The Supplier Concentration Map: What Breaks When Your Biggest Vendor Dies

One page, six columns, built from the purchase ledger in an afternoon: what each supplier gates, what share of revenue flows through it, how fast damage arrives when it stops, and the exit ramp you would actually use. The 20 percent gate that turns “we should diversify someday” into a dated line item, and the nine-person joinery whose 78 percent single-source dependency nearly took two contracted fit-outs down with it.

The single-point-of-failure audit catches the internal dependencies — the one server, the one person, the one machine. This page covers the dependencies that audit finds least often because they live on an invoice: the external supplier whose outage is your outage. Concentration risk does not feel like risk while the supplier performs — every year of smooth delivery is evidence for the argument to do nothing. The map exists so the argument happens with numbers on the table: 78 percent of materials through one distributor, eleven days of packaging stock, four weeks to first damage reads very differently from “we get on well with our suppliers.”

1. The map — six columns, one table, no more than a page

Build it from the purchase ledger, not from memory, and rank it by the percentage column:

  1. Supplier — the legal entity on the invoice, not the sales rep’s first name. Distributors and the factories behind them are different rows when they are different risks.
  2. What it gates — the thing that stops if this supplier stops: all customer shipping cartons, the only powder-coat line within 300 km, payroll processing. Write the operational thing, not the product category.
  3. Share of spend or revenue through it — last twelve months, one number. This is the column that ranks the map.
  4. Time-to-first-damage — the honest clock from “supplier stops delivering” to “a customer notices”: hours for consumables and packaging, days for standard components, weeks for tooling and exclusive lines. This column decides the order you work in — not spend, not sentiment.
  5. Second source status — one of: qualified (samples passed, price agreed), on paper (name and price known), none. A name in someone’s head is “none” with better handwriting.
  6. Exit ramp — the specific first move: merchant 40 minutes south, 3-day lead, +4 percent. If the ramp is “find someone,” the column is not done.

2. The 20 percent gate — what the share column obligates you to do

The gate is deliberately blunt. The failure mode it prevents is not the dramatic bankruptcy — it is the quiet one: your supplier gets acquired, the new parent consolidates the catalogue, and your line item dies in a pricing email you skimmed on a Friday.

3. Time-to-first-damage — the clock that decides the order of work

Spend follows the damage clock, not the dollar column. Four days of packaging stock means a packaging supplier outage reaches customers in four days — faster than most incidents get a response plan moving. The practical consequence: the highest-concentration supplier with the shortest clock gets its second source first, even when a bigger-dollar supplier has a longer runway. Worked example below turns on exactly this ordering.

4. The 30/60/90 exit ramp — hedging without breaking up

  1. Days 0–30: get samples and a written price from the second source. The objective is evidence, not a relationship: can they make the thing, at the spec, on the clock?
  2. Days 31–60: move 10 percent of volume. A small real order teaches you more than three samples — how they package, how they invoice, how they behave when something goes wrong. Run it in parallel; the outage runbook should name this source as the live fallback.
  3. Days 61–90: make the split the default and write it into the next contract renewal. Tell the primary supplier — plainly: volume will follow reliability and price, and the split is the hedge that keeps both relationships honest.

This is not a divorce. It is the purchasing version of the restore drill: the hedge is worth exactly as much as its last real test, and an untested second source is a hope with a logo.

The five traps

Worked example — the joinery with 78 percent of its materials behind one door

A nine-person commercial joinery shop bought effectively all of its sheet goods — MDF, ply, veneered board — through one regional distributor. Not by accident: consolidated volume had earned the best pricing in the region, and four quiet years had made the concentration invisible. Then the distributor’s parent company tightened credit terms after a review, the account was frozen for nine business days over a disputed invoice, and lead times on standard board went from four days to twenty-one. Two contracted fit-outs — $46,000 of signed work — were scheduled into exactly that window. The joinery found out on a Tuesday, from a delivery driver, not from the supplier.

They spent one afternoon building the map. It ranked four suppliers by share and damage clock: sheet goods at 78 percent share with an eleven-day damage clock (board stores run out first, CNC stops day twelve), hardware at 14 percent with a three-week clock, finish at 6 percent, consumables under 2 percent. The obligation was unambiguous. A timber merchant forty minutes south quoted within two days — 3-day lead, +4 percent on board, samples cut and passed the same week. The 30/60/90 ramp ran through the next quarter: 10 percent of volume in month one to test the real-world behaviour, 30 percent by the end of month two, and the split written into the annual pricing conversation with both suppliers. Total premium paid for the hedge across the year: about $1,900 — roughly one fit-out delay fee, never mind two.

The test came eight months later, when the original distributor’s own supply chain broke for three weeks — the same outage that put two of their other customers out of business. The joinery shipped both remaining fit-outs on time, on a 70/30 split nobody had to improvise. The map takes one afternoon a quarter. The alternative path — the one they were on — ends with the delivery driver delivering the bad news about your biggest quarter.

Kits

Every page ships with a kit block — the paid tools behind the free advice:

Related: the single-point-of-failure audit covers the internal dependencies this page’s map is the outside half of; the vendor outage runbook is the 48-hour playbook for the day a mapped supplier actually stops; the payment terms checklist keeps a credit freeze like the joinery’s from arriving as a surprise; the vendor escalation ladder is how you escalate before switching; and the renewal calendar is where the 30/60/90 split gets written into the next contract. the critical spare parts list is the buy-side hedge for the parts you chose to keep close instead of dual-sourcing.