Most operational risk registers are good at naming events and poor at showing consequences. A supplier failure is marked amber. A systems outage is marked red. A key-person risk is noted for review. What the leadership team still cannot see is which event would stop a customer order from becoming cash first.

That distinction matters. A disruption with dramatic headlines may have little effect on your business. A missing component worth £4, an expired technical approval or one employee's undocumented knowledge may stop an entire revenue line within days.

Recent geopolitical shocks have made supply-chain resilience a board topic again. But the practical problem for a growing or mid-market business is wider than geopolitics. The dependency that hurts you may be a supplier, a port, a production site, a software integration, a quality sign-off, a bank facility, a licence or a specialist who is the only person able to release an order.

The 10-Day Dependency Test is designed to find those points before an incident does. It asks a simple question:

If one dependency became unavailable today, what could stop us recognising revenue within the next ten working days?

Ten days is not a prediction. It is a forcing device. It is short enough to expose dependencies hidden by monthly reporting, but long enough to trace the operational and cash consequences of a failure.

Why conventional risk registers miss the point

Most registers are organised by risk category or department. Finance owns liquidity. IT owns systems. Procurement owns suppliers. Operations owns capacity. HR owns key people.

Revenue does not move through the business in those neat columns. It crosses them.

A customer order may depend on a sole-source component, a production slot, an inspection record, a warehouse interface, a carrier booking, an invoice approval and a functioning credit facility. Each owner can report green while the end-to-end flow remains fragile.

The test therefore begins with the customer promise, not the risk register. Select a product, service, contract or revenue stream that matters. Then follow the work backwards from invoice and cash to the first customer commitment.

Step 1: Choose the revenue flow that deserves attention

Do not begin by mapping the whole company. Choose one flow where interruption would matter enough to change a leadership decision.

Good candidates include:

  • the product family responsible for the largest contribution margin;
  • the contract with the most demanding service level;
  • the site or service line with the fastest growth;
  • the customer segment with the highest renewal or switching risk;
  • the order type already producing delays, expedites or management intervention.

Define the start and end precisely. “Manufacturing” is too broad. “Confirmed order for Product A to accepted delivery and invoice” is workable. For a service business, the flow might run from signed statement of work to approved milestone and invoice.

The output from this step should be one sentence, one owner and one measure of normal performance.

Step 2: Name the dependencies, not the departments

Follow several real orders through the flow. Ask what each stage requires before the next stage can begin. Record the dependency in operational terms.

“Procurement” is not a dependency. “Approved resin grade from either of two qualified suppliers” is. “IT” is not a dependency. “The integration that transfers dispatch confirmation into billing” is. “Engineering” is not a dependency. “One chartered engineer authorised to sign the completion certificate” is.

Look across six dependency types:

  1. Supply: materials, components, utilities, outsourced services and minimum order quantities.
  2. Route: ports, carriers, warehouses, data transfers and physical or digital hand-offs.
  3. Capacity: equipment, sites, production slots, credit lines and working capital.
  4. Control: approvals, licences, tests, certificates, customer acceptance and regulatory release.
  5. System: applications, interfaces, data, identity access and payment infrastructure.
  6. Knowledge: specialist judgement, undocumented process knowledge and critical relationships.

The aim is not to produce a longer list. It is to identify the smallest number of dependencies whose loss would break the flow.

This end-to-end view is central to effective operational redesign.

Step 3: Calculate time-to-revenue-impact

For each dependency, calculate how long the business can continue before revenue is delayed, reduced or lost.

Begin with what is already available: stock on hand, work in progress, spare capacity, approved alternatives, customer lead times and contractual grace periods. Then remove false comfort.

Inventory only provides cover if it is in the right location, meets the required specification and can be released. A backup supplier only counts if it is approved, commercially agreed and able to deliver at the required volume. A manual workaround only counts if people have used it successfully.

Use four time bands:

  • 0 to 2 working days: immediate interruption;
  • 3 to 10 working days: near-term revenue at risk;
  • 11 to 30 days: manageable only with an active response;
  • more than 30 days: monitor, but do not assume the exposure is immaterial.

For each item, record the first revenue consequence. That may be a missed shipment, an unbillable milestone, a service credit, a lost renewal, a stopped production line or a breach that gives the customer a right to terminate.

