Period 2026-Q3
Prepared by C. Berger, Head of Risk · on 23.10.2026
1. Executive summary
The register holds 11 risks: 0 critical, 2 high, 9 medium, 0 low. The overall trend, weighted by severity, is rising (calculated against 2026-Q2, on 10 risks present in both periods). 2 risks above the appetite set by the board (net level ≥ 12): decision required (§4). 2 mitigations behind schedule (§5).
Movements vs 2026-Q2: 1 entered · 1 exited · 4 worsened · 2 improved
- Worsened: R-01 Information system outage (ransomware) (from 9 to 12) · R-05 Supply disruption (steel, single supplier) (from 6 to 9) · R-08 Regulatory tightening (emissions) (from 4 to 6) · R-12 Unmanaged use of AI tools (from 6 to 9)
- Improved: R-02 FADP non-compliance (HR data) (from 9 to 6) · R-06 Seasonal cash-flow strain (from 9 to 6)
- Entered the register: R-09 Occupational accident (production line) (level 8)
- Left the register: R-10 Strike at the logistics carrier (was 6)
- Still above appetite, unchanged since 2026-Q2: R-03 Customer concentration (38 % of revenue) (level 12)
Priority risks
- R-01Information system outage (ransomware) · IT (external provider)12 · High
- R-03Customer concentration (38 % of revenue) · Sales management12 · High
- R-05Supply disruption (steel, single supplier) · Procurement9 · Medium
2. Risk map (residual risk)
Impact in rows · Likelihood in columns
5 Critical | |||||
|---|---|---|---|---|---|
4 Major | R-04R-09 | R-01R-03 | |||
3 Moderate | R-02R-06R-07R-08R-11 | R-05R-12 | |||
2 Minor | |||||
1 Negligible | |||||
1 > 10 years | 2 5–10 years | 3 3–5 years | 4 1–3 years | 5 ≤ 1 year |
3. Risk register
| Code | Risk | Owner | Gross | Net | Controls |
|---|---|---|---|---|---|
| R-01 | Information system outage (ransomware) Cyber/IT | IT (external provider) | 20 | 12 · High | EDR deployed, partial MFA, daily backups. |
| R-03 | Customer concentration (38 % of revenue) Strategic | Sales management | 15 | 12 · High | Commercial diversification plan under way. |
| R-05 | Supply disruption (steel, single supplier) Third parties | Procurement | 12 | 9 · Medium | Four-week buffer stock. |
| R-12 | Unmanaged use of AI tools Compliance | Executive management | 12 | 9 · Medium | Verbal reminder at a staff meeting. |
| R-04 | Departure of a key person (production manager) HR | HR Director | 12 | 8 · Medium | Documentation of processes under way. |
| R-09 | Occupational accident (production line) Health & safety (OHS) | QHSE / OHS Manager | 12 | 8 · Medium | MSST/CFST directive 6508 in place, PPE, periodic inspections. |
| R-02 | FADP non-compliance (HR data) Compliance | HR | 12 | 6 · Medium | Privacy policy published, register in progress. |
| R-06 | Seasonal cash-flow strain Financial | Finance Director | 12 | 6 · Medium | Confirmed credit line, 13-week forecast. |
| R-07 | Product non-quality / reputational damage Reputation | QHSE Manager | 8 | 6 · Medium | ISO 9001 certification, sampling checks. |
| R-08 | Regulatory tightening (emissions) Operational | QHSE Manager | 6 | 6 · Medium | Regulatory monitoring in place. |
| R-11 | Fraud through changed bank details Financial | Finance Director | 12 | 6 · Medium | Dual signature in e-banking above CHF 10,000. |
4. Decisions requested from the board
- R-01 Information system outage (ransomware) (net level 12 ≥ appetite 12). Decision requested on: Test the full restoration of backups ; Segment the OT/IT network.ApprovedRefusedPostponed
- R-03 Customer concentration (38 % of revenue) (net level 12 ≥ appetite 12). Decision requested on: Convert 3 new accounts above 5 % of revenue.ApprovedRefusedPostponed
5. Action plan tracking
- R-01 Test the full restoration of backups · IT · 30.09.2026Overdue
- R-02 Finalise the record of processing activities + sign supplier DPAs · HR · 15.10.2026Overdue
- R-06 Renegotiate supplier payment terms over the Q4 peak · CFO · 15.09.2026Done
- R-01 Segment the OT/IT network · IT · 31.10.2026To do
- R-05 Qualify a second steel supplier · Procurement · 31.10.2026In progress
- R-09 Audit the machine guards + refresh safety training (SUVA) · QHSE · 15.11.2026In progress
- R-04 Document critical processes and train a back-up · HR Director · 30.11.2026To do
- R-11 Call back the number already on file before any IBAN change, and record it in the supplier file · CFO · 30.11.2026To do
- R-12 Adopt an AI usage rule and open business accounts that do not train models on our data · Executive management · 15.12.2026To do
- R-03 Convert 3 new accounts above 5 % of revenue · Sales management · 31.12.2026In progress
- R-08 Audit emissions compliance and cost the upgrade · QHSE · 31.01.2027To do
6. Solvency (art. 725 to 725b CO)
Three checks calculated from the figures entered. Source: Interim accounts as at 30.06.2026 (unaudited). Liquidity (art. 725), capital loss (art. 725a), overindebtedness (art. 725b); applicable to the limited liability company under art. 820 CO.
