Most operational assessments produce a deck and a list of recommendations nobody sequences. A 90-day profit-and-loss (P&L) triage produces something a defense manufacturer can act on: a diagnosis of where the money is actually going, the constraint that holds it there, and the order in which to remove it. The 90 days is the arc from first walk to first results. The written, defensible plan that anchors it is delivered in the first 30 days, during the operational triage, so the rest of the window is execution against a plan you already trust.

What does a 90-day P&L triage actually produce?

A 90-day P&L triage produces a diagnosis, a defensible written plan, and the first measurable results from acting on it, structured in three phases. The first phase audits the P&L against floor reality and maps the value stream. The second stabilizes the process with new policies and audit routines. The third builds the future state and trains the team to hold the gains.

The defining output is not the report. It is the alignment between what the financials say and what the floor is doing. In most engineering-led shops those two pictures have drifted apart for years, and the gap is where the trapped cash and the unquoted rework live. The triage closes the gap.

To be precise about the deliverable timeline, because it matters for what you are buying:

  • The 30-Day Operational Triage delivers the written diagnostic plan. It names the constraint and the sequence to remove it. That is a fixed-scope, fixed-deliverable engagement.
  • The 90-day arc is diagnosis through stabilization to first results. The 30-day written plan is the spine of it, and the remaining weeks are execution and the early proof the plan works.

What is the diagnostic sequence?

The diagnostic sequence runs value stream first, constraint second, margin leak third, and compliance gaps fourth, because each step depends on the one before it. You cannot name the constraint until you have mapped how work actually moves, and you cannot find the margin leak until you know where work piles up.

Value stream mapping

The first step is mapping how a job moves from quote to cash, on the floor, not from a conference room. Value stream mapping is the lean discipline of drawing the actual path of work, including the waits, the rework loops, and the hand-offs that no process document records. Gemba walks, walking the floor where the work happens, are how the real map gets built. The map almost always contradicts the official routing.

Constraint identification

With the map drawn, the next step is finding the constraint, the single resource or step that sets the pace of the entire shop. This is the Theory of Constraints principle: a system's throughput is governed by its bottleneck, and improving anything other than the bottleneck does not increase output. Most shops pour effort into steps that are not the constraint and wonder why the backlog never shrinks. The triage names the real one.

Margin leak analysis

Once the constraint is clear, the next step is finding the margin leaking around it: the rework, scrap, and undocumented problem solving the ERP never recorded. This is the Hidden Factory. Quality pioneer Armand Feigenbaum estimated this loss can reach 40 percent of total capacity. The analysis puts a number on the jobs that lose money, the capacity consumed by rework, and the cash trapped in long-lead inventory.

Compliance gap assessment

The final diagnostic step is scoring the compliance posture against the regulatory exposure the shop actually carries. For a defense manufacturer that means Cybersecurity Maturity Model Certification (CMMC) readiness against the 110 controls of NIST Special Publication (SP) 800-171, the accuracy of the self-assessed Supplier Performance Risk System (SPRS) score, International Traffic in Arms Regulations (ITAR) handling, and AS9100 evidence. As of July 2026 CMMC Phase II, the phase that would have made Level 2 third-party certification mandatory in DoD contracts, is suspended, while the DFARS 252.204-7012 safeguarding obligation and the SPRS self-assessment behind it stay in force. A wrong SPRS score is a false-affirmation risk the Department of Justice pursues under the False Claims Act. These gaps go into the same plan as the operational ones, because for a defense shop they are not a separate track.

What does the written defensible plan contain?

The written plan names the constraint, the sequence to remove it, and the cash and throughput each step is expected to free, in an order the team can execute. It is defensible because every claim ties back to the value stream map and the P&L, not to opinion. A founder can hand it to a partner, a banker, or a board and have it hold up to scrutiny.

What separates this plan from a consultant's deck:

  • It names one constraint, not twenty opportunities. A list of twenty improvements is a way to do nothing. One sequenced constraint is a way to start Monday.
  • It sequences by dependency and by cash. Early wins are chosen partly to fund the later work, so a cash-constrained shop can self-finance the transformation.
  • It is owned by the team, not the consultant. Embedded training on data governance, pull systems, 5S, and the right use of AI means the people who run the shop can run the plan after the engagement closes.

A plan you can act on without me in the room is the only kind worth writing. The test of the diagnostic is whether your own team can execute the sequence after I step back.

What cash and throughput levers does the triage surface?

