Supply Risk, Resilience and Global Procurement

Introduction

Procurement decisions increasingly determine whether an organisation can continue operating during disruption. A low purchase price may be attractive, but it can be outweighed by port closures, sanctions, cyberattacks, supplier insolvency, quality failures, currency depreciation or excessive dependence on one source. Supply risk management therefore extends beyond purchasing administration. It is a strategic discipline concerned with the design, monitoring and recovery of supply networks.

Global procurement can provide access to lower costs, specialised capabilities, innovation and alternative sources of supply. It also increases exposure to longer lead times, political uncertainty, customs requirements, exchange-rate movements, cultural differences, information-security threats and logistics interruption. The central managerial challenge is to balance efficiency, responsiveness and resilience rather than optimise any one objective in isolation.

This chapter develops an integrated approach to identifying, quantifying and managing operational, financial, geopolitical, cyber, logistics and concentration risks. It also explains Incoterms, landed cost, continuity planning, resilience capabilities and crisis response.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain major categories and sources of supply risk.
2. Identify dependencies and assess probability, impact and detectability.
3. Quantify expected loss, safety-stock requirements and landed cost.
4. Evaluate global sourcing alternatives using total-cost and risk criteria.
5. Interpret the procurement implications of Incoterms and transfer of risk.
6. Design continuity, mitigation, resilience and crisis-response plans.
7. Assess governance, ethical, regulatory, cyber and technology considerations.

1. The Nature of Supply Risk

Supply risk is the possibility that an external or internal event will prevent procurement from delivering the required material, service, quality, cost, quantity or timing. It has two dimensions. The first is exposure: what could be affected and how severely? The second is uncertainty: how likely is the disruptive event and how difficult is it to detect or control?

A useful distinction is between a hazard, a condition capable of causing harm, and a risk, the effect of uncertainty on objectives. For example, political instability is a hazard; a delayed shipment caused by export restrictions is a supply risk. A disruption may be acute, such as an earthquake, or chronic, such as deteriorating infrastructure or persistent currency volatility.

Risk can arise at any tier. A buying organisation may contract with a direct supplier, while a critical component depends on a sub-tier processor, a particular mine, a software platform or a single port. Effective analysis therefore requires visibility beyond the immediate supplier.

Major categories of supply risk

Risk categories interact. A cyberattack on a logistics provider may create a physical delivery delay; a geopolitical event may cause currency depreciation and insurance cost increases. Risk registers should therefore record dependencies and cascading effects rather than treat categories as isolated.

2. Risk Identification and Assessment

A structured assessment normally follows five steps:

1. Map the supply network, including materials, suppliers, sites, transport routes, ports, systems and sub-tier dependencies.
2. Identify events, causes, controls and consequences.
3. Estimate likelihood, impact and time to recovery.
4. Prioritise risks and assign owners.
5. Select treatments, monitor indicators and review assumptions.

Useful tools include supplier segmentation, process mapping, failure mode and effects analysis (FMEA), scenario analysis, spend analysis, geopolitical screening, financial-ratio review, audits and supplier self-assessments.

Risk scoring

A simple qualitative score is:

where R is the risk score, L is likelihood and I is impact. If both are rated from 1 to 5, the score ranges from 1 to 25. This is a prioritisation device, not a probability model. It assumes that the rating scales are consistently defined and that multiplication provides a useful approximation. A score should never conceal the underlying narrative: a low-probability event with catastrophic impact may warrant stronger treatment than its score suggests.

FMEA often adds detectability. One common priority-number approach is:

where S is severity, O is occurrence and D is difficulty of detection, each typically rated from 1 to 10. The approach is useful for comparing failure modes within a consistent assessment, but the numbers are ordinal judgements rather than precise probabilities. It should not be interpreted as an actuarial loss estimate.

