Supply concentration risk: find shared production dependencies
Map the shared sub-tiers and regions behind multiple suppliers, measure exposed demand, and turn concentration findings into sourcing actions.
A purchasing report can show several suppliers while every build depends on one forge, resin plant, or transport route. Find those shared dependencies before calling the supply base diversified. Measure concentration at the production node that can interrupt the part, then test how much demand another independent path could actually cover.
What is supply concentration risk?
Supply concentration risk is exposure to a small number of suppliers, production sites, processes, regions, or other shared dependencies. Several vendors can carry the same risk when they rely on one critical node. Measure the exposure for the part and failure scenario you care about, rather than assuming a larger vendor list creates resilience.
A concentration measure describes dependence. It does not predict the probability of a fire, export restriction, insolvency, or quality escape. To choose a response, combine the share exposed with the effect on production and the time needed to recover approved supply.
Start with parts that stop the build or require long qualification. This is more useful than calculating a whole-company spend score first: a cheap seal or casting can stop a valuable assembly even when its supplier represents little annual spend.
Where can multiple suppliers share one failure point?
Look below the companies you pay. Check the producer of the casting or forging, material grade, special process, semiconductor die or fab, dedicated tool, and source-specific software or process knowledge. Ask which site performs the step, since one company may have several independent sites or several companies may use the same one.
Geography creates another layer. Two plants can have different owners but share a floodplain, electricity supply, export jurisdiction, or port. Identify the scenario precisely. “Same country” is relevant to one export restriction; it may be too broad for a localized storm.
Supply declarations should distinguish actual production locations from sales offices, distributors, and invoice addresses. If the manufacturer is unknown, preserve that uncertainty. A vendor's domestic billing address does not prove that the material or process is domestic or independent.
An illustrative map has two approved machine shops, A and B. A supplies 60% of your housing demand; B supplies 40%. Both buy castings from Foundry X. For a machine-shop outage, you have two paths, subject to spare capacity. For a Foundry X outage, all the demand is exposed.
The distinction between choosing one source and having only one usable source is covered in sole source vs single source. Here the question is whether apparently separate paths converge before the part reaches you.
How do you build a usable concentration register?
Use a compact register for critical parts. Ask each supplier for the dependencies needed to answer a defined scenario. A complete map of every tier may be impractical, but knowing the relevant casting and material route can still support a decision.
| Field | What to record | Why it matters |
|---|---|---|
| Part and approval scope | Number, revision, approved site and process | Prevents unrelated approvals being counted |
| Direct sources | Current volume or demand allocation | Establishes the starting shares |
| Critical sub-tier node | Legal name, site, process and evidence date | Reveals paths that converge |
| Common scenario | Named outage or restriction affecting that node | Defines which demand is jointly exposed |
| Share exposed | Percentage of the part's demand dependent on the node | Shows the size of the dependency |
| Independent usable capacity | Qualified output available elsewhere by date | Tests recovery instead of counting vendors |
| Inventory cover | Usable stock and credible receipts against demand | Estimates time available for action |
| Evidence confidence | Confirmed, partial, unknown, with references | Makes missing information visible |
| Action | Owner, due date, acceptance evidence | Turns the map into mitigation work |
Choose a common time period and unit for shares. Use part demand in units when possible; if you use spend, explain why it is a reasonable proxy. Different unit prices can change spend shares without changing how many builds are exposed.
Do not count a shared node twice. In the foundry example, the paths' exposed shares add to 100% of housing demand. Across different parts, keep separate denominators or use a clearly defined build-impact measure; adding unrelated percentages produces a misleading headline.
Can HHI help measure supplier concentration?
The Herfindahl–Hirschman Index sums squared percentage shares. In an illustrative sourcing calculation, two independent sources at 60% and 40% give 5,200: 60² + 40². One node carrying 100% gives 10,000. Use the same calculation at the critical sub-tier when direct suppliers share it. DOJ, Herfindahl–Hirschman Index.
The DOJ's 1,800 threshold describes highly concentrated markets in merger analysis. It is not a manufacturing sourcing limit or an approved supplier-risk threshold. Borrowing the arithmetic is useful; borrowing the legal interpretation would confuse two different decisions. DOJ and FTC, 2023 Merger Guidelines, Section 2.1.
