Every procurement risk register tracks supplier financial health. Most miss the risk that actually shuts down production: having exactly one qualified source for a critical component. When that supplier fails — a fire, a quality problem, a force majeure — the buyer has no switch to flip. Production halts. The cost is not measured in purchase orders. It is measured in idle production lines, missed deliveries, and penalty clauses.
The math favors diversification, but the organizational incentives do not. Procurement teams are rewarded for cost reduction, not for resilience investments that may never be used. A second source adds tooling cost, qualification overhead, and split volumes — all visible on the P&L. The avoided cost of a shutdown that never happens is invisible. This asymmetry is why single-source risk persists even in organizations that know better.
Consolidation has a dark side most procurement teams ignore
Supplier consolidation is one of the most reliable procurement levers. Fewer suppliers mean higher volumes per supplier, better negotiating leverage, and lower administrative overhead. The savings are real, and they show up in the first year. The risk accumulates silently over years.
The problem is that consolidation creates single points of failure. A supplier that was one of three sources becomes the only source after a consolidation program succeeds. The procurement team celebrates the 12% cost reduction. The risk register does not update. Three years later, that supplier has a quality crisis, and the buyer discovers there is no one else qualified to make the part.
The difference between these two outcomes is not luck. It is whether the procurement team built a second source before they needed one. The most expensive time to find a backup supplier is during a crisis. Lead times stretch, tooling costs spike, and quality shortcuts produce defective parts.
Which components deserve a second source
Not every part needs a backup supplier. The cost of qualifying a second source for every component would swallow the procurement budget. The skill is in knowing which parts matter enough to justify the investment.
The standard framework uses two dimensions: production criticality and supply market concentration. A component that can be replaced from distributor inventory within 48 hours does not need a second source, even if it is technically single-sourced. A component that requires 12-week lead times, custom tooling, and regulatory certification needs a backup — even if the current supplier has been reliable for a decade.
The output is not a mandate to diversify everything. It is a prioritized list with explicit risk acceptance for components where the math does not justify a backup. That risk acceptance document is the single most valuable artifact this process produces — when a shutdown happens, it proves the decision was deliberate, not negligent.
The organizational barrier: procurement is not rewarded for avoiding invisible disasters
This is the structural problem. A procurement leader who delivers 8% cost reduction through supplier consolidation gets a bonus. A procurement leader who spends $150,000 qualifying a second source for a part that never fails gets asked why the budget was wasted. Both decisions can be correct. Only one is rewarded.
The fix is not motivational. It is architectural. Risk-adjusted procurement metrics need to enter the performance evaluation. A single-source dependency on a production-critical component should show up as a negative on the procurement scorecard — the same way cost overruns do. The metric is simple: what percentage of production-critical spend has a qualified second source? Track it quarterly. Make it visible to the CFO.
Some organizations take this further. They treat single-source risk as a balance sheet item, not a procurement metric. The cost of qualifying a backup supplier is capitalized — treated like an insurance premium, not an operating expense. This accounting treatment changes the conversation entirely. A $150,000 tooling investment that protects $50M in annual production output is not a cost. It is a hedge.
What this means in practice
- Audit your single-source list within 30 days. Cross-reference ERP supplier assignments with engineering's approved vendor list. The ERP and the engineering list rarely match. The gaps are where the risk lives.
- Score every single-source component on production criticality. Use a simple 1–5 scale based on days-to-line-down. Components that score 4 or 5 need a backup plan. Components that score 1 or 2 can be documented and monitored.
- Get real quotes for second-source qualification on your top-5 critical parts. Tooling, sample runs, and audit costs are knowable numbers. Do not estimate — get quotes. The actual cost is usually lower than procurement teams assume.
- Present the math to the CFO, not the procurement team. Frame second-source qualification as risk transfer: insuring $X in annual production output for $Y in one-time qualification cost. This is a finance conversation, not a procurement conversation.
- Add a single-source concentration metric to the procurement dashboard. Track the percentage of production-critical spend covered by at least two qualified sources. Set a quarterly target. Review it in the same meeting where cost savings are reviewed.
How much does a second-source qualification typically cost?
A second-source qualification typically costs $50,000–$250,000 for manufactured components, depending on complexity, tooling, and certification requirements. This is a fraction of what one week of line-down recovery costs — usually $500,000 to several million.
How long does it take to qualify a backup supplier?
For standard manufactured components, qualification takes 3–6 months including tooling, sample approval, and process validation. For regulated industries like aerospace or medical devices, it can take 9–18 months due to certification requirements.
What percentage of companies have single-source suppliers without backups?
Industry surveys indicate 40–60% of manufacturing companies have at least one production-critical component with no qualified second source. This number has not improved significantly over the past decade despite increased supply chain disruption awareness.
When does supplier consolidation create more risk than savings?
Supplier consolidation creates more risk than savings when the consolidated supplier becomes the sole source for a production-critical component with no qualified alternative. The cross-over point is when the savings from volume discounts are less than the cost of even one week of unplanned downtime at the affected production line.
Sources
- Deloitte — Global Chief Procurement Officer Survey 2025. deloitte.com
- The Hackett Group — 2025 Procurement Key Issues Research. thehackettgroup.com
- McKinsey & Company — Supply Chain Risk Management practices. mckinsey.com
- Gartner — Supply Chain Risk Management Maturity Model. gartner.com