Premium Insight

Which Risk Signal Moves First? Three Company Health Score Cases Where Compliance, Cyber and Regional Events Led the Financials

Romana Chládková
Romana Chládková
September 24, 2026
•
25 min read
•
Business Analyst
Man working at a laptop by a window, reading with his hand to his mouth
Share this post
Get a personalized tour of Semantic Visions

Talk to our experts and discover how real-time data insights can support your business.

Book a Demo

Every risk team knows the feeling of reading a quarterly report and realising the problem had been visible for months. The question is where. We went back through daily Company Health Score data for S&P500 companies and picked the three cases where the answer is clearest: Charles River Laboratories, Clorox and Lowe's. In each one, a non-financial sub-score moved weeks before the financial sub-score, and the public record explains why.

Key takeaways

  • In all three cases, the first sub-score to move was not the financial one. At Charles River it was compliance, at Clorox cybersecurity, at Lowe's regional (with ESG moving alongside).
  • The lead time between the first non-financial move and the financial sub-score turning was roughly 97 days for Charles River, 51 days for Clorox, and around six weeks for Lowe's.
  • The leading move was not subtle. Charles River's compliance sub-score fell from −9 to −71.5 in ten days; Clorox's cybersecurity sub-score went from 0 to −35.5 in six weeks.
  • Two of the three cases are negative, one is positive. The pattern holds in both directions: a weather-driven regional signal at Lowe's preceded a financial sub-score that climbed from −5 to +50.
  • The scores are built from media events, not from filings. They are a reading of how the outside world was describing a company, day by day, which is exactly why they can move before the numbers do.

Why look at sub-scores rather than the headline number

The Company Health Score is a composite of six domains: Financial, Operational, Compliance, Cybersecurity, ESG and Regional. Each domain scores from −100 to +100, built from events detected in the news flow and aggregated over a rolling 180-day window. The headline score is a weighted blend of the six.

The blend is useful for ranking a portfolio. It is less useful for understanding a single company, because it smooths out the one thing an analyst most wants to know: which domain broke first, and whether the others followed. Our earlier piece on why context beats scores in risk evaluation made that argument in principle. This article tests it against data.

We used Report Studio to reconstruct the public event timeline for each company, then laid it over the daily sub-score history. What follows is the result, with every event claim linked to a primary source.

Line chart of Charles River Laboratories' Company Health Score, February 2023 to February 2024. After a DOJ subpoena was disclosed on 22 February 2023, the compliance sub-score dropped sharply from about -9 to near -100 and stayed there until August before recovering to around -5 by early 2024. The financial sub-score held just above zero until 25 May, then dipped to about -20 over the summer and returned to zero by January. The overall health score fell from around +25 to about -40 in August. Compliance moved 97 days before financial.

Case 1: Charles River Laboratories, when compliance moved 97 days before the financials

What happened. On 17 February 2023, Charles River received a subpoena from the US Department of Justice relating to an investigation into the Cambodian non-human primate (NHP) supply chain. The company disclosed it five days later, in its Q4 2022 results release, alongside two consequences: it had voluntarily suspended NHP shipments from Cambodia, and it expected the constraint to cut consolidated revenue growth by "approximately 200 to 400 basis points" in 2023. Shares fell as much as 14% that day and closed down about 10%, according to the Boston Globe; Reuters reported an intraday drop of 12.4%.

Securities class actions followed in May 2023 (the initial complaint is public). A year later, the Q4 2023 results showed revenue of $1.01 billion, down 7.9% year on year, with the Discovery and Safety Assessment segment, the unit that depends on NHPs, down 9.5%. The story ran for years: in January 2026 the company said it would buy its Cambodian supplier K.F. (Cambodia) Ltd for about $510 million to gain "greater oversight and operational control of a key supply source" (Reuters).

What the sub-scores did.

Reading it. The compliance sub-score collapsed within four days of disclosure. The financial sub-score did the opposite: it actually rose slightly in late February, as coverage of the results themselves was mixed rather than negative, and it did not cross zero until 25 May, 97 days after the subpoena was received. Between those two dates, the ESG sub-score also swung from +18.7 to −72, as animal-welfare coverage attached itself to the legal story. The volume of articles in the 180-day window went from roughly 4,200 on 22 February to nearly 109,000 by mid-August.

Two notes. First, the compliance sub-score was already mildly negative before 17 February; coverage of the wider Cambodian macaque smuggling case had been running since a November 2022 indictment, so the domain was primed. We are not claiming the score foresaw the subpoena. Second, the reported −7.9% quarter a year later has other components: the company attributed 4.7 points to the prior year's 53rd week, 1.6 points to the Avian vaccine divestiture, and 3.5 points to organic decline. The NHP constraint sits inside that last figure, as the company itself had flagged in February.