The triage surfaces levers in two families: throughput levers that lift output by exploiting the constraint, and cash levers that free working capital trapped in inventory and rework. Both come straight out of the diagnostic, which is why the sequence matters.

The recurring levers in a defense electromechanical or sensor manufacturer:

  • Exploit the constraint before adding capacity. Most shops want to buy a second cell when the existing constraint is starved by setup time or rework. Lifting throughput at the bottleneck is faster and free.
  • Recover cash conversion days. AlixPartners found the aerospace and defense cash conversion cycle lengthened from 138 to 159 days between 2018 and 2022. Cash trapped in long-lead inventory and rework loops is recoverable by removing the constraints that hold it there.
  • Stop quoting jobs that lose money. The margin leak analysis reveals which parts are priced below their true loaded cost once rework is counted. Re-quoting or exiting those jobs is often the single highest-return move.
  • Convert recovered capacity into compliance bandwidth. The capacity freed at the constraint is exactly the headroom a shop needs to do the CMMC readiness work without halting production.

How is the defense version different from a generic 90-day plan?

The defense version differs by hardwiring compliance into every phase rather than treating it as a separate workstream. A generic 90-day operational plan optimizes throughput and cash and stops there. A defense shop that does that and ignores its CMMC posture and its SPRS score can free a quarter of working capital and still lose the prime.

So compliance lives inside the diagnostic, the stabilization, and the future state. The audit routines installed in the stabilization phase are the same routines that produce CMMC and AS9100 evidence. The data governance taught to the team is the same governance that protects Controlled Unclassified Information (CUI). The work is built so the operational gains and the regulatory readiness arrive together, because for this buyer they are the same problem wearing two faces.

The bottom line

A 90-day P&L triage produces a diagnosis of where the money is going, a defensible written plan that names the constraint and the sequence to remove it, and the first measurable results from executing it. The 30-day operational triage delivers the written plan; the full 90 days carries it from diagnosis through stabilization to early proof. The diagnostic runs value stream, constraint, margin leak, and compliance gaps in that order, and for a defense manufacturer the compliance work is hardwired into every phase rather than bolted on at the end.

Sources

  • DoD CIO, About CMMC. The July 13, 2026 suspension of CMMC Phase II, the reform task force, and the Phase 1 pause, under which Level 2 remains a self-assessment against NIST SP 800-171 Revision 2 with annual affirmation into SPRS. The same page states the suspension "does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012." Retrieved July 16, 2026.
  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The clause that imposes the NIST SP 800-171 safeguarding obligation and that the Phase II suspension explicitly leaves in force. Retrieved July 16, 2026.
  • NIST SP 800-171 Revision 2. The 110 security requirements the compliance gap assessment scores against. Worth knowing which version you are being measured on: NIST withdrew Revision 2 on May 14, 2024 and superseded it with Revision 3, but DoD's CMMC Level 2 self-assessment and DFARS 252.204-7012 still run against Revision 2, and Revision 3 does not carry the same 110-requirement structure. Retrieved July 16, 2026.
  • Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative, U.S. Department of Justice, October 6, 2021. DOJ's statement that it will "utilize the False Claims Act to pursue cybersecurity related fraud by government contractors," including "knowingly misrepresenting their cybersecurity practices or protocols," which is what a wrong SPRS score is. The underlying exposure is the False Claims Act itself, 31 U.S.C. 3729, which the FAR directs contracting officers to consult counsel about at FAR 32.503-14(c). Retrieved July 16, 2026.
  • Theory of Constraints, Theory of Constraints Institute. The principle used in the constraint identification step, developed by Dr. Eliyahu Goldratt and introduced in his book The Goal: every system has one limiting constraint, and "strengthening the other links can never increase the overall strength of the chain."
  • Value Stream Mapping and Gemba, Lean Enterprise Institute. The two tools behind the first diagnostic step. Toyota developed value stream mapping as part of the Toyota Production System; gemba is the Japanese term for the actual place where work happens, and a gemba walk is grasping the current situation by direct observation rather than by reading a report about it.
  • Dr. Armand Feigenbaum on the Cost of Quality and the Hidden Factory, IndustryWeek, July 4, 1994. Feigenbaum in his own words, putting the hidden factory at "anywhere from about 20% to 40% of total capacity of many American companies."
  • Navigating the Skies of Working Capital: Call for Action in the Aerospace and Defense Industry, AlixPartners, June 2, 2023. The cash conversion cycle lengthening from 138 days in 2018 to 159 days in 2022, across 98 publicly listed aerospace and defense companies globally. An industry trend, not an SMB benchmark. Retrieved July 16, 2026.