Insight October 22, 2026

Not a color. A number.

Red, amber, green tells you someone is worried. It does not tell you what a disruption costs, which site matters most, or what an investment is worth. Here is what changes when every site, supplier and system carries a number instead.

Ask most organizations how exposed they are to disruption and you will be shown a heatmap. Red, amber, green. A score from one to five. A matrix that someone assembled in a workshop, from the opinions in the room, some time ago.

Heatmaps feel structured. That is their trick. Every cell is filled in, every risk has a color, and the whole thing fits on one slide. But look at what a color actually tells you. It tells you that at the time of the workshop, the people present were worried about something, roughly this much. It does not tell you what a day of downtime at that plant costs. It does not tell you whether the supplier marked amber matters more than the one marked red. It does not tell you what fixing either of them would be worth.

And so a predictable thing happens. The heatmap goes to the board. The board nods. Nobody can say what red means in the terms the board uses for every other decision, so the budget goes somewhere that can. The heatmap goes back in the drawer until next year.

What a number can do that a color cannot

A number can be compared. A site that carries forty percent of revenue through a single line outranks a site that carries four percent, whatever colors they were painted. Two suppliers can be ranked by the revenue that stops if each one does, and by how long it would take to replace them. Once everything is in the same unit, the question "what matters most" has an answer instead of a debate.

A number can be traced. A figure that arrived from somewhere specific, this throughput, this margin, this lead time, this dependency, captured from the person who actually runs the process, can be defended in front of an auditor, an underwriter or a skeptical finance director. A color cannot be traced to anything except the workshop it came from.

A number can be acted on. If qualifying a second supplier removes a measured amount of exposure, that project can be ranked against every other use of the same money: the new line, the system upgrade, the insurance limit. Resilience stops competing for attention as a compliance topic and starts competing on the same terms as everything else.

Where the numbers come from

The objection is always the same: we do not have that data. In our experience you do, it is just not written down. The plant manager knows which line matters. The buyer knows which supplier is sole-source. The IT lead knows which application everything secretly depends on. Finance knows what each product earns. None of this is in one place, and most of it is in people's heads.

So the work is not estimation. It is capture. Sit the people who run the business down with the data the business already has, revenue by product, throughput by line, the supplier list, the application inventory, and join the two. Every process gets connected to what it earns, what it costs to keep running, and what it depends on. From that, modeling a disruption is arithmetic: the revenue that stops, the costs that continue, the extraordinary spend to recover, the penalties that apply. Per site. Per supplier. Per system. Per day.

Done in a room, with the right people, that takes days. Done by interview and spreadsheet, it takes a quarter and is wrong by the time it is finished.

One standard, everywhere

The second objection is consistency. If every site quantifies itself, every site will do it differently, and the numbers will not add up. True, if you let them. The answer is one method, one set of definitions and one model, applied at every site in whatever language that site works in, at a pace the organization can sustain. Then the numbers do add up, and for the first time the head of operations can see the whole estate in one picture that means the same thing everywhere.

The plan is the byproduct

Notice what has not been mentioned: the continuity plan. That is deliberate. Once the model exists, with a number on everything and the dependencies drawn, you can build a quantified business impact analysis from it in days rather than a quarter, and a continuity plan whose every strategy is tied to a number. The plan stops being the goal and becomes what a healthy resilience process produces along the way, and it is only the first of the things the model is good for.

And the same model answers questions that no continuity plan was ever asked. How much business interruption cover to buy, and where. Which capex project removes the most exposure per unit spent. Which supplier to dual-source first. What to tell the board about what continuity is worth, and how much risk it has taken off the table this year.

That is what a number does. A color just tells you someone was worried.