Supply Chain Mapping and Risk Identification

Introduction and context

A supply chain is not merely a sequence of suppliers and customers. It is a socio-technical network through which materials, information, money, services, capabilities and risks move. A focal organisation may purchase a finished component from a tier-1 supplier while remaining dependent on a tier-3 producer of a specialised chemical, a single logistics corridor, or a cloud platform used for planning. Consequently, risk identification based only on the immediate supplier base systematically underestimates exposure.

Supply chain mapping is the disciplined representation of relevant network participants, processes, resources, flows and dependencies. Risk identification is the subsequent process of recognising events or conditions that may prevent the network from achieving objectives, understanding their causes and consequences, and recording them for treatment. Together, these activities provide the factual foundation for resilience, continuity planning, sourcing decisions, inventory policy, supplier development and crisis response.

A useful map must answer five questions:

1. Who performs each activity, at which location and at which tier?
2. What material, information, financial and reverse flows connect the activities?
3. Which assets, systems, people, infrastructure and external services are dependencies?
4. Where are the bottlenecks, single points of failure and control weaknesses?
5. Which threats, vulnerabilities and consequences require management attention?

A map is therefore not an artistic diagram. It is an analytical model whose quality depends on scope, evidence, assumptions, ownership and currency.

Learning objectives

By the end of this chapter, students should be able to:

• distinguish supply-chain mapping from simple supplier listing;
• map multi-tier networks and material, information, financial and reverse flows;
• apply process mapping and value-stream mapping to identify exposure and waste;
• evaluate dependencies, bottlenecks, critical nodes and concentration risk;
• use interviews, audits, risk registers and horizon scanning as complementary evidence sources;
• assess risks using transparent likelihood, impact and control criteria; and
• propose governance and technology practices that improve the accuracy and usefulness of risk maps.

1. The architecture of a supply-chain map

1.1 Network, process and flow perspectives

Three perspectives should be combined.

The network perspective identifies nodes and links. Nodes include suppliers, plants, warehouses, ports, carriers, utilities, information platforms and customers. Links represent contractual, physical, digital, financial or regulatory relationships.

The process perspective explains what happens at each node: forecast, order, procure, manufacture, inspect, store, transport, sell, service, return or dispose. It exposes hand-offs, approvals, queues and controls.

The flow perspective traces what moves between nodes. Material flow includes raw materials, components, packaging, work-in-process, finished goods and returns. Information flow includes forecasts, orders, schedules, specifications, quality data, shipment status and master data. Financial flow includes invoices, payments, credit and customs charges. Reverse flow includes returns, repairs, reusable packaging, recalls and waste.

The perspectives should be reconciled. A physical route may appear robust while the related customs-data interface has a single digital dependency. Conversely, a supplier may have several plants but all may depend on one sub-tier producer.

1.2 Mapping boundaries and levels of detail

Mapping begins by defining the focal product, service, geography, time horizon and decision purpose. A map for a product recall differs from one for climate transition risk or cyber incident response. The analyst should specify whether the boundary includes customers, reverse logistics, shared services, utilities and sub-tier suppliers.

Detail should be sufficient for the decision, but not so excessive that the map becomes unmaintainable. A practical hierarchy is:

The map should record confidence. “Verified,” “supplier-reported,” “inferred” and “unknown” are more informative than presenting uncertain information as fact.

1.3 Important terminology

A tier describes the commercial or production distance from the focal organisation. A tier-1 supplier sells directly to the focal organisation; a tier-2 supplier normally supplies a tier-1 supplier. Tiering is product-specific and can differ across products.

A critical node is a node whose disruption could materially impair objectives and for which alternatives are limited, slow or costly. A bottleneck is a resource or activity whose capacity constrains throughput. A single point of failure is a dependency for which no viable alternative is available within the required recovery period. A concentration risk arises when volume, capability or geography is clustered in one supplier, site, route or jurisdiction.

A dependency is a relationship in which one activity requires another resource or capability. A vulnerability is a condition that increases susceptibility to a threat. A risk event is a possible occurrence; its cause explains why it may occur, and its consequence describes the resulting effect.

2. Mapping methods and their uses

2.1 Process mapping

Process mapping represents activities in sequence and identifies inputs, outputs, owners, decisions, controls and hand-offs. Swimlane maps are particularly useful because they separate responsibilities among procurement, suppliers, manufacturing, logistics, quality, finance and IT.

A sound process map identifies both normal and exception paths. For example, an order process should show acknowledgement, credit hold, engineering change, shortage escalation, partial shipment and cancellation—not only the ideal route. Risk frequently resides in exception handling, informal workarounds and activities performed by a single experienced employee.

