A second supplier provides little protection if it relies on the same factory, transport route or software platform as the first. Companies can appear diversified in their purchasing records while remaining exposed to a single point of failure. The practical measure of resilience is whether an alternative can deliver acceptable goods or services within the time the business can tolerate.
That distinction changes the procurement conversation. The issue is no longer simply how many vendors are approved. It is whether replacement capacity exists, whether specifications are compatible and whether the company has rehearsed the steps needed to use it. Resilience has to connect commercial agreements with operational capability.
The OECD Supply Chain Resilience Review, published in 2025, emphasises managing risk through adaptable supply chains rather than withdrawing from international trade. For individual companies, that broad finding points towards a more selective approach: understand the dependencies that matter, then decide which alternatives and buffers are worth paying for.
Concentration can hide beneath different names
Purchasing teams often monitor the share of spending allocated to each supplier. That is useful for negotiation and oversight, but it does not fully describe operational exposure. A low-cost component can halt an expensive production process, while a large annual contract may cover a service that is relatively easy to replace.
The distinction is between spending concentration and dependency concentration. A hypothetical manufacturer buying two specialist parts from different distributors could still depend on one upstream producer. Changing distributors would improve the appearance of the supplier list without resolving the underlying constraint.
The same pattern can occur in service businesses. Two outsourced providers may rely on the same hosting environment or identity system. An interruption at that shared dependency could affect both providers simultaneously, reducing the value of a conventional backup arrangement.
Mapping every supplier indefinitely is rarely practical. A more useful starting point is to identify inputs and services whose loss would stop important customer activities. Management can then investigate the relevant upstream dependencies in greater depth, documenting where information is unavailable rather than assuming that no concentration exists.
Geography does not settle the resilience question
Distance can affect transport time and inventory requirements, but a nearby supplier is not automatically a dependable one. Local production may still depend on imported materials, specialised machinery or a small number of utilities. Conversely, a distant supplier might offer stronger continuity arrangements and more transparent capacity information.
The World Bank's 2023 Logistics Performance Index report examined structural factors including infrastructure, logistics services and border controls. It is a historical country-level reference, not a live forecast of an individual shipment. Its relevance is that dependable delivery depends on the surrounding logistics system as well as the supplier's own performance.
Route exposure therefore belongs in supplier assessment. Goods from two different locations may converge at the same port or distribution centre. Separately negotiated freight contracts may offer limited protection if the underlying route is shared.
UNCTAD's Review of Maritime Transport 2024 examines vulnerabilities at maritime chokepoints. The business implication is to assess how a longer route or constrained transport capacity would affect delivery schedules and costs. That is a planning exercise, not a prediction that a particular route will be interrupted.
An approved alternative may still be unusable
Supplier approval and supplier readiness are different stages. A vendor may meet financial and quality requirements yet need additional tooling, product testing or systems integration before taking over meaningful volumes. The apparent substitute could therefore be unavailable during the period when it is most needed.
Consider a hypothetical retailer with an alternative packaging supplier. The vendor can produce the required item, but artwork approval, material testing and production scheduling take several weeks. If existing stocks cover only a few days, the alternative cannot prevent an immediate interruption even though the supplier is formally approved.
This example shows why qualification lead times deserve the same attention as delivery lead times. A continuity plan should explain what work remains before a substitute can be used and who controls that work. It should also identify any customer consent or certification needed for a change.
Maintaining some ordinary purchasing volume with an alternative can help keep the relationship active and reveal operational problems. However, splitting orders also brings costs and may reduce scale efficiencies. The appropriate allocation depends on product economics and the consequences of failure, rather than a universal preference for multiple suppliers.
Capacity has to exist under stress
A supplier's normal spare capacity may disappear during a widespread disruption. If several customers activate backup arrangements at once, each may discover that its assumed replacement volume exceeds what the supplier can provide. A reassuring sales conversation is weaker evidence than a clear capacity arrangement supported by operational information.
Companies should understand the difference between an estimate, a contractual commitment and capacity that has been reserved and tested. None provides absolute certainty. Each nevertheless offers a different basis for assessing whether continuity assumptions are credible.
The conditions of activation matter too. A supplier may require a minimum order, advance payment or longer commitment before increasing production. These terms can create a funding need precisely when the customer is already dealing with lost sales and higher transport costs.
Procurement and treasury therefore need a shared view of the transition. A technically available supplier may be financially difficult to activate, while a funded alternative may still lack the necessary production slot. Resilience depends on those arrangements working together.
Digital dependencies belong in the same assessment
Supplier risk extends beyond physical deliveries. Ordering, scheduling and invoicing can depend on external software. If those services fail, goods may be available while the company struggles to authorise purchases or communicate instructions.
NIST's cybersecurity supply chain risk management guidance addresses identifying, assessing and mitigating risks across technology supply chains. It provides a cybersecurity framework rather than a complete method for managing physical procurement. Its relevance here is the need to understand the technology dependencies that support supplier relationships.
Companies can examine whether emergency ordering is possible when the normal platform is unavailable. A manual process should specify who can authorise an order, how the supplier verifies the request and how records are reconciled afterwards. Otherwise, a workaround can create payment errors or opportunities for fraud.
