A supplier continuity risk assessment goes beyond vendor performance scores. It asks what the supplier supports, how long the business can operate without it, what alternatives exist, how long switching takes, and which qualification, logistics, quality, technology, or customer-approval steps could delay recovery.
Define the business dependency
Identify the product, service, system, material, route, or operational function that depends on the supplier.
Calculate time to impact
Review usable inventory, demand, service tolerance, alternate process capacity, and other buffers to understand how much time exists before disruption becomes material.
Test alternate readiness
Confirm whether the alternative is qualified, available, contracted, integrated, and capable of meeting required specifications and volume.
Review hidden dependencies
Sub-tier suppliers, tooling, transportation, proprietary data, customer approvals, or one specialist can make a nominally replaceable vendor much harder to switch.
Translate the assessment into action
Treatment may include qualification, inventory changes, dual sourcing, contract requirements, monitoring, exercises, data portability, or explicit risk acceptance.
Use evidence proportionate to consequence
A supplier supporting a noncritical commodity should not receive the same review depth as a vendor whose failure can stop a facility, disable a critical system, or violate a major customer commitment. Review effort should follow consequence and uncertainty.
Monitor material change
Ownership changes, capacity constraints, repeated expedites, new subcontractors, cyber incidents, quality deterioration, route changes, or longer lead times can change supplier resilience between annual reviews. Those events should trigger reassessment where they materially affect the dependency.
Assess usable capacity, not the existence of an alternate
A second supplier does not automatically create resilience. The assessment should examine qualification, specification, tooling, contractual readiness, geographic reach, transportation, available volume, ramp time, and whether the alternate is exposed to the same upstream constraint as the primary supplier.
Measure the full switching clock
Replacement time includes more than supplier lead time. It can include internal approval, sample testing, customer approval, system setup, data exchange, packaging changes, logistics, quality release, onboarding, and the time required to consume or segregate existing inventory.
Review supplier change as a trigger
Material changes in ownership, production location, subcontractors, technology, lead time, quality, financial stability, service scope, or incident history should trigger reassessment rather than waiting for the next annual review.
End with a treatment decision
For each critical supplier, leadership should know whether to accept the exposure, strengthen the contingency, qualify another source, increase buffer, change the design or specification, or begin an exit plan. The assessment should make that decision and its owner explicit.
Frequently asked questions
Does every supplier need this level of review?
No. Depth should be proportionate to business consequence. The assessment is most valuable for suppliers whose failure would materially affect important operations.
Can the assessment be used before selecting a new supplier?
Yes. The same criticality and switching questions can strengthen qualification and contracting decisions.
Can the assessment compare several critical suppliers?
Yes. A portfolio view can compare consequence, time to impact, switching difficulty, concentration, and contingency evidence so deeper work is directed to the dependencies that matter most.