Reading Your Supply Chain One Tier Deeper

Ask a procurement director about supply risk and you will get a competent answer about tier one: who the suppliers are, what the contracts say, when they were last audited.

Ask who supplies those suppliers and the answer thins out very quickly. That is where the concentration that actually interrupts production tends to sit.

Risk is not proportional to spend

Most supplier risk assessment is organised around spend, because spend is the data that exists. This systematically misdirects attention.

A low-value component with a single qualified source can halt a production line as effectively as a strategic category. We have repeatedly found that the items carrying the greatest revenue exposure were not on anyone’s risk register, because they were too small to attract attention.

Measure revenue at risk, not supplier count

Counting suppliers tells you about your administrative burden. It tells you nothing about your exposure.

The more useful exercise is scenario-based: if this supplier stops, what can we not ship, for how long, and what revenue does that represent? Ranking by that figure usually reorders priorities substantially.

The tier two picture does not exist internally

No internal system holds this information, which is why so few organisations have it. Building the map requires combining procurement records with quality audit data and direct conversations with suppliers about their own dependencies.

Suppliers are generally more willing to discuss this than expected, particularly where the relationship is long-standing and the request is framed around joint continuity rather than audit.

Dual sourcing everything is not the answer

The instinctive response to concentration is to qualify a second supplier everywhere. This is unaffordable and largely unnecessary.

A differentiated approach works better: qualify alternatives only where the exposure justifies the cost, use contractual capacity options in the middle tier, and hold targeted buffer stock sized on lead time and disruption probability rather than a uniform number of weeks.

Keep the map alive

The most common failure is treating this as a one-off study. A supplier map built during a project is out of date within a year.

The durable fix is to capture upstream dependency at supplier qualification, so the map maintains itself as the supply base changes. That converts a consulting exercise into an operating routine, which is the difference between knowing your exposure once and knowing it continuously.