To Reduce Supply Chain Risk, Consider Mapping Your Sub-Tiers
Trace your most critical parts to the mill, score each risk, and give every one an owner and a date.
To reduce supply chain risk, map the sub-tier suppliers behind your most critical parts, score each risk by likelihood and impact, and give every risk one named owner and one dated action. This playbook is sized for a purchasing team with no dedicated risk function: a register you can copy, a scoring scale you can defend, and one part traced from your contract shop down to the mill.
Why does supplier mapping stop at tier 1, and how do you go deeper?
Mapping stops at tier 1 because the names of tier 2 and tier 3 suppliers usually live in someone's head, not in your ERP. Going deeper doesn't take a risk team. It takes three passes over information you already have, one part at a time.
Start with your 20 most critical parts. Skip the full catalog. Pick the parts that would stop production if they came late, and add the ones that carry the most spend. Spend alone misses the cheap casting with no approved substitute. A two-person team can map 20 parts in a week of short sessions; a full sweep of the bill of materials is a second job nobody has.
Ask tier 1 for the mill, foundry or fab. Send one email per supplier: "For part X, who supplies the raw material or casting, and where?" Many answer quickly, because their other customers ask the same question. Record the answer even if it is only a name and a country. If a supplier won't say, record the gap and when you asked. Silence is missing evidence, not proof of a problem; supply concentration risk covers what to request next.
Read the shipping documents you already have. Bills of lading, packing slips and certificates often name the facility a part actually shipped from, which can reveal a sub-tier site without a phone call.
How do you score supply chain risks by likelihood and impact?
A 1-to-5 scale on both is enough. The point is not precision; it is a ranking your team agrees on, so effort goes to the top of the list instead of everywhere at once. Tie each score to evidence you already hold, and write down why you chose it.
| Score | Likelihood | Impact |
|---|---|---|
| 1 | No late deliveries or quality holds in three years | A shortage your safety stock absorbs |
| 3 | One late delivery in the past year | One expedite; the cost hits margin only |
| 5 | Repeated expedites or misses in the past year | Missed customer shipments |
Multiply the two for the rating that sorts your register:
Score each part, not just the supplier. One supplier can make a part you can buy anywhere and a part with no qualified alternative. Don't let a low product hide a single failure that stops a build: a part with impact 5 and no substitute goes to the top whatever its likelihood. Supplier risk assessment covers the evidence behind each score.
What belongs in a supply chain risk register?
Ten fields. With more, the register becomes a spreadsheet nobody maintains; with fewer, you can't tell who is doing what by when. Keep it wherever your purchasing team already works, whether that is supplier notes in your ERP, a shared sheet, or a custom object in Cartograph next to your POs.
| Field | What to record |
|---|---|
| Risk ID | R-001, R-002, so people can name a row in conversation |
| Part and supplier | Something you actually buy, and who makes it |
| Risk | One plain sentence: "Single source for the cast housing; 14 weeks to recover if the foundry stops" |
| Likelihood | 1 to 5, from the anchors above |
| Impact | 1 to 5, from the anchors above |
| Rating | Likelihood × impact |
| Owner | A person, not a department |
| Action and due date | One action, one deadline |
| Status | Open, in progress, mitigated or accepted |
| Last reviewed | A date, so stale rows show |
One row per risk, not per supplier. "Supplier X: medium risk" tells nobody what to do. Supplier X losing its sub-tier foundry is one risk; Supplier X confirming POs three weeks late is another; Supplier X depending on a single trucking lane is a third. Each fails differently and needs a different fix, so each gets its own scores, owner and action. A register with 30 suppliers usually holds 80 to 120 risks. Most take five minutes: a score, one sentence of action, one name.
