Industrial manufacturer

Contain the downside while improving the evidence

A possible component fault, no injuries, and a board that needs a recommendation today.

An illustrative scenario. It does not describe a client or a real company.

Frame

Objective, horizon, non-negotiables and who holds authority.

A manufacturer discovers that a small number of products may contain a component capable of failing under unusual conditions.

The board needs an immediate recommendation.

What is known

No injuries are reported.
Internal testing has produced a failure, but not consistently.
Engineering believes the probability is low.
The affected batch cannot yet be identified precisely.
A full recall could threaten company survival.
Legal counsel says the current evidence does not yet compel a recall.

How should the company act before uncertainty is resolved, and who owns the risk decision?

Objective: Prevent harm and keep the company alive, in that order, while the evidence is still forming.
Horizon: Days for containment. Weeks for tracing and independent testing.
Non-negotiables: Nothing plausibly affected ships while severity is unknown.
Evidence and the decision record are preserved.
The company does not state a confidence it does not have.
Who decides: The board. Legal counsel defines obligations and exposure. It does not own the company’s safety, reputational or existential judgement.

Observe

What is established, what is assumed and what is missing.

Every item is typed. Facts come from the scenario. Assumptions are illustrative quantities added so the consequences can be calculated. Unknowns are left unknown.

Established 5

Fact:
A small number of products may contain a component capable of failing under unusual conditions.
Given in the scenario. High confidence.
Fact:
No injuries are reported.
Given in the scenario. High confidence.
Fact:
Internal testing has produced a failure, but not consistently.
Given in the scenario. High confidence.
Fact:
A full recall could threaten company survival.
Given in the scenario. High confidence.
Fact:
Legal counsel says current evidence does not yet compel a recall.
Given in the scenario. High confidence.

Assumed 5

Assumption:
400,000 units are in the field. A recall costs about €220 a unit. Available liquidity is €45m.
Illustrative modelling assumption. Medium confidence.
Assumption:
The affected batch is somewhere between 8,000 and 60,000 units.
Illustrative modelling assumption. Low confidence.
Assumption:
Under the unusual conditions, between 0.2 and 5 units in every 10,000 would fail.
Illustrative modelling assumption. Low confidence.
Assumption:
About 1,500 plausibly affected units ship each week. Pausing them costs about €0.6m a week in margin, plus €0.1m of testing.
Illustrative modelling assumption. Low confidence.
Assumption:
Tracing batches, suppliers and customers should take about 3 weeks. The next covenant test is 12 weeks away.
Illustrative modelling assumption. Low confidence.

Inferred 1

Inference:
Engineering believes the probability of failure is low.
Given in the scenario. Low confidence.

Not yet known 2

Unknown:
Which batch is affected. It cannot yet be identified precisely.
Given in the scenario. Low confidence.
Unknown:
The credible worst-case severity of a failure.
Given in the scenario. Low confidence.

Model

The relationships that can be calculated, and their limits.

Only relationships that can honestly be calculated are modelled. Apply one bounded pressure, or move one assumption, and follow the consequence across the organisation.

Apply one pressure

As briefedThe scenario as it was first described. A failure in the fieldA customer reports 1 failure. Nobody is hurt. The lower bound on the failure rate rises to 1 in 10,000.A distributor wants assuranceA key distributor demands written assurance that the product is safe before it will keep shipping.A covenant test in three weeksThe bank’s covenant test falls in 3 weeks, before tracing can complete.

Or change one assumption: Weeks needed to trace the batch

3 weeks

Bounded to 1 weeks to 9 weeks.

What changed

First effects

Second effects

Thresholds

Risk

Expected failures, low case0.2

Expected failures, high case30.0

Units shipped if nothing changed4,500

Severity is not establishedCrossed

Credible evidence of potentially serious harmNot crossed

The failure has left the laboratoryNot crossed

Finance

Cost of a full recall€88.0m

Cost of containment while tracing€2.1m

Full recall against liquidity2.0x

Containment as a share of a full recall2.4%

A full recall exceeds available liquidityCrossed

The covenant test falls inside the traceNot crossed

Operations

Targeted recall, if the batch is small€1.8m

Targeted recall, if the batch is large€13.2m

Uncertainty in scope7.5x

The batch is not identifiedCrossed

Commercial

An assurance has been demandedNot crossed

Apply a pressure to see what moves, in what order, and where it stops.

Contest

Functional positions, conflict and a critic.

Each function answers in the same structure: a recommendation, the evidence it rests on, the assumption underneath, its confidence, the consequence for another function and the authority it would need.