Expected loss

When credible probability and financial impact estimates are available, expected loss can be calculated as:

where pᵢ is the probability of scenario i, Cᵢ is its monetary consequence, and the probabilities across mutually exclusive scenarios sum to 1. The estimate assumes that scenarios are properly defined and that the consequence measure includes relevant costs such as lost contribution, recovery, penalties and emergency transport. Expected loss supports economic comparison, but it does not capture all strategic or catastrophic concerns.

Worked example. A component has three mutually exclusive annual outcomes: no disruption with probability 0.80 and cost $0; moderate disruption with probability 0.15 and cost $40,000; and severe disruption with probability 0.05 and cost $180,000.

EL = (0.80 × 0) + (0.15 × 40,000) + (0.05 × 180,000)

Therefore, expected annual loss is $15,000. Management may compare this with the annual cost of dual sourcing, additional inventory or supplier development. The decision should also consider service, safety and reputation consequences that may not be fully represented by the dollar estimate.

3. Concentration and Dependency Risk

Concentration risk exists when a large proportion of supply depends on one supplier, location, route, technology, currency or production process. It is often hidden by the number of purchase orders: ten purchase orders may still represent one factory or one sub-tier source.

The Herfindahl–Hirschman Index (HHI) can describe supplier concentration:

where sᵢ is supplier i’s share expressed as a decimal. HHI ranges from near zero with many small suppliers to 1 with a single supplier. If three suppliers have shares of 0.50, 0.30 and 0.20, HHI equals 0.38. A higher value indicates greater concentration, although there is no universal procurement threshold; criticality, substitutability and switching time must also be considered.

Geographic concentration can be assessed using the same method with country or region shares. Managers should examine common-cause dependencies, such as several apparently independent suppliers obtaining the same semiconductor from one upstream producer.

Mitigation options include qualified dual sourcing, regionalisation, standardisation, substitute materials, strategic inventory, supplier development, capacity reservations and redesign. Dual sourcing is not automatically resilient: if both suppliers share a port, raw material or software provider, effective diversification may be low.

4. Resilience, Continuity and Recovery

Supply resilience is the capability of a supply network to prepare for disruption, absorb its effects, adapt and recover while maintaining acceptable performance. Efficiency seeks low cost and low idle capacity; resilience deliberately preserves options, buffers and recovery capability. Neither is universally superior. The appropriate balance depends on criticality, demand variability, regulatory obligations and the cost of failure.

Important resilience capabilities include:

• Visibility: timely knowledge of inventory, orders, capacity, location and sub-tier dependencies.
• Redundancy: alternative suppliers, routes, systems or capacity.
• Flexibility: ability to change volume, specification, production location or transport mode.
• Collaboration: shared forecasts, joint problem solving and transparent escalation.
• Modularity: products and processes designed so that components or production steps can be substituted.
• Financial viability: suppliers with sufficient liquidity and access to working capital.
• Learning: post-event review and improvement rather than repeated emergency response.

A business continuity plan should identify critical products and processes, minimum acceptable service, recovery priorities, responsible personnel, communications, alternate sources, data backups and approval authorities. It should distinguish maximum tolerable period of disruption from recovery time objective. The former is the longest interruption the business can tolerate before unacceptable harm; the latter is the target time for restoring a process. Recovery point objective, used especially in information systems, specifies the maximum acceptable loss of data measured in time.

Inventory as a resilience measure

For stable demand and independent replenishment uncertainty, a basic reorder point is:

where d is average demand per time period, L is replenishment lead time in the same time unit, and SS is safety stock.

If demand and lead-time variability are approximated by a normal distribution and are independent, safety stock may be estimated as:

where z is the standard-normal service factor, σ_d is the standard deviation of demand per period, and σ_L is the standard deviation of lead time measured in periods. The formula assumes a stable statistical process, approximately normal combined uncertainty, constant average demand and lead time, and independent demand and lead-time variation. If demand and lead time are correlated, an additional covariance term is required; if supply disruption is highly non-normal, scenario-based or simulation methods are more appropriate.

