Portfolio Risk Alerts: Count Is Not Coverage

Coverage in risk monitoring is not set by indicator count. It is set by three properties: whether the data source actually reaches you, whether the trigger can be decided mechanically, and whether an exception has a named owner and action. With all three, one indicator buys real coverage. Missing any, two hundred indicators simply file noise in more compartments. Catalpa publishes a monitoring design built on 18 alerting indicators; the relevant point is not the number but that each one carries a source, a trigger condition and a closing action, and is recomputed on schedule. That is the difference between a control system and an indicator supermarket.

Three source families, three indicator families

Data source	Indicators it can support	Refresh	How it usually fails
Public signals: registry changes, litigation, penalties, share pledges, news	Entity anomalies, new defendant status, frozen equity, controller change	Daily or event-driven	Not bound to the holding list; aliases of one entity cause silent misses
Self-reported portfolio company data	Cash runway, revenue trend, receivables and inventory turns, key-person loss	Monthly or quarterly	Missing submissions hidden behind averages; no report reads as no risk
Internal fund and deal data	Contribution progress, overdue resolution items, unmet agreement covenants, valuation write-downs	Per workflow step	Back-dated timestamps defeat overdue logic

Cost and value curves differ sharply. Public signals are the easiest to buy and the easiest to build, but carry the lowest information density: one event appears once each in registry, court and news feeds, and without deduplication it consumes the reviewer’s attention three times. Self-reported operating data is hardest to sustain yet covers the most material risk. Internal data needs no external purchase, only complete workflow fields — the best value per unit of effort, and the most frequently skipped.

Three mandatory elements per alert

• Trigger definition: written as a decidable sentence, with comparison object, threshold, time window and exclusions. “Litigation appeared” is not a definition. “New defendant case with claimed amount above a set share of that entity’s net assets, still open” is. Set thresholds from the client’s own sector and holding policy rather than importing vendor defaults.
• Action: who does what, within how long — call for confirmation, request written explanation, hold the next contribution, escalate to reinvestment committee. An alert with no action was never sent.
• Closing condition: who confirms closure and what record survives. Without it the same event re-triggers from several feeds until somebody switches it off in frustration.

Four origins of alert fatigue

First, uncalibrated thresholds: launch values come from industry defaults, nobody retunes them, and trigger volume decouples from real risk within a year. Second, no deduplication: the same case against the same controller fires once per source. Third, no baseline: the indicator reads absolute current values instead of movement against that entity’s own history, so an early-stage technology company and a mature manufacturer get systematically mismatched under one threshold. Fourth, no owner: alerts land in a shared inbox that nobody treats as their task list.

Only the first three are product problems. The fourth is organisational. What software can do is bind the action to a role and turn overdue exceptions themselves into a metric.

Run this acceptance test before go-live

• Pick entities from the current holding list and verify aliases and former names resolve to one object. Treat this as a miss test, not a demo.
• Trace one known public event from occurrence to alert and record the calendar days. That interval is your real lead time.
• Compute last cycle’s total triggers and the share the business confirmed as genuine risk. Retune or retire indicators with high volume and low confirmation.
• Check that every alert drills down to source evidence and a link. Without drill-down, mark it unusable.
• Verify deduplication: one entity, one event, multiple feeds must produce one work item.
• Name the owner for each closure step, and put undisposed overdue alerts on the standing agenda.
• For self-reported data, make on-time submission rate and non-reporting entity count first-class indicators. Prove collection capability before claiming operating insight.

When we advise against starting with risk alerts

Three cases. If the holding list is not yet resolved to unique entities, the system produces duplicate alerts and structural misses at the same time, and neither is fixable by tuning. If the team has no reserved weekly review hours, narrow the scope to purely internal indicators such as contribution progress and overdue covenants; alerts only pay for what someone acts on. If public signal feeds are purchased but not wired into post-investment workflow, the effect is not faster detection — it is quarterly review plus a mailbox nobody reads. The path from indicators to model-assisted judgement is described under AI agents and intelligent risk; unified controls across lending, factoring and guarantee businesses appear in quasi-financial group credit control and financial holding and quasi-financial.

The test after one year is simple. Can you name which risk a specific indicator caught first, who acted, and how long it took, with the record to prove it? If not, the indicator count only measured the length of a configuration screen.