Legal

Argues against: recall everything now

Current evidence does not compel a recall. Preserve every record, and route communication through counsel.

Rests on: Fact:Legal counsel says current evidence does not yet compel a recall.
Fact:No injuries are reported.
Fact:Internal testing has produced a failure, but not consistently.
Assumes: The evidence stays as it is while the company investigates.
Consequence for risk: A legal threshold is a floor. Somebody else has to say where the company’s own threshold sits.

Risk

Argues against: continue while the evidence develops

Probability means nothing without severity. Until worst case is known, treat it as potentially serious: quarantine, pause plausibly affected shipments and verify testing independently.

Rests on: Fact:A small number of products may contain a component capable of failing under unusual conditions.
Fact:Internal testing has produced a failure, but not consistently.
Unknown:The credible worst-case severity of a failure.
Assumes: Severity can be established credibly within 3 weeks.
Consequence for finance: Pre-fund the recall now. A prepared recall costs little. An improvised one costs the company.

Finance

Argues against: recall everything now

A full recall is €88.0m against €45.0m of liquidity: 2.0x what we have. Containment for 3 weeks costs €2.1m, which is 2.4% of that.

Rests on: Fact:A full recall could threaten company survival.
Assumption:400,000 units are in the field. A recall costs about €220 a unit. Available liquidity is €45m.
Assumption:About 1,500 plausibly affected units ship each week. Pausing them costs about €0.6m a week in margin, plus €0.1m of testing.
Assumes: No insurance recovery, and no new facility, is available in time.
Consequence for operations: Every week taken off the trace is money and exposure saved. Resource it accordingly.

Operations

Argues against: continue while the evidence develops

The batch is between 8,000 and 60,000 units. Tracing suppliers, lots and customers narrows a recall from €13.2m towards €1.8m. Unchanged, 4,500 more units would ship first.

Rests on: Assumption:The affected batch is somewhere between 8,000 and 60,000 units.
Assumption:About 1,500 plausibly affected units ship each week. Pausing them costs about €0.6m a week in margin, plus €0.1m of testing.
Unknown:Which batch is affected. It cannot yet be identified precisely.
Assumes: Supplier and lot records are good enough to trace.
Consequence for commercial: Customers holding paused lots need a date and a reason. Draft both now.

Conflict

Compulsion against hazard

Legal against Risk

Legal says nothing compels a recall. Risk says the absence of compulsion is not the absence of hazard.

Calculated

Cost of containment while tracing

€2.1m

What buying better evidence costs.

Assumption: Assumption carrying weight

Under the unusual conditions, between 0.2 and 5 units in every 10,000 would fail.

Low confidence. If this is wrong, the calculations that rest on it move with it.

Unknown: Evidence to obtain first

The credible worst-case severity of a failure.

The answer could be “worst case is cosmetic” or “worst case is serious harm”. They lead to different decisions, which makes this the question to settle first.

The critic

A separate pass reads the positions for conflict, unsupported certainty, benefits counted twice, omitted effects and false precision.

Omitted second-order effectLegal, Risk
Legal counsel has defined the obligation. Nobody has yet owned the judgement: what the company would do if no law applied at all.
False precisionRisk
Expected failures run from 0.2 to 30.0. Engineering’s low probability is a belief drawn from one inconsistent test.
Highest-value missing evidenceRisk
The most valuable unknown is credible worst-case severity. A rare cosmetic failure and a rare catastrophic one call for different thresholds, and no other finding moves the decision as far.

Where that leaves the room

Agreed

No function argues for a full recall today, at €88.0m. No function is comfortable continuing unchanged.

Still in dispute

Legal and Risk. Where the threshold sits. Legal places it at compulsion. Risk places it at credible serious harm.

Not for analysis to decide

Safety thresholds, regulator communication, recall and public statements belong to the board. Analysis can accelerate tracing, model scenarios and prepare documents.

The disagreements are kept. Someone accountable has to choose between them.

Decide

Options, trade-offs and an accountable call.

Three credible courses of action. Each one is carried by assumptions that would need to be true. Choose the one you would take. Your choice is not scored.

Recall everything nowRemove all doubt, whatever it costs. For this to be right:

The company survives a recall of €88.0m.
The worst case is serious enough to justify it.
No narrower action would protect people.

Continue while the evidence developsThe law does not compel a recall. Keep trading and keep testing. For this to be right:

The legal threshold and the right threshold are the same.
Engineering’s belief about probability is correct.
Nothing ships in the meantime that the company will regret.

