| 1 | Prioritize supply risk using a tiered risk heat map. | Focus management attention on materials and suppliers that could cause the greatest operational, financial, regulatory, or customer impact. | Classify items by impact, likelihood, time to recover, and substitutability. Review the highest-risk categories at least quarterly. | Risk coverage: percentage of critical spend and materials assessed. | Approved risk register with documented owners, mitigation actions, review dates, and escalation thresholds. |
| 2 | Use dual sourcing for critical components. | Reduce dependence on a single production site, country, transportation route, or supplier. | Qualify an alternative source before disruption occurs, while verifying capacity, quality, regulatory compliance, and lead time. | Dual-source coverage: percentage of critical items with two approved sources. | Current qualification records, allocation rules, alternate-source capacity data, and periodic switching tests. |
| 3 | Align inventory with risk-adjusted demand. | Balance working capital against service continuity when demand or replenishment conditions change. | Set safety stock and reorder points according to demand variability, supplier lead-time variability, recovery time, and item criticality. | Service level and inventory turns: tracked by category and risk tier. | Documented inventory policy, exception approval workflow, and monthly review of excess, obsolete, and shortage exposure. |
| 4 | Establish supplier financial and operational monitoring. | Detect early warning signs such as liquidity stress, capacity constraints, quality deterioration, or labor disruption. | Monitor financial health, delivery performance, quality, capacity utilization, sanctions exposure, and major-site changes. | Early-warning response time: time from alert to documented management action. | Risk dashboards, alert thresholds, evidence logs, and assigned corrective-action owners. |
| 5 | Define clear supplier segmentation and governance forums. | Apply the right level of oversight to strategic, bottleneck, leverage, and routine categories. | Use differentiated review frequency, executive sponsorship, performance scorecards, and escalation paths. | Governance adherence: percentage of scheduled reviews completed with actions closed on time. | Segmented supplier list, meeting calendar, decision rights, action tracker, and documented escalation records. |
| 6 | Map sub-tier dependencies and critical production locations. | Identify hidden concentration risks beyond the immediate supplier relationship. | Collect information on key sub-suppliers, manufacturing sites, logistics nodes, country exposure, and single points of failure. | Sub-tier visibility: percentage of critical materials mapped beyond the first tier. | Validated supply network map, site-level location data, dependency records, and annual supplier attestation. |
| 7 | Integrate business continuity and recovery planning. | Limit downtime after natural disasters, cyber incidents, geopolitical events, utility failures, or transportation interruptions. | Require recovery plans for critical suppliers, including alternate sites, backup utilities, communication trees, and recovery priorities. | Recovery readiness: percentage of critical suppliers with tested plans and defined recovery times. | Approved continuity plans, tabletop exercises, test results, lessons learned, and remediation tracking. |
| 8 | Use contracts to manage risk, data, and accountability. | Clarify obligations for continuity, change notification, traceability, compliance, data sharing, and corrective action. | Include business-continuity requirements, audit rights, notification periods, change-control clauses, and measurable service standards. | Contract coverage: percentage of critical suppliers with current risk and continuity clauses. | Signed agreements, approved clause library, renewal controls, audit records, and documented exception approvals. |
| 9 | Build cross-functional decision rights. | Prevent fragmented decisions between procurement, operations, finance, quality, legal, compliance, and logistics. | Form a supply-risk council with defined authority for allocation, inventory changes, supplier onboarding, and emergency sourcing. | Decision speed: elapsed time from material risk escalation to approved action. | RACI matrix, meeting minutes, escalation protocol, approval limits, and records of emergency decisions. |
| 10 | Measure resilience through scenario testing and continuous improvement. | Validate whether plans work under realistic disruption conditions and improve controls based on evidence. | Run periodic scenarios covering supplier failure, demand surge, transport interruption, cyber incident, and geopolitical restrictions. | Action closure rate: percentage of test findings resolved by the agreed due date. | Scenario results, quantified impact estimates, corrective-action plans, retest records, and annual governance review. |