Supply Risk Map

Place suppliers on a map with tier, geography, dependency and recovery time; the red cluster is your exposure.

Time1 h
FormatTeam
StageResilience

Supply Risk Map: what it is and why it works

A supply risk map places the suppliers of your critical inputs on a visual grid or geographic map, annotated with tier, location, dependency and recovery time. Dependency asks how many qualified alternatives exist and who else competes for the same capacity; recovery time asks how long it would take to qualify and switch to another source. Plotted together, these attributes produce a cluster of red items: single-source, hard-to-requalify suppliers in exposed locations. Each red item then gets an owner and a mitigation date.

The method works because it moves risk discussions from general worry to named parts, sites and dates. It is more useful than a long risk register because the picture shows concentration: several critical parts depending on the same region, sub-tier supplier or port. A useful lens is to compare time to recover for each supplier with your time to survive, meaning how long current stock and alternatives can keep you running. Where recovery exceeds survival, you have exposure. The map feeds a Supplier Risk Score for ongoing monitoring, gives Stress Scenarios realistic shocks to rehearse, and sets priorities for Backup Supply Plans.

What you need

A list of critical inputs, ideally ranked by revenue or production impact
Supplier names, sites and tier level for each input, including known sub-tier sources
Current qualification status of alternative sources
Estimated time to qualify and switch for each input
Stock on hand and in transit, to estimate how long you can run without supply

What you get

A visual risk map or matrix with supplier sites, tiers and dependency
A ranked list of red items where recovery time exceeds survival time
Identified concentration points such as shared sub-tier suppliers or regions
An owner and mitigation date for each red item

When to use it

When risk is discussed in generalities and nobody knows the real exposure.

How to do it, step by step

List suppliers for critical inputs with tier and location.
Add dependency: who else uses them, what alternatives exist.
Add recovery time: how long to qualify and switch.
Plot on a map or matrix; the red cluster is your exposure.
Assign an owner and a mitigation date to each red item.

Worked example: Mapping critical spares exposure at a water utility

Illustrative scenario — figures are realistic but not from a real company.

A regional water utility runs three treatment plants and 40 pumping stations. After a long delay on a replacement membrane module, management asked which other inputs could halt treatment. Procurement listed 85 critical items, from chemicals to membrane elements, UV lamps and motor control components.

The team recorded supplier, manufacturing site, tier and number of qualified alternatives for each item; for 30 items they also traced the sub-tier source of a key component.
Engineering estimated recovery time: weeks to requalify an alternative chemical grade, many months for a new membrane supplier needing pilot testing and regulatory acceptance.
Stores estimated how long each item could be covered from stock on hand and in transit.
Plotted on a matrix of recovery time versus coverage, 11 items fell in the red zone. Four of them shared the same overseas sub-tier source of a polymer component.

Result. The utility assigned owners to all 11 red items, raised strategic stock for four, started qualification of a second membrane supplier and added contract clauses requiring notification of sub-tier changes. The shared sub-tier dependency, invisible in the supplier list, became the top priority. The lesson: exposure concentrates below tier one.

Open it in the FieldKit Supply Chain app → Get the Supply Chain template pack — join the waitlist

Common pitfalls and how to avoid them

Mapping only tier-one suppliers.Trace sub-tier sources for the most critical inputs; concentration often hides one or two levels down.
Mapping every supplier with equal effort.Start with critical inputs ranked by impact; a focused map of 50 items is more useful than an incomplete map of 5,000.
Treating the map as a one-time poster.Update it at least yearly and whenever a supplier, site or qualification changes.
Identifying red items without owners.Assign every red item a named owner, an action and a mitigation date, and review progress in regular meetings.

Frequently asked questions

What is supply chain risk mapping?

It is the process of identifying the suppliers, sites and routes behind your critical inputs and visualizing their exposure: where they are, how dependent you are on them, and how long recovery would take. The output is a map or matrix that shows where disruption would hurt most, so mitigation effort goes to the right places.

What is the difference between time to recover and time to survive?

Time to recover is how long a supplier or node needs to return to full output after a disruption. Time to survive is how long you can keep meeting demand without it, using stock, alternatives and substitutes. When recovery takes longer than survival, that node is a priority exposure.

How deep into the supply chain should risk mapping go?

Go as deep as needed to find concentration for your most critical inputs. For many items tier one is enough, but for components with scarce materials, specialized processes or known bottlenecks, tracing to tier two or three is often where the real exposure appears. Supplier cooperation and contract clauses help obtain that visibility.

Origin

Supply risk mapping — business continuity practice, ISO 22301 era.

Used in these playbooks

Supplier crisis room 90 min

A supplier just failed: map the exposure, pick the alternates, assign actions — in 90 minutes.

Resilience audit 2 days

Two days to know your real exposure: risk map, supplier scores, stress scenarios, buffers and backup plans on paper.

Related methods

More in “Resilience”

Absorb shocks: buffers, alternates and rehearsed responses.