What Keeps the Resilience Manager Up at Night? Two Providers, One Dependency

Having two suppliers does not necessarily mean having two alternatives.

It is possible that both companies purchase the same component from a single manufacturer. They may use the same logistics provider, ship through the same port, or rely on the same technology platform. They may also concentrate their production in the same geographic area, which is exposed to the same natural, political, or infrastructure-related events.

In all these cases, diversification exists on paper but not in practice.

This is one of the questions that should be of greatest concern to those working in the field of resilience: To what extent do we truly understand our organization’s dependencies?

Where Visibility Ends

Most third-party risk management programs focus heavily on direct suppliers.

They are classified according to risk level, subjected to due diligence, assessed through questionnaires, and, in the most significant cases, included in audit programs. The contracts establish service levels, security obligations, incident reporting timelines, and termination conditions.

These checks are necessary. However, they are not always sufficient.

The direct supplier is only the first level of a much more complex network. Behind them may be component manufacturers, specialized subcontractors, logistics providers, energy suppliers, data centers, cloud platforms, and software developers.

The purchased service therefore depends on parties with whom the organization has no contractual relationship and about whom it has limited information.

In TPRM terminology, our supplier’s supplier is often referred to as a fourth party. In industrial supply chains, it is more common to refer to Tier 2, Tier 3, and subsequent tiers. The terminology may vary, but the problem remains the same: an organization’s ability to operate depends on parties that lie beyond its normal scope of control.

The Paradox of Hidden Concentration

The most insidious case is that of apparent diversification.

A company may have selected two suppliers to avoid dependence on a single provider. The two contracts may be managed by different companies, with different locations, account managers, and commercial terms.

At a higher level, however, both providers could depend on the same manufacturer or use the same infrastructure.

In this case, the organization eliminated contractual single sourcing, but not the operational single point of failure.

The same problem can manifest itself in different ways:

• Two software vendors use the same cloud provider;
• Two manufacturers purchase a critical component from the same company;
• Suppliers located in different countries use the same logistics hub;
• More operators are turning to the same subcontractor for a specialized service;
• Products that appear to be alternatives incorporate the same proprietary technology.

The number of suppliers is therefore not a sufficient measure of resilience. It is necessary to determine whether the alternatives are truly independent.

NIST recommends using supply chain mapping to identify suppliers’ suppliers, geographic concentrations, the origin of the most critical parts, and potential bottlenecks. This visualization makes it possible to see relationships that are unlikely to emerge from a contract list or a vendor management dashboard.

Transparency has its limits

It’s not easy to get this information.

A direct supplier may not have a complete understanding of its supply chain. It may also consider the names of subcontractors, sources of supply, and the configuration of services to be commercially sensitive information.

In other cases, the problem is the imbalance of bargaining power. A small customer may have little ability to impose transparency requirements on a large international supplier.

Added to this is another obstacle: supply chains are not static. Suppliers change production sites, subcontractors, technologies, and delivery methods. An accurate mapping conducted during due diligence can quickly become incomplete.

The goal, therefore, cannot be to have complete and permanent knowledge of the entire network. It would be costly, difficult to maintain, and often disproportionate to the risk.

Instead, we need a selective approach based on critical analysis.

Where to Start

The first step is to identify the procurements for which a hidden dependency could have a significant impact.

Contract value isn’t always the best criterion. A small supplier may provide an irreplaceable component, an essential application, or expertise available from very few providers.

The selection process should therefore begin with the critical processes and products identified through the Business Impact Analysis. For each of these, it is necessary to determine which external resources are essential and how long it will take to restore or replace them.

For the most critical suppliers, due diligence should include certain specific questions:

1. Which subcontractors are essential for providing the service or supplying the product?
2. Are there any components, technologies, or services available exclusively from a single provider?
3. Where are the main production, logistics, and technology sites located?
4. What alternatives have been planned in the event that a critical facility becomes unavailable?
5. Are the alternatives already in use, or should they be implemented only after the interruption?
6. How long might it take for them to actually become operational?
7. Is the supplier required to report significant changes in its supply chain?

The answers do not necessarily have to result in a complete map. They should make it possible to identify dependencies that could affect multiple suppliers, processes, or business continuity strategies at the same time.

Integrating Information into Business Continuity

Being aware of an addiction does not automatically reduce the risk.

The information collected must be used in the Business Impact Analysis, continuity scenarios, and response strategies.

If two suppliers rely on the same subcontractor, they should not be considered two independent alternatives. If it takes weeks to implement an alternative solution, this timeframe must be compared with the Maximum Tolerable Period of Disruption for the affected process.

Exercises should also consider events that propagate across multiple levels of the supply chain—not only the unavailability of a direct supplier, but also the disruption of a common component, shared infrastructure, or a critical operator within the ecosystem.

The Questions That Should Keep Us Awake

For a Resilience Manager, the starting point can be traced back to four questions:

Do we at least know the main dependencies of our most critical suppliers?

Is the diversification we’ve achieved genuine, or are multiple providers converging on the same nodes?

Do the contracts include appropriate disclosure requirements regarding dependencies and material changes?

If the most critical common node were to go down tomorrow, would we be able to immediately assess the impact, or would we only then begin to reconstruct the chain?

It is not necessary to know every supplier of every supplier. However, it is necessary to know where a lack of visibility can undermine the strategies on which the organization’s continuity depends.

True resilience isn’t measured by counting how many suppliers are in a portfolio. It’s measured by understanding how many alternatives are actually still available when a common dependency fails.