Example. Daily demand averages 100 units with standard deviation 20 units. Average lead time is 5 days with standard deviation 1 day. For a 95% cycle service target, use z ≈ 1.645.

SS = 1.645 × √(5 × 20² + 100² × 1²)

SS = 1.645 × √(2,000 + 10,000) ≈ 180 units

The reorder point is therefore approximately 100 × 5 + 180 = 680 units. This calculation addresses routine uncertainty, not a prolonged factory closure. Strategic inventory for disruption scenarios requires a separate decision based on recovery time, demand priority, shelf life, holding cost and probability of interruption.

5. Global Procurement and Total Landed Cost

Global sourcing decisions must compare total economic cost rather than quoted unit price. Landed cost is the cost of acquiring and delivering an item to the agreed destination. Depending on the organisation’s policy, it may include purchase price, packaging, origin handling, freight, insurance, duties, taxes that are not recoverable, customs brokerage, inspection, financing, inventory carrying cost, quality failure, currency effects and expected disruption cost.

A general structure is:

where LC is landed cost per unit; P is supplier price; F is freight and handling; I is insurance; D is non-recoverable duty; B is brokerage and border charges; Q is expected quality and compliance cost; H is allocated inventory or financing cost; and X is expected disruption or risk cost. The terms must be defined consistently and should not double-count costs already included in a quotation.

Taxes that the buying organisation can fully recover are generally excluded from economic cost, although they affect cash flow. Currency conversion must use a stated exchange-rate assumption and sensitivity analysis should be performed where exposure is material.

Worked comparison. Supplier A quotes $10.00 per unit. Freight is $0.80, insurance $0.10, duty 5% of the customs value (price plus freight, assumed here), brokerage $0.20, and quality cost $0.15.

Customs value = $10.00 + $0.80 = $10.80.

Duty = 5% × $10.80 = $0.54.

Landed cost before inventory and disruption allowance = $10.00 + $0.80 + $0.10 + $0.54 + $0.20 + $0.15 = $11.79.

If expected disruption cost is $0.30 per unit, risk-adjusted cost is $12.09. A domestic supplier quoted at $12.00 may therefore be economically preferable, even before considering shorter lead time and easier recovery. The result depends on the assumptions and should be tested under alternative freight, exchange-rate and disruption scenarios.

6. Incoterms and Allocation of Responsibilities

Incoterms are internationally recognised rules published by the International Chamber of Commerce that clarify delivery obligations, allocation of transport costs, export and import responsibilities, and the point at which risk transfers. They do not, by themselves, determine ownership, payment terms, product specification, dispute law or every insurance obligation.

Examples include EXW, FCA, CPT, CIP, DAP, DPU and DDP for various modes, and FAS, FOB, CFR and CIF for sea or inland waterway transport. The correct rule must be paired with a named place and edition, such as “FCA Supplier Facility, Incoterms® 2020.”

A frequent error is to confuse cost responsibility with risk transfer. Under some rules the seller pays for carriage to a destination while risk transfers earlier. Procurement professionals must confirm who controls transport, who provides documents, who bears customs exposure and whether insurance coverage is adequate. EXW may appear inexpensive but can create practical export and loading difficulties for a foreign buyer. DDP may provide convenience but can expose a seller to import compliance obligations it cannot legally perform in the destination country.

Contract reviews should align Incoterms with:

• the organisation’s logistics capability;
• insurance and claims arrangements;
• customs valuation and tax requirements;
• desired visibility and control;
• packaging, inspection and evidence of delivery;
• sanctions, export-control and forced-labour obligations.

7. Mitigation and Risk Treatment

Risk treatment should follow a hierarchy:

1. Avoid: stop using a hazardous source, route or specification.
2. Reduce likelihood: improve supplier qualification, controls, maintenance or cyber security.
3. Reduce impact: hold strategic inventory, qualify alternatives or redesign the product.
4. Transfer or share: use insurance, contractual allocation, hedging or collaborative arrangements.
5. Accept: consciously retain the risk with monitoring and contingency triggers.