Contain, investigate and prepareQuarantine and pause what may be affected. Trace, test independently and pre-build the recall. For this to be right:

Quarantine and tracing really do stop further exposure.
Severity can be established within weeks.
The company will act on its own threshold, ahead of legal compulsion.

Christianna’s judgement

Contain the downside. Improve the evidence.

A full recall costs €88.0m, 2.0x the liquidity available, on evidence that does not yet justify it. Continuing unchanged would ship 4,500 more units into the same uncertainty. Containment costs €2.1m and buys the evidence.

The decision as signed, at the starting position

Do not initiate a company-wide recall solely because a failure is theoretically possible. Immediately pause or quarantine potentially affected shipments, preserve evidence, trace exposure, intensify testing and prepare the recall.

Legal counsel defines obligations and exposure. It does not own the company’s safety, reputational or existential judgement.

Probability cannot be evaluated without severity: a rare cosmetic failure and a rare catastrophic failure require different thresholds.

Rejected: Recalling everything now. Continuing unchanged because the law does not yet compel a recall.
The assumption carrying it: That the downside really can be contained while the evidence improves.
Authority I keep: Safety thresholds, regulator communication, recall and public statements.
What I would delegate to AI: Accelerating trace analysis, scenario modelling and document preparation.
What would change my mind: I recall before legal compulsion if credible evidence indicates potentially serious harm, even at low incidence.

When evidence is incomplete, contain the downside while improving the decision. Do not continue unchanged and hope uncertainty resolves favourably.

Christianna Hamilton

This is one accountable judgement for the stated objective and evidence. It is not offered as the universal answer.

Act

Bounded actions, owners and approvals.

A decision is finished when it has owners, limits and a way of being checked.

First action

Quarantine identifiable inventory and pause plausibly affected shipments.

Measure to watch

Credible worst-case severity, as independent testing reports.

Quarantine identifiable inventory.
OperationsHuman decision required
Pause plausibly affected shipments.
OperationsHuman decision required
Trace batches, suppliers and customers.
OperationsDraft
Independently verify testing.
RiskPrepare for approval
Establish credible worst-case severity.
RiskPrepare for approval
Pre-build recall scope, funding and communications.
FinancePrepare for approval
Define the evidence threshold that triggers escalation.
GovernanceHuman decision required
Preserve the decision record.
LegalDraft

Where calculation ends and human authority begins

Calculate and surface. Evidence, assumptions, arithmetic and consequences are made visible.
Investigate and challenge. AI can extend the search, prepare options and test for conflict or unsupported certainty.
Decide and own. An accountable person weighs the trade-offs, makes the call and remains responsible for what follows.

Learn

What would show the judgement was wrong.

A judgement should say in advance what would overturn it. Change one material condition and see whether it holds.

Worst case is serious harmIndependent testing establishes that a failure could cause serious injury, even though incidence stays low.Worst case is cosmeticIndependent testing establishes that a failure has no safety consequence.

Next decisionDo not automate organisational unreadiness2,000-person company Previous decisionA one-person revenue engine is not a sustainable businessGrowth-stage B2B company

A decision of your own

If a situation in your organisation has this shape, I would be glad to talk it through.

hello@christiannahamilton.com

Method and provenance

The scenario is illustrative. It does not describe a client, an engagement or a real company.

What the tools do, and what remains human

Calculate and surface. Arithmetic and thresholds are handled consistently so the same inputs produce the same result.
Investigate and challenge. Functional positions expose disagreement. The critic looks for conflict, missing evidence, double counting and unsupported certainty. A live reading, where offered, can extend that challenge but cannot alter the underlying numbers or the signed decision.
Decide and own. The signed judgement is Christianna Hamilton’s. It is written in advance and remains the responsibility of a person, not a system.

Evidence

Items marked given in the scenario come from the written brief. Items marked illustrative modelling assumption are quantities added so that consequences can be calculated. Evidence last reviewed 2026-09-21.

Calculations in this decision

Quantity	Unit	What it assumes
Cost of a full recall	EUR million	Every unit in the field, at the unit cost.
Full recall against liquidity	multiple	No insurance recovery is assumed.
Targeted recall, if the batch is small	EUR million	Lower bound of the batch.
Targeted recall, if the batch is large	EUR million	Upper bound of the batch.
Uncertainty in scope	multiple	Upper bound over lower bound.
Expected failures, low case	expected count	Small batch, low rate.
Expected failures, high case	expected count	Large batch, high rate.
Cost of containment while tracing	EUR million	Pause and testing run for the whole trace.
Containment as a share of a full recall	per cent	None beyond its inputs.
Units shipped if nothing changed	units	Shipping continues at the current rate through the trace.