Step 4: Test whether the substitute is real

Leadership teams often overestimate resilience because an alternative exists in theory. The right question is not “Could we find another supplier?” It is “Could the alternative protect the customer promise before the impact date?”

Test five points:

  • Is the alternative approved by the business, customer and regulator where required?
  • Has quality or performance been tested under realistic conditions?
  • Is capacity contractually available, or merely discussed?
  • Are price, payment terms, tooling, data access and logistics agreed?
  • Has the switchover been rehearsed by the people who would execute it?

Classify each substitute as proven, available but untested, possible with lead time or not currently credible.

That language is less comfortable than “backup in place”, which is precisely why it is useful.

Step 5: Put a cash range around the exposure

Resilience decisions compete with growth, working capital, systems and people for funding. A high risk score is not enough. The leadership team needs a commercial range.

For each material dependency, estimate:

  1. revenue delayed or lost during the likely interruption;
  2. contribution margin at risk;
  3. additional cash required for inventory, expedited freight, overtime or temporary capacity;
  4. contractual credits, penalties or remediation costs;
  5. customer value at risk if service failure changes retention or future share of wallet;
  6. recovery cost, including requalification, restart and backlog clearance.

Use a low, central and high case. The purpose is not false precision. It is to distinguish a £50,000 interruption from a £5 million exposure and to reveal which assumption drives the range.

Then compare the exposure with the cost of protection. A second source, extra stock or duplicated system may be expensive. The relevant comparison is not against zero cost. It is against the expected loss, the balance-sheet strain and the strategic value of continuity.

Related: The Cash Conversion Review for Growing Businesses.

Step 6: Choose one of five responses

Every dependency does not need duplication. The response should reflect time-to-impact, substitutability, cash exposure and strategic importance.

  1. Remove: redesign the product, process or customer promise so the dependency no longer exists.
  2. Reduce: add stock, capacity, documentation, monitoring or a tested workaround.
  3. Replace: qualify a second source, route, system or authorised person.
  4. Transfer: use insurance, contractual allocation, service guarantees or a partner able to carry the exposure.
  5. Accept: retain the risk consciously because protection costs more than the exposure warrants.

Acceptance is a valid decision when it is explicit, quantified and owned. It is not the same as discovering during an incident that nobody funded the alternative.

Turn the test into an operating routine

Ownership and triggers sit with the leadership team.

A dependency map goes stale quickly. A supplier changes its own source. A system integration is altered. A new customer specification removes a previously valid substitute. A specialist leaves. Growth consumes the spare capacity that made the last review reassuring.

For every material dependency, set:

  • an accountable executive;
  • an operating owner close to the flow;
  • an early-warning indicator;
  • a threshold that triggers action;
  • the first three actions to take;
  • the date on which the substitute or workaround was last tested.

Useful indicators are specific. Supplier on-time delivery, rejected batches, remaining stock cover, queue length, system-error rate, approval backlog, unused credit headroom and dependency on one authorised person all provide earlier warning than a quarterly red-amber-green review.

Review the highest exposures monthly and the full map quarterly. Repeat the test when a new product, market, acquisition, system, site or major customer changes the operating flow.

Five questions for the next leadership meeting

If the full exercise cannot begin immediately, start with these questions:

  1. Which product, service or contract would create the greatest cash pressure if revenue stopped for ten working days?
  2. What single dependency would stop that revenue flow first?
  3. How much time would we actually have before the customer or cash consequence arrived?
  4. Which claimed alternative has been tested under realistic conditions?
  5. What resilience action would we fund today if the exposure were stated in pounds rather than colours?

If the team cannot answer them consistently, the problem is not that the business lacks a risk register. It lacks a decision-ready view of operational dependency.

Resilience should buy time, not reassurance

The purpose of resilience investment is not to make every disruption impossible. It is to give the business enough time and enough choice to protect the customer promise, cash and strategic position.

That requires a shorter list, sharper measures and tested alternatives. Start with one revenue flow. Find what would stop it first. Calculate when the effect reaches the customer and the cash account. Then fund the response that earns its cost.

Allington Advisors helps leadership teams trace critical revenue flows, quantify operational exposure and turn broad resilience concerns into prioritised actions. If one dependency could stop an important part of your business within ten days, a focused review can establish where the real exposure sits and what is worth doing about it.

Download the Operational Chokepoint Mapping Pack