- Liquidity (art. 725)
- Available reserve CHF 1'120'000 (cash and committed undrawn credit lines), monthly net cash flow −CHF 95'000: 11,8 months covered. Result: liquidity to be monitored (under 12 months).
- Capital loss (art. 725a para. 1)
- Assets less liabilities: CHF 2'270'000, against a threshold of CHF 375'000 (half of CHF 750'000: share capital and non-refundable legal reserves). Result: no capital loss.
- Overindebtedness (art. 725b)
- Assets less liabilities: CHF 2'270'000 at going-concern values. Result: liabilities covered.
Board duties triggered by these figures
These figures trigger no statutory duty.
Liquidity thresholds are a convention of the tool (12 months is the horizon that art. 958a para. 2 CO uses for the going-concern assumption, 6 months is half of it); the law sets no numeric horizon. These checks are not legal advice.
7. Occupational health and safety (OHS)
Over the period: 2 accident(s) of which 2 with lost time, 1 near miss(es), 1 occupational illness(es), 10 lost day(s). Frequency rate 88.1, severity rate 0.4 (based on 22'700 hours worked).
OHS risks in the register
- R-09Occupational accident (production line) · QHSE / OHS Manager8 · Medium
8. Human capital (HR)
Headcount at end of period: 48 person(s) (45 FTE). Movements over the period: 3 hire(s), 2 departure(s) of which 1 regretted.
- Turnover rate
- 4.2 %
- Share of regretted departures
- 50 %
- Absenteeism rate
- 2.2 %
- Average employment level
- 93.8 %
- Vacancy rate
- 4 %
- Net change in headcount
- +1 people
Indicators calculated from the source data entered (formulas in the appendix of the HR module); the accident rates (frequency / severity) appear in the OHS section.
9. Emerging risks (horizon scanning)
2 theme(s) under active watch and 1 added to the register, on the basis of the horizon framework (environmental, societal, technological, geopolitical, economic, regulatory).
- V-05Shortage of skilled labour and demographics · SocietalUnder watch
Linked to R-04 (key person): 4 polymechanics retire by 2029.
- V-10Industrialised cybercrime · TechnologicalAdded to the register
Covered by R-01 (ransomware). Deepfake scenario to be added to the next crisis exercise.
- V-14Strong franc and currency volatility · EconomicUnder watch
Partial currency hedging (60 % of export revenue), quarterly review with the bank.
Appendix: assessment scales
Risk level = Likelihood × Impact. Thresholds: 1-4 low · 5-9 medium · 10-14 high · 15-25 critical. Board appetite: 12.
Impact
- 1 · Negligible : Less than CHF 50'000 · no significant operational disruption · no external impact.
- 2 · Minor : CHF 50'000 to 200'000 · disruption of less than 2 days · isolated customer complaint.
- 3 · Moderate : CHF 200'000 to 500'000 · disruption of 2 days to 1 week · complaint from a major customer.
- 4 · Major : CHF 0.5 to 2 million · shutdown of 1 to 2 weeks · regional press coverage · investigation by an authority.
- 5 · Critical : More than CHF 2 million · shutdown of more than 2 weeks · national press · business continuity at stake.
Likelihood
- 1 · Rare : Less than once in 10 years · no known precedent in the industry.
- 2 · Unlikely : Once every 5 to 10 years · precedent known elsewhere in the industry.
- 3 · Possible : Once every 3 to 5 years · has already occurred in a comparable company.
- 4 · Likely : Once every 1 to 3 years · has already occurred in the company.
- 5 · Almost certain : At least once a year · occurrence expected during the financial year.