Supplier concentration risk: a 5-step assessment
A practical framework for finding the hidden single points of failure in your supply base — before a disruption forces the discovery.
Concentration risk is the quietest exposure on the balance sheet. It rarely shows up in a variance report because the vendor is performing well — right up until they aren't. This is a five-step assessment executives can run without a consultant.
Step 1 — Map spend, not vendors
Pull twelve months of AP data. Group by parent company, not payee name. A surprising share of "diversified" spend traces back to two or three parents once subsidiaries and reseller intermediaries are collapsed.
Step 2 — Add the geography layer
For each vendor, tag the country of manufacture — not the country of the contracting entity. Two US-registered suppliers that both source finished goods from a single Chinese province are one risk, not two.
Step 3 — Score criticality
- Would a 30-day outage stop production or delivery?
- Is the input single-sourced by specification, not just by choice?
- What is the qualification lead time for an alternative?
Anything scoring "yes / yes / more than 90 days" is a structural single point of failure. Everything else is inventory management.
Step 4 — Look at your customers' concentration too
Concentration on the customer side is the risk executives most often miss. If one buyer represents more than 20% of revenue, the operational plan needs a scenario for their loss — not because it will happen, but because pricing power evaporates the moment they realize the leverage.
Step 5 — Set a threshold, not a resolution
The goal isn't zero concentration. It's a documented threshold with a documented response. "No single vendor above 15% of category spend without a qualified alternative on file" is an executable rule. "Reduce vendor concentration" is not.