A hidden efficiency trade-off
For years, many companies reduced supplier numbers to gain purchasing leverage, simplify quality control and deepen strategic relationships. In stable conditions, that approach can improve efficiency. But it can also create a less visible form of concentration risk: the possibility that one supplier, region, route or upstream dependency becomes disproportionately important to revenue continuity.
The OECD Supply Chain Resilience Review
The issue is not that concentration is always undesirable. Some inputs are naturally produced by a small number of specialist firms or regions. Long-term supplier relationships can also improve quality, innovation and coordination. The management challenge is to know where concentration exists, whether substitutes are genuinely available and how quickly the business could respond if a critical source failed.
That moves supplier concentration beyond procurement. It becomes a question about revenue protection, working capital, insurance, customer commitments and capital allocation. For boards, the relevant question is no longer simply how much is spent with a supplier, but how much enterprise value depends on that supplier continuing to perform.
Concentration can sit below the first tier
Direct supplier lists often provide an incomplete picture. A company may appear diversified because it buys the same component from several vendors, while all of those vendors depend on one upstream producer, logistics hub, cloud platform or specialist material. The business can therefore have multiple contracts but only one real point of failure.
McKinsey's work on supplier and nth-party risk notes that concentration can exist in the underlying infrastructure and networks supporting large organisations. Business-critical supplier risk management
This is why multi-tier visibility is becoming more important. Companies need to understand not only who their suppliers are but where production occurs, what substitute capacity exists, how financially resilient key suppliers are and which dependencies are shared across apparently separate vendors.
The same principle applies to digital supply chains. A software provider may rely on another cloud or identity provider. A payments platform may depend on a small group of infrastructure vendors. A cybersecurity event at a common service provider can therefore affect many businesses at once even if their direct supplier relationships look diversified.
The metrics are changing
A 2026 World Economic Forum article argues that supply chains are increasingly being assessed not only for operational resilience but also for financial resilience, with attention to concentration, critical dependencies and the financial impact of disruption. From resilient to investible supply chains
This points toward a different set of management metrics. Spend concentration still matters, but it is not enough. Companies may also need to track the share of revenue dependent on a supplier, time to qualify an alternative, geographic overlap between vendors, inventory cover for critical inputs, supplier financial health, contractual recovery rights and the proportion of key dependencies mapped beyond tier one.
Scenario analysis can make those metrics more useful. Instead of asking whether a supplier is high risk in the abstract, a company can model what happens if the supplier is unavailable for two weeks, two months or longer. The result can reveal whether the real exposure is lost sales, production stoppage, expedited freight, customer penalties, additional working capital or reputational damage.
This is where board attention becomes valuable. Some resilience investments look inefficient when assessed only against annual procurement savings. A second source may have a higher unit cost; additional inventory may reduce working-capital efficiency; dual tooling may require capital expenditure. But those costs can be rational when compared with the value of maintaining continuity during a severe disruption.
Diversification is not the same as reshoring
The OECD has cautioned that broad relocalisation can impose significant economic costs without consistently improving resilience. Its modelling indicates that relocalising supply chains could reduce global trade and real GDP
For companies, the implication is that resilience does not require abandoning global supply chains. It requires identifying where concentration is excessive relative to the business impact of failure and creating options where the exposure matters most.
Those options may include dual sourcing, maintaining qualified backup suppliers, using suppliers in different regions, designing products around interchangeable inputs, holding strategic inventory, securing additional logistics routes or strengthening the financial health of critical suppliers through longer-term commitments.
McKinsey's 2025 supply-chain risk survey found that companies were continuing to adjust networks in response to trade and tariff uncertainty. Supply Chain Risk Pulse 2025
The right response will differ by category. Commodity inputs may be easier to diversify than highly engineered components. In some cases, concentration is unavoidable and the more realistic strategy is deeper collaboration, better contingency planning and faster recovery rather than supplier substitution.
From procurement exposure to enterprise exposure
Supplier concentration becomes a board-level issue when the business connects procurement data to financial impact. That means classifying suppliers by criticality, not only by spend, and identifying the dependencies that could interrupt important products, customers or operations.
A mature approach also avoids treating resilience as a one-time mapping exercise. Supplier networks change through acquisitions, product redesigns, outsourcing decisions and changes made by suppliers themselves. Monitoring therefore has to be continuous enough to catch material shifts in exposure.
The broader business lesson is that efficiency and resilience are not opposites. The objective is to understand where efficiency creates fragility and where redundancy creates real strategic value. Companies that can identify their most concentrated dependencies before a disruption occurs have more choices about how to respond - and more time to make those choices at an acceptable cost.
Key questions
What is supplier concentration risk?
Supplier concentration risk arises when a company depends heavily on one supplier, region, route or underlying upstream dependency for an important input, service or capability.
Why should boards care about it?
Because supplier failure can affect revenue, customer commitments, working capital, insurance, capital spending and business continuity. The exposure can therefore be larger than the procurement spend involved.
Does resilience mean bringing production home?
Not necessarily. Evidence from the OECD suggests that broad relocalisation can be costly and does not guarantee greater resilience. Targeted diversification and contingency options can often be more effective.
References
• OECD - Supply Chain Resilience Review
• OECD - Promoting Resilience and Preparedness in Supply Chains
• OECD - Coordinated Efforts Needed to Strengthen and Diversify Supply Chains
• McKinsey - Taking a Business-Critical Approach to Supplier Nth-Party IT Risk