Supplier risk & n-tier visibility

Most companies know their direct suppliers well. Far fewer know who supplies those suppliers, and that’s often where disruptions start. In 2021 the global chip shortage halted car assembly lines around the world, though carmakers rarely buy chips directly: the chips sat two or three tiers down, inside modules made by their suppliers.

N-tier visibility means mapping the network beyond tier 1:

1. Map: for critical parts, ask tier 1 suppliers where their key inputs come from, down to raw materials if needed.
2. Find concentration: several suppliers depending on one sub-supplier, one region or one port is a hidden single point of failure.
3. Score risk: financial health, geographic exposure (floods, earthquakes, conflict), quality history, compliance and ESG, and how long the part would take to replace.
4. Monitor: news, weather and financial alerts that flag trouble early.
5. Act: for the riskiest items, add safety stock, qualify alternatives, redesign to standard parts, or sign capacity agreements.

A useful way to prioritize is to ask, for each part: if this supplier stopped tomorrow, how long could we keep running on the stock we have, and how long would it take to recover with another source? Parts where recovery takes longer than survival need attention first.

Mapping is hard work. Suppliers may not want to reveal their sources, and networks change constantly, so companies focus on critical items rather than trying to map everything.

Time to survive and time to recover

For each critical part:

• Time to survive (TTS): how long you can keep meeting demand if the supplier stops, using stock on hand, in transit and at alternative sources.
• Time to recover (TTR): how long the supplier, or a replacement, needs to restore full supply.

If TTR is longer than TTS, there is a gap during which sales are lost.

Simchi-Levi, Schmidt and Wei (2014) used this approach with Ford and found that many of the highest exposures sat in low-spend parts, the ones procurement usually watches least.

A practical risk routine

1. Segment: start with parts that are single-sourced, long lead time or critical to high-revenue products.
2. Map: ask tier 1 suppliers for the sites and key sub-suppliers behind those parts; check with bills of materials, trade data and supplier audits.
3. Score likelihood and impact across risk types: financial, operational, geographic, compliance and ESG, cyber.
4. Monitor: alerts for news, weather, financial distress and sanctions at the mapped sites.
5. Act and review: assign owners and actions for the highest scores, and re-run as products and suppliers change.

Spotting financial distress early

Supplier bankruptcies rarely come without warning. Signals include late deliveries and quality slips, requests for faster payment or advances, staff turnover, delayed filings and falling credit ratings. Financial models such as Altman’s Z-score combine ratios from published accounts into a distress indicator. For private or small suppliers, payment behaviour and operational signals are often the best evidence available.

Choosing the response

Risk responses cost money in normal times, so match them to the risk:

• Avoid: redesign to remove a risky input.
• Mitigate in advance: safety stock, second sources, capacity reservations, supplier development.
• Plan contingencies: pre-agreed backup suppliers, transport reroutes, customer allocation rules.
• Accept small risks that cost more to cover than to bear.

Inventory suits frequent, short disruptions; second sources and contingency plans suit rare, long ones.

Laws that require n-tier knowledge

Due-diligence rules increasingly make deeper mapping a legal requirement. The US Uyghur Forced Labor Prevention Act presumes that goods made wholly or partly in Xinjiang involve forced labour unless importers prove otherwise, which requires tracing inputs such as cotton and polysilicon. The EU’s corporate sustainability due diligence directive and Germany’s supply chain act require large companies to identify and address human-rights and environmental risks in their supply chains. For exporters, customers will ask for this evidence.

Lessons from the chip shortage

When car demand recovered faster than expected in 2021, chip makers had already given capacity to electronics customers. Car makers learned that:

• low-cost parts can be the binding constraint,
• just-in-time ordering through tier 1 suppliers left them with no visibility of tier 2 and 3 capacity,
• long-term agreements and direct relationships with critical component makers buy priority,
• some strategic buffer stock of hard-to-replace parts is cheaper than idle assembly lines.

Making it stick

Risk registers often become lists nobody acts on. What works: owners and deadlines for each high-risk item, risk reviews inside S&OP and sourcing decisions, and drills that test contingency plans before they are needed.