Line chart of Clorox's Company Health Score, August 2023 to May 2024. The cybersecurity sub-score fell from zero to about -15 after an 8-K disclosed unauthorised IT activity on 14 August 2023. It dropped further to about -47 after a second 8-K reported manual order processing and shortages, then swung between roughly -25 and -57 through February 2024 before recovering to about -10 by May. The financial sub-score stayed slightly positive until it crossed zero on 5 October and hovered around -10 to -14 before returning near zero. The overall health score declined from about +17 to around -20. Cybersecurity moved 51 days before financial.

Case 2: Clorox, when a cybersecurity signal moved 51 days before the financials

What happened. On 14 August 2023, Clorox filed an 8-K saying it had "identified unauthorized activity on some of its IT systems" and had taken certain systems offline, with some operations "temporarily impaired" (The Register quotes the filing). On 18 September a second 8-K said the company had switched to manual order processing, was experiencing product shortages, and expected a material impact on its fiscal first quarter (Cybersecurity Dive).

The numbers arrived on 4 October in a preliminary Q1 update: net sales expected to fall 23% to 28%, against a prior expectation of mid-single-digit growth, and a diluted loss per share of $0.35 to $0.75. The Q1 FY2024 results on 1 November confirmed it: net sales down 20% to $1.39 billion, diluted EPS down 75% to 17 cents, $24 million of attack-related costs in the quarter. By the end of calendar 2023 the cumulative cost had reached $49 million, per the company's 10-Q as reported by BleepingComputer. In July 2025 Clorox sued its IT help-desk provider Cognizant for $380 million, alleging the attackers obtained credentials simply by phoning the help desk; Cognizant disputes the claim (Cybersecurity Dive).

Reading it. The sequence is the textbook one for an operational cyber incident. Cybersecurity moved first, within a day of the 8-K. Operational followed five weeks later, the day after the second 8-K described shortages. Financial did not cross zero until 5 October, the day after the company itself quantified the damage, 51 days after the cybersecurity sub-score first moved and 78 days before the quarterly results. Note the shape of the financial line: it held at +2 throughout September even as the cyber sub-score fell past −35. The media were describing an IT problem and a supply problem; nobody was yet writing about revenue.

Line chart of Lowe's Company Health Score, August 2024 to July 2025. The regional sub-score sat at zero until early October 2024, when it rose to about +12 following a $2 million Hurricane Helene pledge. It climbed to about +21 around the Q3 2024 results in late November, then eased back to zero by late May. The financial sub-score dipped slightly below zero in September, rose steadily from November, and peaked at about +50 around the Q4 2024 results in March 2025 before settling near +30. The overall health score ranged between about +10 and +45. In this positive case, regional moved about six weeks before financial.

Case 3: Lowe's, when a regional signal preceded a positive financial turn

What happened. Hurricane Helene made landfall in late September 2024. Lowe's activated its Emergency Command Center on 24 September and on 30 September pledged $2 million to relief efforts, noting it was shipping generators, chainsaws, gas cans and dehumidifiers to affected stores. On 11 October it added an incremental $10 million.

On 19 November, Q3 2024 results showed sales of $20.2 billion and comparable sales down 1.1%, "partly offset by storm-related sales." The company nudged its full-year sales outlook up to $83.0–83.5 billion from $82.7–83.2 billion, citing "anticipated modest storm-related demand in the fourth quarter." Reuters noted the comp decline beat the consensus expectation of −2.86%. On 26 February 2025, Q4 2024 results showed comparable sales up 0.2%, driven in part by "rebuilding efforts in the wake of recent hurricanes." In January 2025 the company had also pledged $2 million to California wildfire relief.

Reading it. This is the weakest of the three chains, and we include it for that reason. The regional sub-score had sat at exactly zero for months; it moved to 11.6 on 4 October as coverage of the storm response accumulated, and peaked at 21.1 in late November. The financial sub-score went from −5 in September to +11 by 17 November, before results, dipped on earnings day, then climbed steadily to +50 by March 2025 as coverage of the beat, the outlook and the positive comp built up.

Two caveats matter. Lowe's itself said the Q3 beat held "even excluding storm-related activity," so hurricane demand was one of several drivers, alongside Pro and online growth. And the first sub-score to react was not regional but ESG, which jumped from 32.7 to 43.1 on 2 October as the relief pledge and volunteer mobilisation were read as community events. In practice, a disaster-response story lights up two domains at once.

What the three cases have in common?

Three things stand out.

The financial sub-score is a confirmation signal, not an early one. In all three cases it moved after the company itself had put numbers on the problem, or after analysts had. That is not a flaw in the score; it is what "financial" coverage is. If you are watching only that domain, you are reading the same news as everyone else.

