Supplier Concentration Risk: Qualification Time, Buffers and Recovery Options

A buyer can have several direct suppliers and still rely on one sub-tier plant. Another buyer can source most of a category from one supplier yet hold a tested alternative and adequate buffer. The operational consequence of losing supply, and the time needed to recover it, determine which concentration deserves action.

This analysis connects supplier shares to criticality, qualification barriers and recovery choices. It uses evidence available through 2025. The final scenario shows how to prioritise a dependency without inventing a universal safe concentration threshold.

Define the dependency and its business consequence

“Supplier concentration” can describe share of purchase value, units, production capacity, critical components, purchase orders, approved capacity, accounts payable, or a particular geography. Those denominators answer different questions. A supplier can represent 60% of annual spend because it sells a high-value item while supplying a small portion of physical units. Another supplier can provide 20% of spend but 100% of a safety-critical component.

Write down the buyer entity, category, time period, currency, tier, and denominator. Separate direct suppliers from contract manufacturers, distributors, and sub-tier producers. State whether the measure is based on invoiced purchases, committed spend, forecast demand, or available capacity. The SEC filing for Carrier Global illustrates why the period and denominator matter: it reports the largest supplier’s share of purchases and the combined share of the top ten suppliers.

Separate supplier share from criticality

Share tells you where dependence sits; criticality tells you what happens if the input is unavailable. A high share in office supplies is not equivalent to a high share in a validated pharmaceutical excipient, an aircraft component, or a network control system. The same percentage can therefore sit in different risk bands for different categories.

Use a criticality description that a buyer can test: customer safety, regulatory approval, production-line stoppage, service-level breach, revenue delay, data exposure, or reputational harm. The OECD’s supply chain resilience review treats resilience as the ability to manage interdependencies and disruptions, rather than as a simple instruction to eliminate concentration. A procurement assessment should make that consequence explicit.

Scroll horizontally to compare all columns.

Sub-tier exposure and substitution time

A direct-supplier list can hide a common sub-tier. Two contract manufacturers may buy the same chip, chemical, foundry service, cloud region, or logistics lane. Counting them as two independent suppliers would overstate diversification. Conversely, a distributor may offer access to several manufacturers, so its purchase share does not necessarily equal manufacturing concentration.

Map the product or service from the buying entity through the direct supplier, contract manufacturer, component producer, raw-material source, and key logistics nodes. Mark which links are confirmed, inferred, or unknown. NIST SP 800-161 places supply-chain risk management inside enterprise risk management because visibility, integrity, resilience, and quality can depend on multiple tiers. A missing tier is a due-diligence gap, not evidence of low risk.

Pair supplier share with substitution time

The practical question is not only “how concentrated is the category?” It is “how long would a qualified replacement take?” Estimate the time needed to find, audit, contract, sample, validate, certify, integrate, and ramp an alternative. Include customer or regulator approval when the product or service requires it.

A high-share supplier with a two-week replacement path may be less exposed than a 15% supplier whose replacement takes eighteen months. Use ranges when the evidence is uncertain, and keep search time separate from production ramp time. If a procurement team cannot estimate either, record “switching time unknown” and treat the unknown as a control gap.

Test switching costs and qualification barriers

Switching cost includes more than a new quoted price. It can include tooling, software integration, data migration, engineering change notices, validation lots, training, minimum order quantities, dual-running inventory, contractual termination fees, and lost learning from an incumbent. A lower-cost alternative may still be uneconomic if the transition interrupts service.

Ask who owns the specification, tooling, design files, test fixtures, data, and certifications. Check whether the buyer can transfer those assets to another supplier. The OECD resilient public procurement toolkit presents multi-sourcing as one resilience strategy, alongside supplier evaluation, relationship management, and monitoring. It does not make a second supplier automatically feasible; feasibility depends on the category and the qualification path.

Common-mode capacity and contract protection

Three forms of concentration often travel together but should be measured separately. Capacity concentration asks whether a few sites can produce the required volume. Geographic concentration asks whether suppliers or sub-tiers share a country, region, port, grid, water source, or transport corridor. Ownership concentration asks whether nominally different suppliers share a parent, financing source, or controlling interest.

The OECD pass-through frequency indicator is useful because it examines how frequently production networks pass through particular countries and industries. It is a macro-level exposure measure, not a company-specific risk score. For a procurement decision, combine it with site-level capacity, logistics alternatives, and the buyer’s own bill of materials.

Read contracts, commitments, and inventory buffers together

A supplier’s share does not show how much protection the contract provides. Review committed capacity, allocation rights, lead-time obligations, service credits, termination provisions, change-control clauses, price-adjustment rules, audit rights, business-continuity requirements, and notice periods. Then test whether those provisions are enforceable in the jurisdictions and operating conditions that matter.

Inventory can bridge a disruption, but only if the stock is usable, located where it is needed, within shelf life, and sufficient for the likely duration. A buffer may reduce short-term service risk while increasing working capital and obsolescence exposure. Record the coverage period and the assumption behind it instead of treating “safety stock” as a complete mitigation.

