Critical suppliers and single points of failure: what to look for.
A supplier can look ordinary in an accounts list and still be operationally critical. The important question is not how much you spend with them, but what stops if they cannot deliver.
Identify criticality through activities
Start with the activities that generate revenue, protect people, meet important obligations or serve key customers. For each activity, list the external providers, applications, equipment and specialist people required.
Look for concentration
- One supplier supports several critical activities.
- Different services ultimately rely on the same upstream provider.
- Only one person holds the relationship or technical knowledge.
- An alternative exists on paper but has never been onboarded or tested.
- The supplier and your business share the same geographic or infrastructure exposure.
Ask operational questions
Confirm notification arrangements, realistic recovery times, data access, minimum order constraints and the practical steps for switching providers. Contract language is useful, but the business also needs a response when the contracted recovery time is missed.
Turn the finding into treatment
Options include a tested alternative, buffer stock, a manual workaround, knowledge transfer, stronger monitoring or accepting the exposure with a documented decision. Assign an owner and review date so the treatment does not remain an intention.
Sources and further guidance
Australian guidance used in preparing this article. General information only; obtain advice for your circumstances.