Worked example: one part through its sub-tiers
Take a machined bracket, BRK-4471. Ask the contract shop who supplies its steel, then ask the service center which mill rolls the bar. Two emails and a phone call give you the chain.
| Tier | Who | How you found out |
|---|---|---|
| 1 | Contract machine shop in Ohio | Your PO |
| 2 | Steel service center supplying 4140 bar | Email to the shop |
| 3 | The one mill that rolls that bar | Call to the service center |
Score the whole chain, not just tier 1. Every bracket depends on one mill, so the risk sits with the mill: if it stops rolling 4140, the shop and the service center can't help. The register gets a row for it:
| ID | Risk | L | I | Rating | Owner | Action and due date | Status |
|---|---|---|---|---|---|---|---|
| R-014 | One mill behind all 4140 bar for BRK-4471 | 2 | 5 | 10 | Buyer for BRK-4471 | Qualify a second service center buying from another mill by March 31 | In progress |
Its rating of 10 sits mid-table, but with impact 5 and no substitute it goes to the top anyway. That one row is the difference between knowing your bracket comes from Ohio and knowing it depends on one mill.
Who should own each risk, and what does ownership mean?
One named person carries each risk, and it is the person already accountable for the part or supplier it touches. The buyer owns the single-source casting. The planner owns the safety stock on that family of parts. No new titles and no committee: the register writes down what your org chart already implies.
Review the open rows in the weekly purchasing meeting you already hold. If an owner can't state the risk and its due date from memory, the register is decoration. Budget about an hour a week to keep it current.
Which risks deserve action first, and which do you accept?
Sort by rating and work the top-right corner first: high likelihood and high impact. For a smaller manufacturer that is usually one or two single-sourced parts, one supplier with shaky PO confirmation habits, and whatever keeps causing premium freight. Those get an owner and a dated action. Dual-sourcing every part is how risk work becomes a second full-time job.
The rest of the register isn't unfinished work. Mark each remaining risk accepted, with one sentence on why: the part is low-volume, a week of buffer stock covers it, or the fix costs more than the exposure. Name the manager who accepts it and the next review date. That note is what you show your CFO when a shortage happens anyway, and what you reread at the next review to see whether the math has changed.
How do you keep the register alive?
A register nobody reopens within a quarter is a spreadsheet, not a control. Two habits keep it current.
Tag the signals you already collect. Late PO confirmations, premium freight approvals, missed deliveries and slower quotes are all evidence about which rows are live. Tag each one to the part and supplier in the register, and adjust the score instead of building new monitoring. When a PO has no confirmed date, or a delivery is due and nothing has arrived, a readiness signal opens a task, and Cartograph hands it to your team or Scout Agent. The platform is free for unlimited team members; Scout Agent is priced per successful outcome. Cartograph won't make the calls that confirm tier 3 for you, and a register still needs an owner to stay current.
Walk the register once a quarter. In 30 minutes, owners confirm each dated action, scores move for anything that fired, and accepted risks are accepted again or escalated. A supply chain risk management plan turns the top rows into recovery steps your team can run.
The register also changes daily buying. When you place an order for a part with a high-rated sub-tier, you already know how it fails, so you can ask for confirmation sooner or book backup capacity before a missed delivery forces an expedite.
Questions teams ask
How do you reduce supply chain risk with a small team?
Map the sub-tiers behind your 20 most critical parts instead of the whole catalog. Score each risk 1 to 5 for likelihood and impact, and give each one a named owner and a dated action. Review the open rows in the purchasing meeting you already hold.
What goes in a supply chain risk register?
Ten fields: risk ID, part and supplier, risk, likelihood, impact, rating, owner, action and due date, status, and last reviewed. Use one row per risk, not per supplier; 30 suppliers usually become 80 to 120 rows.
How do you find tier 2 and tier 3 suppliers?
Ask each tier 1 supplier who supplies the raw material or casting for the part, then ask that supplier the same question. Check bills of lading, packing slips and certificates for the facility a part actually shipped from. Two emails and a phone call usually trace one part to its mill or foundry.
Which risks should a small manufacturer accept?
Everything outside high likelihood and high impact, unless a single failure would stop a build. Mark each accepted risk with one sentence on why, the manager who accepts it, and the next review date.