Standard symbols are less important than semantic discipline. Each box should describe an activity, each decision should have defined alternatives, and arrows should represent a stated relationship such as sequence, information transfer or approval.

2.2 Value-stream mapping

Value-stream mapping (VSM), derived from lean management, depicts the end-to-end flow of material and information and distinguishes value-adding time from waiting, movement, inspection, rework and inventory. It is useful for risk because delay, excess work-in-process and long replenishment intervals can amplify disruption.

Typical VSM data include cycle time, changeover time, uptime, queue time, inventory, batch size, demand and information frequency. The map should not be treated as a purely efficiency tool: reducing buffers without understanding variability can increase vulnerability. A resilient future-state map may deliberately retain strategic inventory, dual qualification or capacity slack.

2.3 Supplier and dependency mapping

Supplier mapping combines internal procurement records with supplier questionnaires, bills of material, approved-vendor lists, certificates, site data, logistics routes and structured supplier interviews. It should identify legal entity, actual manufacturing site, ownership, products supplied, sub-tier dependencies, capacity, lead time, alternates, geographic exposure and recovery capability.

Dependency mapping extends this work beyond suppliers. For each critical process, ask whether it depends on a particular machine, tool, mould, utility, skill, software application, data feed, carrier, port, payment mechanism or regulatory approval. Shared dependencies are important: several apparently independent suppliers may use the same semiconductor foundry, cloud provider, port or source of energy.

2.4 Audits and interviews

Audits test whether documented arrangements exist and operate. They may examine capacity records, business-continuity plans, maintenance, cyber controls, traceability, inventory, quality systems, environmental controls and emergency exercises. An audit is evidence-based, but it is usually a snapshot and may not reveal undisclosed sub-tier exposure.

Interviews provide tacit knowledge. Procurement staff may know commercial concentration; planners know recurring shortages; operators know fragile equipment; logistics staff know informal route substitutions; and suppliers know practical constraints omitted from contracts. Interviews should use a common protocol, record evidence separately from opinion, and include probing questions such as “What happens if this activity is unavailable for seven days?” and “Which input would you be unable to replace?”

2.5 Horizon scanning

Horizon scanning identifies emerging changes outside routine operational reporting. Sources include regulatory proposals, sanctions, trade policy, extreme-weather projections, epidemiological developments, technology roadmaps, labour trends, commodity intelligence, incident databases and supplier financial signals. The purpose is not prediction with certainty; it is the early recognition of plausible changes that may alter exposure or invalidate assumptions.

A useful scan records signal, potential mechanism, affected nodes, time horizon, confidence, trigger indicators and proposed owner. Weak signals should be distinguished from verified events, and political or social claims should be assessed for source quality and bias.

3. Identifying criticality, bottlenecks and dependencies

3.1 Capacity and bottleneck analysis

A process may contain several resources in series. If resource i has effective capacity Cᵢ units per period, the maximum steady-state throughput is constrained by the smallest effective capacity:

Here, Cᵢ should be measured in consistent units and should reflect availability, quality yield, changeovers and realistic operating time—not theoretical nameplate capacity. This relationship applies to a serial flow under stable conditions; parallel resources, rework loops and demand limitations require a more detailed model.

For example, three serial stages have effective capacities of 1,000, 720 and 900 units per day. The line is constrained to at most 720 units per day before additional effects such as downtime or yield loss. The second stage is a capacity bottleneck. If the stage is also single-sourced and difficult to replace, it is a critical node as well.

Capacity alone does not establish criticality. A low-capacity activity may have abundant alternatives, while a high-capacity activity may be irreplaceable because it possesses a unique approval or technology.

3.2 Lead time, recovery and time-to-impact

Risk mapping should compare disruption timing with organisational tolerance. Let TTI denote time to impact: the time from loss of a dependency until service or production falls below an acceptable level. Let RTO denote the recovery time objective: the maximum acceptable time to restore a process. A basic resilience condition is:

If recovery time exceeds TTI, continuity requires a bridge such as inventory, alternate capacity, substitution or demand prioritisation. This is a decision rule, not a universal law; the values depend on service commitments, product criticality and the definition of unacceptable impact.

Inventory can provide a temporary bridge. If demand is approximately constant at d units per day and usable inventory is I units, the inventory cover in days is:

For I = 2,400 units and d = 600 units per day, cover is 4 days, assuming no replenishment, no safety stock restriction, constant demand and all inventory is usable. The calculation does not prove that four days of protection exists if inventory is allocated to other customers, defective, inaccessible or subject to shelf-life limits.