The leading domain matches the kind of event. A legal event hit compliance. A breach hit cybersecurity. A natural disaster hit regional. This sounds obvious, but it is the reason sub-scores are more useful than the blend: the first domain to move tells you what kind of problem you are looking at before you have opened a single article.

The leading move was large. None of these were two-point drifts. When a sub-score moves 30 or 60 points inside a few weeks, the system is detecting a sustained flow of severe events, not a single headline.

"When I look at a company, I don't start with the headline score. I start with the domain that has moved the most in the last two weeks, and then I ask whether a second domain is starting to follow. Clorox is the clearest example: cybersecurity alone was an IT story. The day operational crossed zero, it became a supply story, and from that point the financial impact was a matter of when, not whether. The score doesn't tell you the number. It tells you which articles to read first, and it tells you about six weeks earlier than the quarterly report does."

— Romana Chládková, Senior Business Analyst, Semantic Visions

What this means for risk teams

For a third-party or credit risk function, the practical implication is a change in what gets watched. Rather than a single health number with a threshold, the useful trigger is a large move in any one domain, followed by a check on whether the other domains are starting to follow. Charles River's ESG sub-score turning from +19 to −20 within a week of the compliance collapse was the second signal that this was going to be a long story. Clorox's operational sub-score crossing zero on 20 September was the moment an IT incident became a supply incident.

This is also where the auditability matters. Each daily value in the tables above can be traced back to the events that produced it, and each event to the article it came from. When the compliance sub-score of a supplier drops 40 points, the question "why?" has a documented answer, which is the standard we argued for in third-party risk monitoring with OSINT.

Limitations

  • Three cases, chosen for clarity. We started with researching S&P500 companies and kept the three where the public record most clearly explains the score movement. The other three (PulteGroup, Ulta Beauty, Cincinnati Financial) did not show a clean chain from a single non-financial driver to a financial outcome, and we did not force one.
  • Media signals, not causation. The scores measure how a company is being written about. They moved before the financials because the underlying events were public before the financial consequences were. That is exactly the value, but it is not the same as a causal model.
  • Retrospective reconstruction. Event timelines were built with Report Studio after the fact, and sub-score values are read from the daily history. The lead times we quote are what an analyst watching the dashboard would have seen; they are not the output of a forecasting model.
  • Other factors in the financials. Charles River's −7.9% quarter includes a 53rd-week comparison and a divestiture. Clorox's recovery was shaped by inventory rebuilding and portfolio changes. Lowe's own management said its Q3 beat held even without storm-related activity.

Frequently asked questions

What is a Company Health Score sub-score?

The Company Health Score breaks a company's media-derived risk profile into six domains: Financial, Operational, Compliance, Cybersecurity, ESG and Regional. Each domain has its own score from −100 to +100, calculated daily over a rolling 180-day window. The headline score is a weighted aggregate of the six.

Why did the financial sub-score move last in all three cases?

Because financial coverage follows financial disclosure. Journalists write about revenue impact when the company or analysts quantify it. Compliance, cyber and regional events are reported as they happen, so those domains register first.

Does a sub-score move mean the company's financials will follow?

Not by itself. It means a flow of events in that domain is being reported at a volume and severity the model considers significant. Whether the financials follow depends on the event. The pattern in these three cases is that when the leading move is large and a second domain follows, the financial consequence tends to appear.

Can the score turn positive as well as negative?

Yes. Lowe's is the positive case here: a regional and ESG signal from disaster response preceded a financial sub-score that rose from −5 to +50 over five months.

Where does the event data come from?

From news monitoring across 12 languages, with events detected, classified by type and scored for sentiment, intensity and severity before they enter the daily signal. Every event can be traced back to its source article inside svEye.

References and further reading

Related articles

Access Premium Insights

By submitting your email, you agree that Semantic Visions may contact you with relevant business communications. You can opt out at any time.
Thank you! Your submission has been received and insights will be unclocked shortly!
Oops! Something went wrong while submitting the form.

Related articles

Data image

You Can't RECODE a Blind Spot

Read more
Close-up of a laboratory pipette dropping liquid into glass test tubes, representing the pharmaceutical development of semaglutide drugs like Ozempic.

The Ozempic Signal: How AI Media Monitoring Read a Drug's Risk Story Years Before the Headlines

Read more
A misty mountain landscape illustrating supply chain visibility challenges and the importance of continuous third-party risk monitoring and OSINT to uncover hidden vendor risks.

Third-party risk monitoring with OSINT: The signals your vendor questionnaire cannot capture

Read more

See Everything. 
Focus on What Matters.

svEye™ filters the noise to uncover meaningful patterns and insights. Gain clarity, stay informed, and drive smarter decisions with a comprehensive overview.

Free Trial
Third Party / Supply Chain Risk
News and Media
Manufacturing and Consumer Goods