The Single-Thread Risk: Measuring Supplier Dependency in UK Operations

Supplier concentration rarely announces itself. A components supplier, a specialist subcontractor, a software provider or a logistics partner can sit quietly in the operation for years without appearing on a board agenda. Customer concentration, by contrast, is usually visible: it appears in sales reports, account plans and creditor conversations. The result is an asymmetry in attention. Leaders know where revenue comes from, but not always where continuity comes from.

That asymmetry matters because the supplier a business cannot easily replace is not necessarily the one with the largest invoice. It may be a small firm with a unique accreditation, a single-site machinist, a cloud platform embedded in order processing, or a haulier covering a difficult route. The practical question for a managing director is not how much is spent with that supplier. It is what would happen on Monday morning if the supplier could not deliver.

Start with revenue, not spend

A supplier concentration review should begin with the order book rather than the purchase ledger. Procurement analysis often starts with spend, which can obscure dependence. A low-spend supplier may be essential to a high-value product line; a high-spend supplier may be easily substituted.

The first step is to list the organisation’s principal revenue streams for the current year. For each, identify the inputs without which delivery would stop or degrade materially. These inputs may be materials, components, subcontracted services, transport, software, certifications or specialist labour. Then name the supplier or suppliers behind each input.

This is not an exercise in mapping every purchase. It is a test of revenue continuity. A useful filter is to ask three questions for each supplier: would output stop, would quality fail, or would a customer contract be breached? If the answer to any is yes, the supplier belongs on the review list.

A one-day audit that produces decisions

The review can be completed in a day if it is scoped tightly. Invite operations, finance and sales. The morning should be spent building a dependency map: principal revenue streams, critical inputs, named suppliers and the internal owner of each relationship. The afternoon should be spent testing each critical supplier against four practical criteria.

First, substitutability. Is there a qualified alternative, and could it be used without customer approval or re-certification? Second, time to recover. If the supplier stopped tomorrow, how long before an alternative could deliver at the required volume and standard? Third, contractual leverage. What notice periods, service levels, escrow arrangements or transition obligations exist? Fourth, supplier health. Is the supplier financially stable, dependent on the organisation for its own revenue, or exposed to a single site or key person?

The output should be a short dependency register, not a procurement report. Each entry should show the revenue exposed, the recovery time, the current mitigation and the owner. That register becomes the basis for board discussion.

Quantify concentration in plain terms

Complex indices are rarely necessary. A simple calculation is more useful: revenue at risk multiplied by the time to recover. If a supplier supports £2 million of annual revenue and recovery would take eight weeks, the organisation is exposed to roughly £300,000 of revenue risk, before considering customer penalties or reputational damage. That figure can be compared with cash headroom and customer commitments.

Concentration should also be viewed from the supplier’s side. A small supplier that depends heavily on one customer may be financially fragile. A large supplier may be stable but able to dictate terms. Neither situation is automatically unacceptable, but both should be understood.

It is equally important to distinguish between spend and dependence. A supplier receiving 5 per cent of spend may support 30 per cent of revenue. A supplier receiving 30 per cent of spend may be one of several qualified sources. The audit should record the latter, not the former.

Set trigger points the board can act on

A dependency register is only useful if it leads to decisions. The board should agree simple trigger points in advance. For example, a supplier might be marked amber where no qualified alternative exists, and red where recovery would exceed four weeks or where revenue at risk exceeds available cash headroom.

Triggers should lead to specific actions, not general concern. Actions might include qualifying a second source, holding strategic stock, negotiating improved notice periods, requiring escrow or transition support, arranging site visits, or developing dual tooling. Some risks may be accepted explicitly; that is a legitimate decision provided it is recorded and reviewed.

The review should be repeated at least annually and whenever a major contract, product line or supplier changes. Ownership should sit with operations, with finance providing the revenue-at-risk calculation and sales confirming customer constraints.

Common traps

The most common error is to confuse contract length with protection. A long contract may offer commercial comfort, but it does not create an alternative supplier. Another trap is to focus only on tier-one suppliers. Lower-tier dependencies, such as a sole provider of a coating, calibration or packaging input, can be just as critical and far less visible.

Organisations also overlook non-commercial dependencies: a supplier’s accreditation, a key engineer, a single production site, or a software integration that would take months to replace. These belong in the same review because they affect the same decision: how much revenue the business is willing to place on a single thread.

The decision before the crisis

Supplier concentration is a governance issue before it is a procurement issue. The aim is not to eliminate concentration, which would be neither practical nor affordable. The aim is to know where it sits, quantify what it would cost, and decide in advance what action is proportionate.

A one-day review can give a managing director a clearer view of the suppliers the business cannot easily say no to. That view is worth having before a failure forces the conversation.