Supplier risk and supply chain resilience: a working framework

Suppliers & risk · By the Buyer's Ledger editorial team · Published 2026-10-17

Close-up of heavy, deeply rusted chain links piled on top of each other, wet from the rain — Rusty chain links in an industrial yard in Lysekil, Sweden. A supply chain fails at its weakest link, often one tier away from the buyer.

Supplier risk management is the discipline of anticipating what could stop a supplier delivering, or make it harmful to keep using them, and preparing before it happens. Resilience is the outcome: the ability of the supply chain to absorb a disruption and recover quickly. The pandemic, port closures, semiconductor shortages and conflict-related shipping disruption have moved the subject from a compliance checklist to a board-level concern.

Types of supplier risk

Risk	Examples	Typical signals
Operational	Quality failures, capacity shortfalls, plant breakdowns, cyber incidents	Falling OTIF, rising defects, missed confirmations
Financial	Insolvency, liquidity stress, dependence on a single customer	Late filings, deteriorating accounts, requests for advance payment
Geographic and geopolitical	Natural disasters, conflict, sanctions, export controls, tariffs	Location data, sanctions list changes, trade announcements
Concentration	Single or sole source, many suppliers relying on the same sub-supplier	Spend and bill-of-materials analysis
Compliance and ethical	Bribery, forced or child labour, environmental damage, data protection breaches	Audits, media and NGO reports, certifications lapsing
Cyber and information	Supplier with access to systems or data is breached	Security questionnaires, certifications such as ISO/IEC 27001

Distinguish single source (you chose one supplier although others exist) from sole source (only one supplier can provide the item). The first is a decision you can revisit quickly; the second needs longer-term work such as redesign or developing a new supplier.

A framework in five steps

The general risk management process in ISO 31000 (identify, analyse, evaluate, treat, monitor and review) applies well to suppliers.

1. Segment and identify

Start with criticality, not spend. For each supplier or category, ask what happens if supply stops tomorrow: how long until operations or customers are affected, and how long would it take to replace the supplier? Combine with spend data and the Kraljic position. Focus deep work on the critical few: bottleneck and strategic suppliers and those with access to sensitive systems or data.

2. Map beyond tier 1

Many disruptions originate deeper in the chain: a tier-2 chemical plant, a tier-3 chip foundry. Mapping requires asking critical suppliers for their key sub-suppliers and plant locations, sometimes under confidentiality, and checking whether several of your suppliers depend on the same hidden source. The mapping does not need to be complete everywhere; it needs to be good for the items that would stop you.

3. Assess

Score each risk for likelihood and impact on a simple scale. Impact can be quantified as time-to-recover (how long until supply is restored) against time-to-survive (how long you can operate without it, given inventory and alternatives). Where time-to-recover exceeds time-to-survive, there is a gap that needs action.

4. Treat

Options, roughly from cheapest to most expensive:

Accept and monitor for low-impact risks.
Contractual protection: business continuity obligations, notification duties, step-in rights, escrow for software source code, last-time-buy rights for components being discontinued.
Supplier development: helping a critical supplier improve quality, capacity or continuity planning.
Inventory buffers: safety stock at your site or held by the supplier (consignment, vendor-managed inventory). Targeted buffers on a few critical items are cheaper than broad overstocking.
Dual or multiple sourcing, ideally from different regions, with real volumes going to each so the second source stays qualified.
Design changes: standardising parts, qualifying alternative materials, reducing dependence on scarce inputs.
Nearshoring or regionalisation of production for the most exposed items.

5. Monitor and review

Risk is dynamic. Combine scheduled reviews of critical suppliers (financial statements, scorecards, continuity plans) with event monitoring: news, sanctions lists, weather and geopolitical alerts for the locations in your map. Commercial risk-monitoring services can automate parts of this, but they only work if your supplier and location data are clean.

Business continuity

For critical suppliers, ask whether they have a business continuity management system and test plans regularly. ISO 22301 specifies requirements for such systems; certification is not essential, but the logic is useful for evaluating any supplier's plan: a business impact analysis, defined recovery objectives, alternative sites or suppliers, and exercises. Your own continuity plan should name what you will do if a critical supplier fails: which alternative to activate, who decides, and how customers will be informed.

Financial risk in practice

Supplier insolvency is often preceded by signs visible to an attentive buyer: deteriorating published accounts, late filing, sudden changes in payment terms requested, key staff leaving, quality slipping as cash tightens. Where a critical supplier is fragile, options include shorter payment terms or supply chain finance to ease their cash flow, taking ownership of tooling, and accelerating qualification of an alternative. Be careful about over-dependence in the other direction too: if your business represents most of a small supplier's turnover, a sudden loss of volume could push them into difficulty.

Resilience versus efficiency

Lean practices (low inventory, single sourcing, just-in-time delivery) cut cost and waste but reduce slack. Resilience measures add cost. The answer is not to abandon lean but to be deliberate: identify the items where the cost of disruption clearly exceeds the cost of protection, and invest there. Making the trade-off explicit, with the time-to-recover and time-to-survive figures, helps finance and operations agree on it. For the specific case of geopolitical exposure, see geopolitics and supply chains; for human-rights and environmental risks that now carry legal duties, see supply chain due diligence.