What should you do when a critical category depends on one supplier?
Dependency on a single supplier is measured by what stops if it fails, not by what you spend with it. Exposure equals margin at risk per week multiplied by the weeks needed to recover. A small supplier can carry exposure many times its annual spend. Mitigation options are then compared on cost, time to take effect and exposure removed.
Exposure = margin at risk per week × weeks to recover
Mitigation options for single-supplier dependency| Option | Cost | Time to effect | Exposure reduced |
|---|
| Safety stock | Holding cost | Immediate | Covers the stock duration only |
| Second-source qualification | Qualification cost | Months | Most of the exposure |
| Continuity clauses | Negotiation effort | Weeks | Partial, depends on enforceability |
| Specification change | Engineering effort | Months | Removes the dependency |
| Supplier monitoring | Low | Immediate | Earlier warning, no reduction |
Illustrative figures
Component supplier: €80,000 annual spend.
Line margin: €400,000 per week. Recovery time without a second source: 10 weeks.
Exposure: €4,000,000, fifty times the annual spend.
Where this decision is actually made
Spend reports rank this supplier near the bottom, which is why the risk is often invisible. Seeing it requires modelling the failure scenario and the cost of each mitigation before something goes wrong, not analysing past invoices. That is the task of scenario-based procurement analytics.
Why does spend size mislead in risk assessment?
Risk follows what the supply enables, not the invoice value. A spend ranking shows where money goes; it does not show which purchases keep a production line, a service or a regulated process running.
Low-spend items — components, licences, niche services — often stop much larger processes when they fail, because nothing else can replace them quickly. For financial entities, the same logic underlies the ICT third-party concentration requirements discussed under supplier concentration risk under DORA: the question is what depends on the provider, not how much it is paid.
How do you estimate recovery time?
Recovery time is the time needed to find, qualify and ramp up an alternative to the point where it delivers the required volume and quality. It is usually longer than the time needed to sign a new contract.
Ask engineering or quality teams for realistic qualification times, based on what past supplier changes actually took rather than on plans. Include tooling, testing and trial orders, and add regulatory approvals where they apply, since in some sectors these alone take months. Where estimates differ, use a range and calculate exposure at both ends.
When is safety stock cheaper than a second source?
Compare the annual holding cost of stock that covers the recovery time with the one-off cost of qualifying a second source plus any price premium the second source charges. The comparison should run over the same period, usually the expected life of the product or contract.
The two options do different jobs. Stock covers short disruptions such as a delayed shipment or a temporary capacity problem; a second source covers supplier exit. Many categories need both, sized differently: a smaller buffer to bridge the ramp-up, and a qualified alternative for a permanent loss of supply.