3.3 Network centrality and practical judgement

Graph concepts can support prioritisation. Degree centrality counts direct connections; a node with many links may propagate disruption widely. Betweenness centrality identifies nodes that frequently lie on shortest paths and may indicate transit hubs or information brokers. However, mathematical centrality is not equivalent to business criticality. A node with few links may supply a unique, high-consequence component. Network metrics must therefore be combined with product knowledge, substitutability, recovery time, regulatory constraints and impact analysis.

4. Risk identification and the risk register

Risk identification should proceed from objectives. Typical objectives include continuity of supply, product conformity, customer service, worker safety, regulatory compliance, information security, financial performance and environmental responsibility.

A practical chain is:

Objective → asset or activity → dependency → threat → vulnerability → event → consequence → control → treatment.

For example: maintain production → coating process → specialised solvent → port closure → single import route → solvent unavailable → line stoppage and delayed customer orders → minimum stock and alternate route → qualify local source.

4.1 Risk register fields

A risk statement such as “supplier risk” is too vague. “If the sole approved producer of resin loses electricity for more than three days, production of Product X may stop because no qualified substitute is available” is testable and actionable.

4.2 Qualitative and semi-quantitative assessment

Many organisations use ordinal scales, for example likelihood from 1 (rare) to 5 (almost certain) and impact from 1 (minor) to 5 (severe). A simple prioritisation score is:

where L is the likelihood rating and I is the impact rating. This is a ranking aid, not a probability calculation. Multiplying ordinal categories assumes that differences between categories are meaningful and comparable, which may not be strictly true. Scores should therefore be accompanied by rationale, uncertainty and escalation rules. A low-frequency event with catastrophic consequences must not be dismissed merely because its product score is moderate.

Controls should be assessed separately. Preventive controls reduce the chance of an event; detective controls identify it; corrective or recovery controls reduce consequences. Residual risk is the exposure remaining after controls, but it should not be represented as a precise number unless the underlying evidence supports quantitative estimation.

4.3 Dependencies and cascading risk

A local disruption can cascade through shared resources, substitute demand, financial stress and information failure. Mapping should test at least four scenarios:

• loss of a node;
• loss of a link or route;
• loss of an enabling service such as power, data or labour; and
• simultaneous disruption of correlated nodes.

The last scenario is crucial. Dual sourcing does not provide effective redundancy if both suppliers share a sub-tier, region, utility or logistics corridor. Independence must be tested rather than assumed.

5. A disciplined mapping workflow

A professional mapping exercise can follow these stages:

1. Define purpose and scope. Specify product, process, geography, time horizon, stakeholders and decision criteria.
2. Assemble evidence. Collect enterprise-resource-planning data, bills of material, contracts, purchase orders, logistics records, quality data, site lists, system inventories and incident history.
3. Build the baseline map. Show nodes, tiers, sites, routes, flows, owners and known quantities.
4. Validate with stakeholders. Conduct workshops, interviews and supplier confirmation; record disagreements and unknowns.
5. Trace critical products and services. Follow part genealogy, information interfaces and enabling dependencies beyond tier 1.
6. Identify failure modes. Examine capacity loss, quality failure, cyberattack, delay, insolvency, regulatory change, natural hazard, labour disruption and ethical breach.
7. Assess and prioritise. Use impact, likelihood, time-to-impact, substitutability, detectability and control effectiveness.
8. Design treatments. Consider qualification of alternatives, inventory, route changes, contractual provisions, monitoring, engineering redesign and collaborative supplier development.
9. Test and maintain. Use simulations, audits, exercises, incident reviews and change triggers to update the map.

The process should be iterative. A new product, supplier, plant, enterprise system, regulation or geopolitical condition can invalidate an earlier map.

Applied case: illustrative medical-device component network

Background

MedSure Devices assembles infusion pumps in Country A. A pump contains a moulded housing, a pressure sensor, a controller board and a specialised adhesive. The company buys the four items from three tier-1 suppliers. Management initially believes the network is diversified because the housing and board have two approved suppliers.

Problem

A port closure delays the pressure sensor. At the same time, a cyber incident interrupts the supplier portal. Planners cannot obtain reliable shipment status, and production is forecast to stop in six days. A rapid supplier-list review does not explain why the second sensor source cannot replace the first.

Analysis and mapping

The team constructs a product-specific, multi-tier map. It discovers that both tier-1 sensor suppliers purchase the same ceramic element from one tier-2 producer. That producer uses a single specialised calibration service. The two housing suppliers are geographically separate but share one resin producer. The adhesive is available from two distributors, but only one manufacturer is qualified for medical use.

