Supplier Concentration Risk: What Happens If Your Key Vendor Disappears?

Most owners can name their customer concentration risk instantly; the big client lives rent-free in their head. Ask the mirror question and you usually get a pause: which supplier, if they vanished on Friday, would stop you trading? Supplier dependency is the twin risk, invisible in the accounts right up until it becomes existential, and the fix is a short mapping exercise followed by a few proportionate moves.

Map the four kinds of dependency

Start by listing every supplier whose failure would hurt within a month, remembering that dependency wears four costumes:

• Inputs. The materials, products or components you resell or build with, especially anything single-sourced, custom-made or on long lead times from overseas.
• Capability. The subcontractor who does the specialised work, the licensed trade every job is scheduled around, the manufacturer who is effectively part of your production line without being on your payroll.
• Infrastructure. The software running your operations, your IT provider, your logistics carrier, your payment processor. This is the most under-noticed category, because nothing is being "bought" in the traditional sense until the day it's unavailable and nothing works.
• People-shaped suppliers. The one bookkeeper, the one designer, the one developer who holds the passwords and the undocumented knowledge. These are suppliers who are really key-person risks in an invoice's clothing, close cousins of the capability gaps that build up inside the business itself.

Score each one on two axes

For everything on the list, ask two quick questions. First, how hard would this supplier be to replace: could you switch in days, weeks or months? Second, how badly does it hurt while unreplaced: is it inconvenient, margin-eating, or trading-stopping? You're not building a spreadsheet for its own sake; you're finding the handful of names that score badly on both axes. That short list, not the full vendor register, is where your attention and money should go.

Be honest about switching time. "There are other wholesalers" is not the same as having an account, agreed pricing and a relationship with another wholesaler. Replacement time is measured from a standing start, including the weeks of onboarding, credit checks and learning each other's quirks.

Learn to read the smoke

Supplier failure rarely arrives unannounced. The signals worth treating seriously: delivery times stretching, quality wobbling, key contacts leaving, requests for upfront payment or sudden changes to terms, visible understaffing, and an acquisition, because new owners re-price and rationalise customer lists, and small accounts are the first casualties. For software suppliers, watch for slowing development, thinning support and sunset notices dressed up as "exciting news".

The cheapest early-warning system available is a standing question to whoever deals with each critical supplier: has anything felt different lately? People notice deterioration long before it reaches a formal notice. They just need somewhere to report it.

De-risk in proportion

You are not dual-sourcing everything; you're buying insurance only where the map says it's worth the premium. The main instruments, roughly in order of cost:

• A documented fallback. For each critical supplier, a short note answering: who else could do this, what would we need to hand them, and who makes the call? Half a page, written calmly now rather than improvised in a crisis.
• A warm second source. An open account and an occasional small order with an alternative. It costs a little margin in the good times and buys you a running start in the bad ones.
• Contractual protection. For genuinely critical relationships: notice periods, transition assistance, and, for software and services, clarity about who owns your data and how you get it out.
• Bringing knowledge inside. For people-shaped suppliers, the fix is less about contracts and more about documentation and access: shared credentials in a proper password manager, processes written down, no single person as the only path to anything important.

Make it a habit, not a project

Concentration drifts. The convenient supplier gets more of the work each year precisely because they're good, and the dependency deepens without anyone deciding it. Revisit the map annually, ideally alongside your insurance renewal, since both are exercises in the same question: what would actually happen, and who carries the cost? An hour a year keeps the answer from being "we find out live". The broader discipline of running operations so no single point of failure can stop the whole machine is what our operations hub is about, and suppliers are simply the external chapter of it.