How procurement, operations and finance teams can build a clearer picture of dependencies across complex supplier networks.
Beyond the direct supplier
Supplier resilience is often discussed in terms of alternative vendors, spare capacity and inventory buffers. Those tools can help, but they do not answer a more basic question: does a company know which relationships, systems and components its operations depend on? A business may have several approved suppliers and still be exposed to the same subcontractor, data provider or logistics bottleneck. [1]
The OECD’s Due Diligence Guidance for Responsible Business Conduct offers a structured way to identify, assess and address adverse impacts connected to operations, supply chains and business relationships. Its focus is broader than delivery continuity, covering areas including workers, the environment, consumers and governance. That breadth illustrates why procurement risk cannot be assessed solely by purchase price and delivery performance. [1]
Map dependencies before ranking risks
A useful supplier map begins with products and services that matter most to business continuity. It then connects each critical activity to direct providers, important subcontractors, supporting technology and the location of key facilities. This does not require perfect visibility into every tier before action can begin; it requires a defensible view of where limited information creates material uncertainty. [1] [2]
Technology vendors deserve the same attention as physical suppliers. NIST’s cybersecurity supply chain guidance identifies risks linked to malicious functionality, counterfeit products, vulnerabilities and incomplete knowledge of how acquired technologies are developed or integrated. A cloud service or software dependency can affect delivery even when warehouses and transport networks remain operational. [2]
Make assessments proportionate
Not every supplier requires the same depth of review. A supplier providing a replaceable office service may warrant a different process from one handling confidential customer data or producing a specialised component with long replacement lead times. Procurement teams can therefore prioritise suppliers based on operational criticality, substitutability, concentration and access to sensitive systems. [2]
Assessments should also distinguish evidence from assurances. A questionnaire may describe a vendor’s policy, while contract provisions, independent testing, incident records or demonstrated recovery procedures may help establish how that policy operates. The purpose is not to create paperwork for its own sake, but to support decisions about which vulnerabilities require additional oversight. [1] [2]
Connect procurement to finance and operations
Supplier interruptions can produce consequences across several functions: delayed production, higher emergency purchasing costs, customer-service failures or working-capital pressure. Procurement therefore needs a shared language with finance, technology and operational leadership. The finance team can help assess how delayed receipts or substitute sourcing would affect liquidity, while operations can identify practical alternatives and time required to restore service. [1]
Resilience measures might include approved secondary sources, documented escalation contacts, secure data interchange, contractual continuity obligations and periodic tests of recovery procedures. Each has costs, so managers should examine whether a control addresses a material dependency rather than assuming that more suppliers or more inventory always means lower risk. [2] [3]
Keep the map current
Supplier due diligence becomes less useful when it is treated as an annual administrative task. A merger, product redesign, new software integration or change in subcontracting can alter the dependency picture. Companies can build review triggers around such events and use incident learning to improve their assessment criteria. [1]
The commercial value of visibility is not a promise of uninterrupted supply. It is the ability to identify which disruptions would matter most, establish credible alternatives where possible and explain the remaining exposure to decision-makers. Resilience is strongest when supplier information supports routine management, not only crisis response. [2] [3]
References
1. OECD, Due Diligence Guidance for Responsible Business Conduct (2018)
2. NIST, Cybersecurity Supply Chain Risk Management Practices, updated November 2024
3. NIST, Cybersecurity Supply Chain Risk Management programme