Supply chain risk: find your real dependencies and build resilience where it counts

A new import duty is announced on a Friday. A country restricts exports of a mineral you have never heard of, but your supplier's supplier has. A shipping route closes and lead times double. For most firms the damage of such events runs through a handful of links: one component, one country, one customer. Supply chain risk is the chance that one of those links fails or becomes much more expensive, so that you cannot deliver or lose your margin.

The good news is that most dependencies are harmless. Buying from one country is not a problem if you could switch within weeks. The task is to find the few links that are both concentrated and hard to replace, and to make those resilient in a targeted way.

Concentration is not the same as dependence

Two questions separate a real risk from a harmless one. Is the supply concentrated, in one supplier, one country or one route? And how quickly and at what cost could you replace it? Peter Kraljic built a purchasing method on this split in Harvard Business Review (September 1983): sort what you buy by its impact on profit and by supply risk, and manage each group differently. Low-risk items need efficient buying. Items with high supply risk, whether strategic or small but irreplaceable, need active management.

The bottleneck items are the dangerous ones. A small part with a single source can stop a whole production line, while the large items on the purchasing list often have several suppliers.

How geopolitics ends up in your figures

Critical raw materials: a yardstick for concentration

Governments are mapping the same risk at national level. The EU's Critical Raw Materials Act sets a benchmark that by 2030 no more than 65% of the EU's annual consumption of a strategic raw material should come from a single third country (source: European Commission, October 2026). The Act also places risk-preparedness obligations on large companies producing strategic technologies. You can use the same yardstick for your own key inputs: if well over half of a critical input comes from one country, treat it as concentrated, even when you buy it from a supplier next door.

Map supply chain risk in five steps

1. 01

   Start from the margin

   List the products, customers and markets that earn most of your gross margin. Only the chains behind them deserve a deep look.

2. 02

   Follow the chain past the first link

   Ask suppliers where components and raw materials come from and which route they take. Include customer concentration and digital suppliers.

3. 03

   Separate concentration from replaceability

   For each concentrated link, compare how long you can keep delivering on current stock with how long it would take to qualify an alternative.

4. 04

   Stress-test the impact

   Calculate what a new duty, an export ban or a price shock does to revenue and margin, without first debating how likely it is.

5. 05

   Choose a measure and an owner per link

   Accept, buffer, add a second source, renegotiate or redesign. Name who is responsible and review the list each quarter.

Step two is where most firms stop. Of the supply chain leaders McKinsey surveyed, 95% had visibility into the risks of their direct suppliers, but for only 42% of them did it reach tier two or beyond (source: McKinsey, December 2025). Step four follows the advice of David Simchi-Levi, William Schmidt and Yehua Wei in Harvard Business Review (January-February 2014): model the effect of a disruption on your operations and finances rather than trying to predict its cause, because the same measures help whatever triggers the failure. Scenario planning gives the method for combining shocks.

Worked example: a lighting manufacturer with one big export market

Orrin Lighting has 70 staff and makes LED luminaires for offices and schools. A third of its revenue comes from one distributor in North America. The map of its five most important links:

The buffer looks expensive until you set it against the risk. Four months of LED modules at €90,000 a month is €360,000 of stock; at a carrying cost of 20% a year that is €72,000 a year. A three-month stoppage would cost €400,000 a month in gross margin, or €1,200,000. The buffer costs 6% of the loss it protects against, and it is needed only until the second maker is approved.

Fictitious Firmfocus example. €360,000 x 20% = €72,000; 3 x €400,000 = €1,200,000; €72,000 / €1,200,000 = 6%. The logic works in any currency.

Measures: from buffer stock to price clauses

• Buffer stock: only for concentrated, hard-to-replace links, sized to the time it takes to switch.
• Second source: a supplier that is actually qualified, with trial runs and certificates, not a name on a list.
• Design for choice: products that accept components from more than one maker.
• Contract clauses: price indexation to commodity or energy prices, and clear agreement on who bears new import duties. The delivery term (Incoterm) in the contract decides who pays the duty.
• Customer spread: a second channel or market when one customer or country carries too much of your revenue.

Efficiency or resilience: a choice per link

Resilience costs money: stock, a dearer second supplier, redesign. Treat it as an insurance premium and pay it only where a link is concentrated, hard to replace and important for the margin. Bringing everything home is rarely the answer. The OECD concluded that a move to keep all production within national borders would undermine, rather than strengthen, supply chain resilience, and argued for stronger and more diversified chains (source: OECD, June 2025). Make resilience costs a separate line in the budget, so they are not the first thing cut when margins come under pressure.

Small business or larger organisation

Pitfalls

• Treating every concentration as a risk: buffers everywhere tie up cash without making you safer.
• Assuming nearby means safe: a local supplier can depend on the same single-country raw material.
• Mapping once: a supplier map from two years ago misses new routes, owners and rules.
• Forgetting the customer side: one dominant customer or export market is a chain risk too.
• Hiding the cost: resilience that is not budgeted is cut at the first cost review.

Supply chain risk is one of the strategic themes next to energy, labour and succession; energy prices in particular often move with the same events, as described in energy costs and grid capacity. The full strategy method is under Strategy.