Contracts should address continuity obligations, notification deadlines, audit rights, change control, business continuity evidence, cyber requirements, data protection, subcontracting, sanctions compliance, responsible sourcing, liability and termination assistance. Clauses are ineffective if the buyer cannot monitor or enforce them.

Supplier segmentation should reflect business impact and supply risk rather than spend alone. Strategic suppliers may require executive governance and joint resilience investment; bottleneck suppliers may require inventory and substitution plans; leverage suppliers may be managed through competition; routine suppliers benefit from automation and standardisation.

8. Crisis Response and Governance

During disruption, decision quality depends on speed, authority and reliable information. A crisis playbook should establish an incident leader, cross-functional team, escalation thresholds and communication channels. Initial actions include validating the event, protecting people, determining affected materials and orders, freezing unreliable data, contacting the supplier and logistics providers, and identifying available inventory and substitutes.

The response should prioritise customers, safety-critical products and legally mandated obligations. Emergency buying must remain controlled: approved substitutions, delegated authority, fraud checks and documented prices are essential. Expedite decisions should compare the cost of transport with the cost of stockout and the strategic importance of the order.

After stabilisation, the organisation should conduct a root-cause review, reconcile financial effects, assess supplier performance, update risk assumptions and implement corrective actions. A crisis that produces no organisational learning is likely to recur.

Governance should include a risk owner, review frequency, key risk indicators and evidence of control effectiveness. Indicators may include supplier financial stress, late-order trend, capacity utilisation, geopolitical alerts, cyber incidents, single-source spend, inventory coverage and changes in supplier bank details. AI and analytics can support anomaly detection, scenario modelling and document review, but automated recommendations require human validation, traceable data, protection of confidential information and controls against biased or manipulated inputs.

9. Ethical, Regulatory and Contemporary Issues

Global procurement decisions have consequences beyond price and continuity. Organisations may face obligations concerning modern slavery, forced labour, conflict minerals, environmental emissions, product safety, anti-bribery, sanctions, export controls, privacy and competition law. Due diligence should be risk-based and extend to relevant sub-tier suppliers. Supplier codes of conduct are not a substitute for verification, remediation and responsible disengagement.

Resilience strategies can also create ethical tensions. Stockpiling scarce medical products may improve continuity for one organisation while reducing access for others. Aggressive supplier switching may transfer financial harm to vulnerable suppliers. Procurement leaders should consider proportionality, transparency, worker welfare and stakeholder effects.

Contemporary developments include regional supply-network design, nearshoring, digital supply-chain mapping, electronic trade documentation, supplier cyber ratings, climate-risk analysis and circular procurement. These developments offer valuable capabilities but introduce new dependencies, including cloud concentration, data-quality problems and algorithmic opacity.

Illustrative Case: Medical Device Component Disruption

Background. A medical-device manufacturer purchases a precision connector from one overseas supplier. The connector represents only 2% of unit cost but is required for regulatory-approved product configuration. The supplier uses a single specialised plating subcontractor.

Problem. A cyberattack disrupts the supplier’s production and order-management systems. The manufacturer has 18 days of inventory, while normal replenishment lead time is 35 days. A second supplier exists but has not completed qualification.

Analysis. The apparent direct-supplier risk conceals sub-tier concentration. The component is low-cost but high-criticality. Expected loss based only on purchase price would understate the cost of lost production, regulatory delay and patient impact. The manufacturer maps inventory, open orders, alternate specifications, the plating subcontractor and regulatory constraints. It confirms that the second supplier can produce a technically equivalent item but requires validation.

