Supplier Risk & Dependency Register

What this tool does

CM8-283 is a supplier risk and dependency register. One row per supplier, and every field serves one question: what happens to us if this supplier stops tomorrow? It records what they supply, what you spend, whether anyone else could do it, how long moving would really take and what your plan is — then scores the exposure, ranks the register by it, and names the suppliers who are exposed with nothing tested behind them. It runs inside this file: no account, no upload, no network request.

Why ranking suppliers by spend is the wrong risk lens

Most organisations already have a supplier list sorted by annual spend, and most quietly treat the top of it as the risk list. It is the wrong list, and the reason is the whole thesis of this tool. Your largest supplier is large because you buy a great deal from them, and that produces attention: a contract, a review meeting, a named account manager, probably a second source, because the money justified the effort. Large spend usually means a commodity too — steel, packaging, freight — and commodities have markets, so if your biggest stockholder closed on Friday you would be trading again by Wednesday. The supplier that stops you is the opposite creature: small, never reviewed because it never reached a spend report, doing one process that exists on a drawing as a specification line, in one building, with two people who know how. Nobody qualified an alternative, because nobody noticed the need. The invoice value is trivial and the dependency is total. In the sample register the largest supplier by spend scores 4, while a heat-treatment subcontractor worth a twentieth as much scores 27 — the normal shape of a supply base, not a quirk of the sample. Spend measures what a supplier is worth to them; exposure measures what they are worth to you.

Spend is still shown, because it says how much money sits behind a dependency and how much leverage you have when asking for a continuity clause. It just does not order the register.

The exposure score

• If they stopped tomorrow — Factor
• No impact — we can wait — 1
• Minor — inconvenience — 2
• Major — a line or service stops — 4
• Critical — the business stops or a contract fails — 6

• Sourcing position — Factor
• Single source, or none qualified — 3
• One alternative qualified — 2
• Two or more qualified — 1

• Financial health — Factor
• Strong or adequate — 1
• Unknown — nobody has looked — 1.5
• Concern — visible difficulty — 2

The impact steps are uneven because the gap between an inconvenience and a stopped line is the larger one. The factors multiply rather than add, so a critical supplier with two alternatives scores below a minor supplier with none — correct, because the first has somewhere to go. Unknown health costs more than adequate, because pricing ignorance at 1 would reward never looking. The action threshold, 12 by default, is a setting.

Single source and sole source

The words get used interchangeably and should not be, because the fix differs. Sole source means only one supplier exists who can do this — a patented process, a proprietary part, a capability nobody else holds. You did not choose it and cannot simply undo it, so the answers are buffer stock, contract terms, a redesign that removes the dependency, or a conscious decision to carry it. Single source means several suppliers exist and you chose one; it is the commoner case and the fixable one, because the alternative already exists and only the qualification work is missing. The register has one checkbox, because on the day they fail the difference does not matter — but say which it is in the plan, because a sole-source row needs stock and a redesign study while a single-source row needs a purchase order.

Switching lead time is the number that matters most

Asked how quickly they could move a part, most firms quote the alternative's delivery lead time. The clock actually starts when the incumbent fails and stops when saleable product arrives:

• Finding and pricing an alternative, if none is qualified.
• Transferring tooling, patterns, fixtures or programs — and establishing who owns them.
• Sample and first-article production, dimensional and material verification.
• Process qualification where the specification demands it — a coating, a heat treatment, a weld.
• Customer approval, where a drawing names an approved supplier list. The step firms forget, and often the longest.
• Then, finally, the production lead time.

Sixteen weeks, not three. The tool will not save a single-source row without this number: a dependency with no switching estimate has been noticed, not assessed.

Contingency plans that have actually been tested

The tested checkbox is deliberately hard to tick, because an untested plan is a document and documents do not make parts. Tested means somebody ran it: a trial order placed and accepted, a batch made and measured, a failover rehearsed long enough to find what broke, a data export actually loaded into something. Reading the plan at a meeting is not testing it, and neither is a supplier saying they could cope.

Testing is where plans die, which is its value. The alternative coater has a minimum order quantity you cannot meet; the second foundry needs the tooling modified; the manual fallback assumes a printer removed two years ago. Each is cheap to find in rehearsal and expensive in a crisis. A supplier at or above the action threshold with no plan, or an untested one, is flagged No tested plan.