Concentration changes with the node measured
Two illustrative calculations: independent machine shops at 60 and 40 percent have HHI 5200; their shared foundry at 100 percent has HHI 10000. Neither calculation describes the probability of disruption.
| Layer | Shares of housing demand | Calculation | HHI |
|---|---|---|---|
| Machining | 60%, 40% | 60² + 40² | 5,200 |
| Casting | 100% | 100² | 10,000 |
Define the part, tier and denominator before comparing scores. HHI is descriptive here, not a sourcing compliance threshold.
HHI rewards a more balanced split, but it cannot tell you whether the second source has spare capacity, its tooling is current, or both sources depend on one process. Keep the simple largest-node share and the scenario beside the index. A team can often act on “all castings depend on X” faster than on an unexplained score.
For different part families, avoid comparing index values until the denominator, tier, and time period match. A score for annual spend across all suppliers is not directly comparable to a score for one part's weekly production allocation.
How do you turn a concentration finding into a sourcing action?
Write the finding as a failure scenario with a consequence. For the housing example: “Both approved machining sources use Foundry X; a casting interruption exposes all housing demand after inventory cover is consumed.” Then list the evidence and the uncertainties, such as whether Foundry X has another approved independent production site.
The next action could be qualifying a different casting route, approving a design that uses another material, obtaining rights and access to tooling, reserving independent capacity, or creating a buffer. Choose the intervention that breaks or bridges the relevant dependency. Adding another machine shop using Foundry X does not break it.
Compare recovery dates with cover. An illustrative independent route takes sixteen weeks to qualify and four more to deliver production parts. Six weeks of usable cover leaves a gap unless another protection bridges it. Put those assumptions into the plan and refresh them as the supplier confirms each milestone.
Closure needs evidence that the route works. A successful quotation or audit may advance the work, but it does not establish usable production output. Define acceptance through the relevant approval, first production delivery, and confirmed capacity. The dual sourcing lesson covers keeping that source active.
How do regional requirements change the review?
The mapping method travels across regions. Contract requirements, approved sources, origin restrictions, and information-sharing rules can change which alternatives are usable. Keep those constraints in the register, identify the requirement that applies to your part, and check it separately from the concentration calculation before approving a sourcing action.
In the United States
EO 14415 names concentration and over-reliance on one source as manufacturing and supply concerns. Section 3 directs regulatory action on vetting; the order's definition is a useful category for your register, not a universal numerical concentration limit. EO 14415, Sections 3 and 7(e).
Selling into the EU?
The EU Critical Raw Materials Act uses a 2030 diversification benchmark: no single third country should account for more than 65% of Union consumption of a strategic raw material at a relevant processing stage. This is an EU-level benchmark, not a 65% purchasing cap on every manufacturer or supplier. Council of the EU, Critical Raw Materials Act.
Avoid claiming a sourcing decision satisfies a regional obligation solely because its concentration share is below a benchmark. Check the actual material, product, customer, and contract requirements separately.
What questions do teams ask about supply concentration?
A concentration review needs evidence about production paths, a consistent denominator, and a process for keeping the map current. These questions address supplier counts, withheld sub-tier information, and changing assumptions. Use the answers to assign the next verification task rather than treating missing information as proof of diversification.
Is supplier count a useful concentration measure?
It is a starting point. Count independent approved production paths for the relevant part and scenario. Then check the capacity and time each path can provide after an interruption.
What if suppliers will not identify sub-tiers?
Record the gap and request the minimum evidence needed for the critical scenario through an appropriate confidential channel. You may need an agreed verification method or customer involvement. Do not assume independence from silence.
How often should the map change?
Refresh after source, process, site, ownership, material, demand, or approval changes, and when evidence is too old for the decision. Give each update an owner and date rather than treating the map as a one-time project.
Start with one critical part, compare its suppliers' actual production paths, and assign an action to the shared node that threatens the build. Use supplier risk assessment to place that action in the wider review. If your team needs help keeping supplier commitments current, talk to our team.
This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.