Add demand, lead time, and service-level context

The same supplier share can create different exposure in a stable category and a category with volatile demand. Compare contracted demand, forecast error, lead-time variability, minimum order quantities, and the consequence of late delivery. Procurement should test whether a second source can actually deliver during the peak or disruption scenario, rather than only during normal utilization.

The OECD guidance on public procurement risk also cautions that domestic sourcing is not a universal solution: domestic suppliers can be disrupted, and full onshoring may not be practical. The relevant comparison is the resilience of the available options, including logistics and recovery, not the label attached to the supplier’s location.

Financial disclosures and operational diligence

Public filings can reveal how companies describe supplier exposure, but a disclosure is not a standardized risk rating. Carrier Global’s 2024 annual report reports a large share of purchases from one supplier and warns that interruption could affect inventory and results. That is evidence of exposure for that company and period; it does not establish a threshold that applies to every buyer.

The comparison can run in the other direction. W.W. Grainger’s 2024 filing describes more than 5,000 primary suppliers and no single supplier above 5% of purchases, while still discussing disruption, tariffs, transportation, and other risks. A broad direct-supplier base can reduce one form of concentration without removing sub-tier, geographic, commodity, or logistics exposure.

Use due diligence across cybersecurity and resilience

Procurement risk now includes the supplier’s technology, data, software, operational technology, and incident response. NIST SP 1326 describes due-diligence dimensions including foreign ownership, provenance, resilience, foundational cyber practices, and supply-chain tiers. These dimensions help a buyer ask whether a concentrated supplier is visible and governable, not simply whether it is large.

For smaller teams, the CISA vendor supply-chain risk management template provides a practical assessment starting point for ICT vendors. Adapt the questions to the category and risk appetite. Avoid turning a checklist response into a false assurance; verify material answers with contracts, audit evidence, site information, and incident records where the decision requires it.

Choose a funded resilience response

Adding a second supplier is one response, not the only response. Other options include redesigning the specification, qualifying interchangeable materials, reserving capacity, holding targeted inventory, relocating a critical process, buying an alternate service path, sharing contingency tooling, or improving sub-tier visibility. Each option has a cost, lead time, and residual exposure.

The OECD resilience toolkit links supplier diversity with segmentation, supplier relationship management, evaluation, and monitoring. That combination matters because an additional supplier that is unqualified, financially weak, or exposed to the same bottleneck may add administrative complexity without adding resilience.

Build a procurement risk register that drives action

Turn the analysis into a record that names the dependency, consequence, owner, trigger, action, and due date. Include the evidence date and confidence of each field. Useful fields include supplier and sub-tier, spend and capacity shares, criticality, switching time, geographic exposure, contract coverage, inventory coverage, incident history, mitigation cost, and residual risk.

The GAO review of VA acquisitions shows why vendor-management practice matters: a buyer can have supply-chain tracing and still lack a view of geographic concentration or industry depth. A risk register should therefore state which visibility is present and which is missing. “No data” is a decision to improve evidence, not a finding that the risk is low.

Scenarios, thresholds and the procurement decision

Model at least three events: a short disruption, a prolonged capacity loss, and a quality, cyber, or regulatory stop. For each scenario, estimate time to impact, time to recover, service or production consequence, cash requirement, customer consequence, and the control that changes the outcome. Keep assumptions separate from observed data.

Avoid universal thresholds such as “above 30% is high risk.” A threshold can be useful inside a category policy if it is tied to criticality and validated switching time, but it is not a portable market fact. GAO’s work on dependence in the defense industrial base emphasizes the need for better country-of-origin and supply-chain visibility; the lesson for commercial procurement is to connect a ratio to the dependency that the ratio represents.

Connect concentration to the buying decision

The output should change a decision: award, renew, dual-source, redesign, stock, audit, negotiate, or gather evidence. For a renewal, ask whether the incumbent’s service and controls justify the switching cost. For a new award, ask whether the concentration is intentional, time-limited, and protected by a credible exit path. For a cost reduction, test whether savings increase hidden sub-tier or geographic exposure.

Procurement, operations, finance, security, legal, and the business owner may each hold part of the evidence. Assign one accountable owner for the decision and name the evidence required before approval. A concentration metric is useful when it changes the sequence of work; it is weak when it becomes a dashboard ornament.

Compare the disruption window with the recovery window

Consider a hypothetical regulated component with twenty days of usable inventory and no qualified alternative. Suppose engineering estimates sixty days to qualify another source and bring accepted stock to the line. On those assumptions, the plan has a forty-day gap before allowing for actual outage duration or further delays. The key risk is that recovery cannot meet the operational window.

The decision could be to fund qualification, adjust a justified buffer or redesign the component, depending on cost and feasibility. Reducing one supplier's share without creating an approved replacement does not close that gap. Equally, adding a second direct supplier does little if both rely on the same failing sub-tier.

The periods are invented teaching inputs. A real assessment needs evidence from engineering, production, quality and the supplier, then a tested recovery plan. The measure should name the line or service affected, expected consequence and funded owner action rather than label a percentage as safe or unsafe.

Use concentration to locate dependencies, then prioritise them by consequence and recoverability. The actionable output is a funded response with an owner, tested alternative and relevant timeline. Reassess it when the product, supplier network or operating buffer changes.