Approach. The crisis team allocates remaining inventory to the highest-priority products, obtains controlled production information through an alternate communication channel, and arranges an emergency audit. It accelerates validation of the second supplier, purchases limited finished inventory, and evaluates air freight. It also establishes a continuity clause requiring incident notification, maps critical sub-tier suppliers, increases safety stock for the validated connector and funds cyber-resilience improvements.

Outcome. Production continues with constrained allocation. The second source becomes qualified after the disruption, and the organisation redesigns the connector to permit two approved plating processes. The higher ongoing cost is accepted because it materially reduces recovery time and concentration exposure.

Learning points. Criticality is not proportional to spend; tier-two visibility matters; qualification lead time must be included in continuity planning; and resilience may require product redesign rather than merely more inventory.

Challenges and Limitations

Risk assessment is subject to probability bias, incomplete data, optimistic supplier declarations and changing conditions. A numeric score may create false precision. Expected loss can undervalue low-probability catastrophes, while excessive buffers can create obsolescence and working-capital burdens. Dual sourcing may reduce dependency but increase quality complexity and volume fragmentation. Regional sourcing may lower geopolitical exposure while increasing unit cost or reducing specialist capability.

The practical response is not to seek a perfect model. It is to combine quantitative estimates with expert judgement, scenario analysis, stress testing and explicit assumptions. Decisions should be revisited when demand, technology, regulation, supplier ownership, routes or geopolitical conditions change.

Chapter Summary

Supply risk is the possibility that uncertainty will prevent procurement from meeting cost, quality, quantity, timing or continuity objectives. Effective management begins with network mapping and classification of operational, financial, geopolitical, cyber, logistics, quality and concentration risks. Risk scores support prioritisation, expected-loss analysis supports economic comparison, and concentration measures reveal dependency that spend totals may conceal.

Global procurement must be evaluated using total landed cost, not supplier price alone. Incoterms clarify delivery obligations and risk transfer but do not replace a complete contract. Resilience is developed through visibility, redundancy, flexibility, collaboration, modularity, financial viability and organisational learning. Inventory formulas can address routine uncertainty, but major disruption requires scenario planning and continuity design.

Professional practice integrates mitigation, supplier governance, cyber controls, ethical due diligence, crisis response and post-event learning. The appropriate strategy balances efficiency with recovery capability and recognises that low-cost, low-inventory networks may be fragile when dependencies are concentrated.

Key Terms

Supply risk: The possibility that uncertainty will prevent supply objectives from being achieved.

Hazard: A condition or event capable of causing harm.

Supply resilience: The ability to prepare for, absorb, adapt to and recover from disruption.

Concentration risk: Exposure created by dependence on one or a small number of sources, locations or systems.

Sub-tier supplier: A supplier that provides goods or services to a direct supplier rather than directly to the buying organisation.

FMEA: Failure Mode and Effects Analysis, a structured method for evaluating potential failures.

RPN: Risk Priority Number, commonly calculated as severity × occurrence × detectability.

Expected loss: Probability-weighted financial consequence of defined scenarios.

HHI: A concentration index calculated as the sum of squared supplier or country shares.

Landed cost: Total cost of acquiring and delivering goods to an agreed destination.

Incoterms: Standard international rules defining delivery responsibilities, costs and risk transfer.

Safety stock: Inventory held to protect against uncertainty in demand or replenishment.

Reorder point: Inventory level that triggers replenishment.

Recovery time objective: Target time for restoring a disrupted process.

Recovery point objective: Maximum acceptable period of data loss.

Business continuity plan: Documented arrangements for maintaining or restoring critical operations.

Risk treatment: Action taken to avoid, reduce, transfer, share or accept risk.

Common-cause failure: One underlying event that disrupts apparently separate sources or processes.

Key risk indicator: A measure used to monitor changing exposure or control effectiveness.