Financial health a buyer can actually observe

Published accounts are old news by the time they show trouble. What you have is a purchasing relationship, and it leaks information constantly:

• Delivery performance drifting, with no explanation that holds up.
• Requests to shorten payment terms, take deposits, or be paid before despatch.
• Part shipments and split deliveries — often a sign they cannot buy their own material.
• Key people leaving, especially quality and production, and posts not refilled.
• Maintenance deferred, machines standing, the site quieter than it was.
• Price rises out of step with input costs; chasing your payment earlier than they used to.

Any one means nothing. Three at once, at a supplier you cannot replace inside a quarter, is a reason to act this month. Use unknown when it is true — unknown is what prompts somebody to look.

Concentration by category and by geography

Single-supplier dependency is the obvious form; concentration is the quiet one — several suppliers, one point of failure behind them all. The concentration tile reports what share of total annual spend your largest few suppliers account for. There is no correct figure, but it should be known.

Geography is free text, because the useful question is not which territory a supplier sits in but whether the capacity sits in more than one place. Two suppliers on one industrial estate share a power supply, a road and a flood plain; two plants in one group share a balance sheet. Write how many sites, how far, and how the goods travel. If every special process runs through one cluster, check the plans do not all name the same alternative.

What to do with a top-exposure supplier

• Qualify an alternative. The permanent fix and the slowest. Budget the first-article and approval work as a project, not as something purchasing does between calls.
• Hold buffer stock. Fast, imperfect, and it costs working capital. Size it against the switching lead time — four weeks of stock in front of a sixteen-week switch buys a quarter of the gap.
• Negotiate continuity terms. Tooling ownership and the right to remove it, records escrowed, notice periods, step-in rights, a duty to notify insolvency. Cheap at renewal, worthless once the crisis has started.
• Accept it consciously. Sometimes no alternative exists, or the redesign costs more than the risk. Accepting is legitimate — but only as a decision, recorded with a name against it and revisited at review. The failure mode is finding afterwards that the exposure was an oversight wearing the costume of a decision.

Review cadence

Set the interval on the Settings tab and the action list marks anything older as overdue. Twelve months suits most of the register; anything above the action threshold deserves twice a year, and a supplier rated a concern deserves a look monthly until the rating moves. A useful review asks four things: what has changed at the supplier, is the switching estimate still honest, has the contingency been tested since we last met, and who owns the next action.

Not a scorecard, and not an audit tracker

Three tools cover suppliers and they answer different questions.

• Supplier Scorecard asks how are they performing? — on-time-in-full, defect rates, responsiveness, delivery by delivery.
• Supplier Audit Tracker asks are they capable? — a point-in-time assessment of their quality system, process control and records, with findings and actions.
• This register asks what happens to us if they stop? — dependency, continuity and concentration. A supplier with a perfect scorecard and a clean audit can still be your largest continuity exposure, and frequently is.

FAQ

Should every supplier go on the register? No. Include anything whose failure would be felt, and everything single-sourced regardless of value. If unsure, ask what you would do on the morning they did not answer the phone — if the answer is "call someone else", leave them off.

What counts as a qualified alternative? Approved, priced, and able to take an order this week. Quoted is not qualified. If moving would need a first article they are a candidate.

What about sub-tier suppliers? The register sees your direct suppliers. A shared sub-tier source is a common way two "independent" suppliers fail together, so ask your critical suppliers what their own single-source exposures are.

Saving your work

Suppliers, settings and the report header are written to this browser's local storage as you type. That storage belongs to one browser on one computer: another browser, a private window or a clean-up tool that clears site data will not have it. Treat Export .json as the real save, which Import .json restores anywhere; Export CSV gives you the register for spreadsheet work; Reset asks twice, then erases everything, with no undo. This register names your weakest points and prices them — handle exports as commercially sensitive.

Accuracy & disclaimer

The arithmetic is three factors multiplied and the tool does it faithfully. Everything that matters sits underneath: whether the impact rating is honest, whether the alternatives counted are ready, whether the switching estimate includes the approval steps, and whether the register holds the suppliers who could actually stop you. That last one is the real limitation. This register scores what you know. It cannot see a supplier's own dependency two tiers down, a retirement, a fire or a flood — and the failures that hurt are usually the ones nobody had on the list. A low score means "nothing we have spotted", not "safe". Health ratings are your observation, not a credit assessment, and nothing here is legal, credit, insurance or procurement advice.