The team maps material, information and regulatory flows. It also identifies the supplier portal as a shared information dependency and records inventory by usable batch rather than total book quantity. Interviews reveal that sensor qualification requires a documented validation cycle of approximately eight weeks.

The bottleneck analysis shows that the sensor is not the highest-volume component, but it is a unique, regulated input with a time-to-impact of six days and a recovery time far beyond six days. The apparent dual sourcing is therefore not independent redundancy.

Approach and solution

Immediate actions include prioritising existing finished-goods inventory, manually confirming shipment information through an authenticated backup channel, and allocating sensors to the most critical customer orders. Medium-term actions include qualifying a genuinely independent ceramic-element source, holding a risk-based buffer, and adding an alternate calibration provider. The company also requires tier-1 suppliers to disclose material sub-tier changes and tests portal failover during continuity exercises.

Outcome

The immediate response prevents an uncontrolled line shutdown, although lower-priority orders are delayed. Within six months, the organisation has a validated sub-tier map for critical components, an information-system contingency process and a governance rule requiring reapproval when a critical sub-tier changes. Management also revises its supplier-diversification metric to measure independent capability rather than supplier count.

Learning points

The case demonstrates that tier-1 visibility is insufficient, supplier count can exaggerate resilience, and information flows are operational dependencies. It also shows why criticality depends on substitutability, qualification time and time-to-impact—not volume alone.

Governance, ethics and technology

Mapping involves commercially sensitive information, including supplier identities, capacities, prices, personal contact data and security architecture. Access should follow least privilege, with clear ownership, retention rules, secure transmission and defined use. Suppliers should understand why data are requested and how confidentiality, competition law and contractual rights will be protected. Organisations should not use risk transparency as a pretext for unfairly shifting all responsibility or imposing disproportionate audit costs on smaller suppliers.

Modern supply-chain platforms can link enterprise-resource-planning records, geographic information, shipment events, supplier questionnaires, bills of material and external alerts. Graph databases are useful for representing many-to-many relationships and tracing shared sub-tiers. Artificial intelligence can classify documents, detect unusual lead-time patterns and suggest links for investigation. It should not be treated as an authoritative source: opaque inferences, stale data, false positives, biased training data and fabricated relationships are material risks. Human validation, provenance, confidence labels and audit trails remain necessary.

Contemporary mapping increasingly includes climate hazards, human-rights due diligence, forced-labour indicators, carbon-intensive processes, water stress, cyber dependencies and geopolitical exposure. These dimensions should be integrated with operational mapping rather than maintained as unrelated registers, because the same node may be simultaneously a continuity, environmental and ethical concern.

Challenges and limitations

No map is complete. Suppliers may not know their own sub-tier network, may resist disclosure, or may report nominal rather than effective capacity. Commercial relationships change rapidly, and data standards differ across organisations. Physical and digital maps can become inconsistent. A highly detailed map can create maintenance burden, while a simplified map can conceal decisive dependencies.

Risk scores can create false precision, especially when ordinal scales are multiplied. Historical frequency may be a poor guide to unprecedented events or correlated disruption. Audits may encourage compliance theatre, and interviews may reflect incentives or organisational silos. Network metrics may privilege connectivity over uniqueness. These limitations require triangulation: compare records, interviews, audits, event data, supplier evidence and scenario analysis; state assumptions explicitly; and prioritise verification of high-consequence unknowns.

Best-practice checklist

• Map products and services, not only legal suppliers.
• Trace critical inputs beyond tier 1 and identify shared sub-tiers.
• Separate material, information, financial and reverse flows.
• Record site, geography, ownership, capacity, lead time and qualification constraints.
• Identify enabling dependencies such as utilities, systems, people and logistics hubs.
• Distinguish theoretical capacity from effective capacity.
• Test whether alternatives are genuinely independent and available within the required time.
• Link every major risk to a node, flow, owner, control and review trigger.
• Record confidence and unknowns instead of hiding uncertainty.
• Protect sensitive data and involve suppliers fairly.
• Use technology to improve traceability, not to replace professional judgement.
• Update maps after incidents, changes, exercises and horizon-scanning signals.

Chapter Summary

Supply-chain mapping provides a structured view of nodes, links, processes, dependencies and material, information, financial and reverse flows. Effective mapping is multi-tier, product-specific and evidence-based. Process maps reveal activities and hand-offs; value-stream maps expose waiting, inventory and flow constraints; supplier and dependency maps reveal sub-tier, infrastructure and digital exposure; audits and interviews validate documented and tacit knowledge; and horizon scanning identifies emerging threats.