Due diligence: Investigation and verification undertaken to identify and manage compliance, ethical or operational concerns.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and a supply risk.
2. What is the purpose of a risk register?
3. Explain why supplier price is not the same as landed cost.
4. What is concentration risk, and how can it be measured?
5. Distinguish recovery time objective from recovery point objective.

Long Answer Questions

1. Explain the major categories of supply risk and discuss how they can interact.
2. Describe a structured process for assessing and treating global procurement risk.
3. Explain the role and limitations of Incoterms in international procurement contracts.
4. Discuss how inventory, dual sourcing, flexibility and product redesign contribute to resilience.
5. Evaluate the ethical and regulatory responsibilities of organisations using global suppliers.

Analytical / Application Questions

1. A firm relies on three suppliers with shares of 0.60, 0.25 and 0.15. Calculate the HHI and interpret the result. What additional information would you need before recommending dual sourcing?
2. Compare two sourcing options using landed cost, currency sensitivity, lead time and expected disruption cost. Explain why the lowest quoted price may not be the best decision.
3. Design a crisis-response plan for a critical component whose sole supplier has suffered a ransomware attack. Specify the first 24-hour actions, decision owners, communication requirements and longer-term resilience measures.

Multiple Choice Questions with Answers

Question 1

Which statement best describes supply resilience?

A. The ability to purchase only from the lowest-cost supplier

B. The ability to prepare for, absorb, adapt to and recover from disruption

C. The elimination of all inventory from the supply chain

D. The transfer of every supply risk to a carrier

Correct Answer: B. The ability to prepare for, absorb, adapt to and recover from disruption

Question 2

A risk has a likelihood rating of 4 and an impact rating of 5 on a simple 1–5 matrix. What is its risk score?

A. 9

B. 15

C. 20

D. 25

Correct Answer: C. 20

Question 3

Which cost is normally included in a total landed-cost analysis?

A. Only the supplier’s quoted unit price

B. Freight, applicable duty and border charges

C. The buyer’s unrelated marketing expenditure

D. Only recoverable taxes

Correct Answer: B. Freight, applicable duty and border charges

Question 4

What does a higher HHI generally indicate in supplier analysis?

A. Greater supplier concentration

B. Lower supplier concentration

C. Higher product quality

D. Shorter transport lead time

Correct Answer: A. Greater supplier concentration

Question 5

Which formula represents a basic reorder point?

A. ROP = dL + SS

B. ROP = d ÷ L − SS

C. ROP = SS − dL

D. ROP = d + L + SS

Correct Answer: A. ROP = dL + SS

Question 6

Which statement about Incoterms is correct?

A. They determine every aspect of ownership and payment law

B. They clarify delivery obligations, costs and risk transfer

C. They guarantee that goods will pass customs

D. They eliminate the need for insurance decisions

Correct Answer: B. They clarify delivery obligations, costs and risk transfer

Question 7

Why can a low-spend component require major resilience investment?

A. Low-spend items are always easy to substitute

B. Criticality depends on operational and regulatory effect, not only price

C. Low-spend components never create production stoppages

D. Price is the only valid risk measure

Correct Answer: B. Criticality depends on operational and regulatory effect, not only price

Question 8

In the expected-loss formula, what does pᵢ represent?

A. The purchase price of item i

B. The probability of scenario i

C. The production quantity of item i

D. The supplier’s profit margin

Correct Answer: B. The probability of scenario i

Question 9

Which is an example of a common-cause failure?

A. Two independent suppliers use completely different ports and materials

B. Several suppliers depend on the same upstream processor

C. A buyer changes its internal approval form

D. One warehouse improves its cycle counting

Correct Answer: B. Several suppliers depend on the same upstream processor

Question 10

What is a suitable immediate crisis-response action after a critical supplier cyberattack?

A. Ignore the event until the next annual supplier review

B. Validate the event, assess affected supply and activate the response team

C. Delete all supplier records

D. Automatically terminate every supplier contract

Correct Answer: B. Validate the event, assess affected supply and activate the response team