Health is not the absence of profit problems. It is the absence of single points of failure. Four numbers tell a board what could take the business down, and how much warning it would get.
THE SHORT ANSWER
In Part 1 the question was whether the numbers were real. Here the question changes. Assume the profit is genuine. What single thing could still take the business down before the next board meeting?
Northrop groups four numbers around resilience: debt-service capacity, customer concentration, the top operational risk, and control exceptions. Each measures a dependency. A large customer, a heavy loan, one plant, one weak control. Together they tell a board where the business is brittle, not just where it is profitable.
THE REFRAME : Profit measures performance. Concentration measures fragility.
A business can be highly profitable and highly fragile at the same time. The two are measured by different numbers, and boards routinely see the first without the second. Concentration rarely appears as a cost, so it is easy to ignore. It shows up instead as a dependency: on one customer, one lender, one supplier, one executive, one control. Northrop's forensic experience across lender-directed engagements is consistent on this point. The businesses that fail suddenly are usually the ones that looked stable on every profitability measure and carried a single point of failure that no one had priced. Managing Director Ashish Chaudhary describes the discipline as stress before surprise: find the breaking point on paper, deliberately, before events find it for you. The board's real question is not "how much debt do we carry?" It is "how comfortably could we service it if next year went badly?"
Debt-service capacity, tested under stress
Debt is not inherently dangerous. Debt combined with weak or volatile cash generation is. A company with fifty crore of debt and predictable recurring cash flow can be far healthier than one with twenty crore of debt and erratic collections. So the board should not track debt outstanding in isolation. It should track the relationship between operating cash flow, interest, principal obligations and available liquidity, under normal conditions and under stress.
Customer concentration, a strength that can become a fault line
When the largest customer is eight percent of revenue, concentration is a footnote. When it is thirty-four percent, the risk profile of the entire business has changed, even if profit has not. A large customer can be a genuine strength. It can also be a single point of failure. The board should know which one it is looking at. Concentration should never be shown as a bare percentage. Northrop reviews it alongside retention, contract duration, renewal probability, gross margin, receivables and strategic dependency. The exposure is not only the loss of the customer. It is the transfer of pricing power. A customer that knows it represents a third of a supplier's revenue negotiates differently, and margin erosion follows dependence as surely as revenue loss does.
The single operational risk that matters this month
Boards are often handed a risk register with forty entries. Forty risks do not improve a decision, they dilute it. A board should be able to answer one question instead: what is the single operational risk most capable of damaging this business over the next twelve months?
It could be one supplier, one plant, one system, one executive, one geography, one regulatory dependency. The dashboard should carry a single, named entry, not a catalogue. The board does not need forty risk statements. It needs to know which one risk deserves its attention now, who owns it, and when it closes.
Fraud and control exceptions, before they become an investigation
No board should first learn that its controls were deteriorating from a fraud investigation. This is the terrain Northrop knows best. Across forensic engagements conducted largely under bank and financial-institution directives, irregularities were identified in the majority of cases, from fund diversion and shell entities to over-invoicing and circular transactions. In almost every one, the early signals sat in the control data long before they sat in a forensic report. The metric a board watches should not simply be the number of exceptions. A rise in reported exceptions can mean the control environment is worsening, or that detection has improved. The two are opposite conclusions from the same number, so the board needs the fuller picture: exceptions identified, closed, overdue, and repeated.
To Conclude
A resilient business is not the one with the fewest risks on a register. It is the one whose survival does not depend on any single customer, lender, supplier or control holding. Find the breaking point on paper first. The value of a board is in stressing the assumption before the assumption becomes a loss.
Frequently asked
What debt-service cover ratio should a board be comfortable with? There is no single threshold, because it depends on how volatile the business is. A stable, recurring-revenue business can carry a lower ratio safely than a cyclical one. What matters is cover under stress, not only under plan. Northrop tests debt service against a shock to cash flow, so a board can see how much room it actually has.
At what point does customer concentration become a board-level risk? Concentration becomes a board issue well before it becomes a crisis. As a single customer moves past roughly a fifth of revenue, the board should review contract length, renewal probability, margin and receivables on that account, because the loss of it stops being a bad quarter and starts being a structural event.
Why report one top operational risk instead of a full register? A register of forty risks spreads attention thinly and rarely drives a decision. Naming the single risk most capable of damaging the business in the next year, with an owner and a resolution date, forces the board to engage with what actually matters and to hold someone accountable for closing it.
Does a rising number of control exceptions mean controls are failing? Not necessarily. More exceptions can mean detection has improved, which is good. The signal that should worry a board is repeat exceptions and a growing backlog of overdue items, because those show that known weaknesses are being left open. Northrop's forensic work consistently finds those early signals in the control data before any fraud surfaces.
Continue the series
- Part 03 . Next: Can you trust management with the money? Forecast accuracy as a proxy for visibility, and capital allocation as the place value is made or destroyed.
- Part 01 . Back: Is the profit even real? Revenue quality, EBITDA, operating cash flow and working-capital days.
Northrop Management stress-tests debt capacity, concentration and control environments for boards and lenders, and reports the single points of failure in language a board can act on. Talk to Northrop.