Sensitive supplier information also requires care. Detailed dependency maps can reveal commercial relationships and operational weaknesses. Access should match the needs of the people using the information, with a clear process for maintaining accuracy as contracts and systems change.
The financial case requires explicit trade offs
Resilience spending competes with other business priorities. Additional inventory ties up cash and can become obsolete. Reserved capacity costs money even when it is unused. More suppliers increase administration, quality oversight and integration work. These costs should be acknowledged rather than hidden behind a general claim that continuity is always valuable.
The comparison is with the consequences of an interruption. Management can examine lost contribution, contractual obligations, emergency freight and the time required to restore normal operations. Estimates will be uncertain, but recording assumptions makes the decision more useful than treating all disruption scenarios as equally severe.
For a low-margin product with easily substituted inputs, extensive redundancy may be difficult to justify. For a service with serious customer consequences and a long recovery period, stronger arrangements may be warranted. The important point is to link expenditure to a specific dependency and a defined operational objective.
Finance teams can also distinguish between cash committed and accounting cost. Building inventory may consume liquidity before it affects reported profit. A continuity decision that appears affordable in the income statement can therefore place pressure on working capital.
Exercises reveal whether the plan is executable
ISO 22301 sets requirements for business continuity management systems. Its existence does not establish that a particular supplier can meet a customer's needs during a disruption. A company still needs evidence that its own response arrangements are practical and appropriate to its activities.
A useful exercise can begin with a defined failure, such as losing access to one critical supplier for a specified period. Participants then work through the decisions, contacts, approvals and information needed to maintain service. The aim is to expose unresolved dependencies before a real interruption forces immediate action.
Exercises should test the less convenient details. Is the emergency contact available outside normal hours? Can the alternate delivery location receive the goods? Does the business have the latest specifications? Who can approve a higher price when the usual manager is absent?
An exercise report should identify gaps, assign owners and record when corrective work is completed. Repeating the same rehearsal without resolving findings can create an appearance of preparation while leaving the actual weakness unchanged.
Supplier relationships influence recovery
Commercial behaviour before an interruption can affect the options available afterwards. A company that changes forecasts abruptly or pays late may make planning more difficult for a smaller supplier. Aggressive payment terms can also shift a buyer's financing burden into a weaker part of its own supply chain.
This does not mean buyers should subsidise every supplier or accept poor performance. It means that price, payment and continuity should be assessed together. An apparently favourable contract can become expensive if it undermines the capacity on which the buyer relies.
Information sharing can help when it is proportionate and reliable. Better demand visibility may allow suppliers to plan staffing or materials more effectively. Buyers should still recognise the limits of forecasts and avoid presenting uncertain sales assumptions as firm commitments.
Trust also needs controls. Critical statements about capacity, recovery and subcontracting should have supporting evidence where feasible. A collaborative relationship is most useful when both sides understand which obligations are definite and which depend on circumstances.
Recovery should include the return to normal operations
Activating an alternative supplier is only one stage of recovery. Companies may then face duplicate orders, excess inventory or conflicting delivery commitments as the original provider resumes service. A continuity plan that ends at the first replacement shipment leaves these financial and operational consequences unresolved.
The transition back needs clear rules for cancelling emergency orders, reconciling stock and checking product quality. Temporary substitutions may also require updates to customer records or service documentation. Managers should know who authorises those changes and when normal purchasing controls resume.
Performance data can support the next decision. Recording actual qualification time, delivery reliability and activation costs helps the company compare its earlier assumptions with what happened. The purpose is to improve future choices, not to claim that one successful response proves resilience against every disruption.
This is also where customer communication matters. If a substitute changes delivery timing or product characteristics, sales teams need accurate information before making commitments. Procurement cannot deliver continuity on its own when customers receive promises that operations cannot meet. A shared recovery view helps connect the supplier response to the service the business has actually agreed to provide.
Common questions about supplier resilience
Does having more suppliers always reduce risk
It can reduce exposure to a single provider, but only if the alternatives have usable capacity and sufficiently different dependencies. Additional suppliers can also increase cost and complexity. Their value depends on the disruption scenarios the company is trying to manage.
Is extra inventory the simplest solution
Inventory can bridge a defined interruption, but it cannot solve every problem. It may be unsuitable for perishable goods, fast-changing products or service dependencies. The relevant calculation is how much usable coverage it provides relative to replenishment and recovery time.
The strongest supplier strategy is one that can explain how the business would continue when an important dependency fails. That requires credible alternatives, realistic funding and rehearsed decisions. A longer vendor list may help, but the decisive evidence is whether the proposed alternative can deliver when the company needs it.
Reference links
OECD — OECD Supply Chain Resilience Review Navigating Risks — 2 June 2025
https://www.oecd.org/en/publications/oecd-supply-chain-resilience-review_94e3a8ea-en.html
World Bank — World Bank Releases Logistics Performance Index 2023 — 21 April 2023
UN Trade and Development — Review of Maritime Transport 2024 — 22 October 2024
https://unctad.org/publication/review-maritime-transport-2024
NIST — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations SP 800 161 Revision 1 Update 1
https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final
ISO — ISO 22301 2019 Business continuity management systems