Supplier Concentration Risk

A manufacturer buys 80% of a key component from one factory. The other 20% comes through a different distributor but is made at the same factory.

Its two purchase orders do not provide genuine supply diversity. Map the items and services needed to keep operating, because some cheap inputs can halt production while a large spend category may be easy to replace, so rank impact before concentrating only on the highest invoice totals.

Identify the ultimate dependency, since different supplier names may share a parent, a plant, a data centre, a transport route or a scarce upstream material, and look through the first-tier vendor when the risk warrants it. Measure exposure on a useful basis, as share of spend, units, production capacity and time to replace can each tell a different story, and a 70% spend share is not automatically more dangerous than a 30% share of a non-substitutable component.

A UK government report on global supply-chain resilience describes concentration, interdependencies and bottlenecks as sources of vulnerability, and notes that plans, buffers and flexible operations can change the severity of an exposure. Ask what failure would do, since a supplier might miss deliveries for a week, lose a licence, suffer a cyber incident or close a plant, and estimate the time until your inventory or service continuity fails under each plausible scenario.

Compare that time with recovery options, such as whether an approved alternate can supply the same specification, whether production can switch to another material and whether an emergency shipment is possible, and at what cost. Set a threshold for review, not a universal safe percentage, since a company may accept sole sourcing for a low-impact item but require backup capacity for a regulated or safety-critical one, and document the decision and owner.

An illustrative concentration measure is purchases from the largest supplier divided by total purchases for that critical input: if $800,000 of $1,000,000 comes from one source, the share is 80%, which is a warning signal, not the expected loss. Check commercial terms, because a long exclusive contract can increase switching cost while reserved capacity or inventory commitments may improve continuity, and verify which protections are binding and how they work during a widespread shortage.

Use alternatives selectively, since a second supplier requires qualification, compatible specifications and enough volume to stay ready, and splitting orders across two names without testing capacity creates a paper backup. The Institute of Internal Auditors discusses third-party risk practices that include oversight through the relationship; concentration is one exposure inside that wider discipline, and monitoring one key provider's health does not by itself solve the dependency.

Stress test correlated shocks, because two suppliers located in the same flood zone, reliant on the same chip or using the same shipping lane may fail together, and geographic diversity alone does not prove independence. Inventory buffers can buy time but tie up cash, space and spoilage risk, so choose a buffer based on demand, lead time and consequence of interruption rather than a round number of weeks.

Monitor changes, since a merger can combine previously independent suppliers, a supplier can move production to a single plant and a new product can raise demand sharply, and keep a tested response plan naming who contacts the supplier, approves alternate specifications, informs customers and prioritises limited stock. Avoid unfairly punishing a strong supplier for being successful, because mitigation can involve internal flexibility and transparent collaboration, not only threatening to move orders, and for an owner the key question is whether a single failure can stop an important outcome before the business can adapt, so quantify that exposure, test real alternatives and pay for resilience where interruption would hurt most.