Criticality depends on more than transaction volume. Bottlenecks, unique capability, concentration, substitutability, qualification time and time-to-impact must be considered together. Risk registers convert map evidence into accountable statements containing causes, events, consequences, controls, ratings, treatments and triggers. Qualitative scores support prioritisation but do not create precise probabilities. Governance must address confidentiality, fairness, data quality and human oversight, particularly when AI and external data are used. The map is a living management instrument that must be tested and updated as the network changes.

Key Terms

Supply chain map: A structured representation of network nodes, links, processes, flows and dependencies.

Tier: A supplier’s production or commercial distance from the focal organisation.

Node: A participant, site, asset, system or service in a supply network.

Link: A physical, digital, financial, contractual or regulatory connection between nodes.

Material flow: Movement of inputs, work-in-process, finished goods, returns or waste.

Information flow: Movement of forecasts, orders, specifications, status and control data.

Dependency: A resource or capability required for an activity to function.

Critical node: A node whose disruption can materially impair objectives and is difficult to replace.

Bottleneck: A resource or activity that constrains throughput.

Single point of failure: A dependency with no viable alternative within the required recovery period.

Concentration risk: Exposure created by clustering supply, capability or routes.

Value-stream mapping: A method showing end-to-end material and information flow, including delay and waste.

Risk event: A possible occurrence that may affect an objective.

Vulnerability: A condition that increases susceptibility to a threat.

Risk register: A controlled record of risks, controls, owners, ratings and treatments.

Time to impact: Time between dependency loss and unacceptable service or production effect.

Recovery time objective: Maximum acceptable time for restoring a process or service.

Horizon scanning: Structured examination of emerging signals and external changes.

Residual risk: Exposure remaining after controls are applied.

Review Questions

Short Answer Questions

1. Why is a tier-1 supplier list insufficient for supply-chain risk identification?
2. Distinguish a bottleneck from a single point of failure.
3. What are the four major flows that should be considered in a supply-chain map?
4. Why should confidence and unknowns be recorded on a map?
5. What is the purpose of a risk register?

Long Answer Questions

1. Explain how process mapping and value-stream mapping complement each other in risk identification.
2. Describe a structured workflow for building and maintaining a multi-tier supply-chain map.
3. Discuss why supplier count is an unreliable measure of resilience.
4. Explain the roles and limitations of audits, interviews and horizon scanning.
5. Evaluate the governance and ethical issues associated with digital supply-chain mapping.

Analytical / Application Questions

1. A three-stage process has effective capacities of 1,200, 850 and 1,000 units per day. Identify the bottleneck and explain what additional evidence is needed before classifying it as a critical node.
2. A company has 3,000 usable units and average demand of 500 units per day. Calculate inventory cover and assess whether it protects a disruption whose recovery time is ten days. State the assumptions and recommend actions.
3. Two suppliers appear independent, but both rely on the same tier-2 producer and logistics corridor. Construct a risk statement and propose at least three treatments that would improve genuine redundancy.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of multi-tier supply-chain mapping?

A. To list only suppliers with direct purchase contracts

B. To identify network participants, flows and dependencies beyond immediate suppliers

C. To calculate product selling prices

D. To replace all supplier audits

Correct Answer: B. To identify network participants, flows and dependencies beyond immediate suppliers

Question 2

In a serial process with effective capacities of 900, 700 and 850 units per day, what is the maximum steady-state throughput before other constraints?

A. 700 units per day

B. 750 units per day

C. 850 units per day

D. 900 units per day

Correct Answer: A. 700 units per day

Question 3

Which item is an information flow?

A. A shipment of components

B. A returned defective product

C. A production forecast sent to a supplier

D. A customs duty payment

Correct Answer: C. A production forecast sent to a supplier

Question 4

What makes a supplier diversification strategy potentially misleading?

A. The suppliers use different invoice formats

B. The suppliers share a critical sub-tier or logistics corridor

C. The suppliers have different sales contacts

D. The suppliers operate under different purchase orders

Correct Answer: B. The suppliers share a critical sub-tier or logistics corridor

Question 5

If usable inventory is 2,400 units and demand is 600 units per day, what is inventory cover under the stated assumptions?

A. 2 days

B. 3 days

C. 4 days

D. 6 days

Correct Answer: C. 4 days

Question 6

Which statement about the score Score = L × I is most accurate?

A. It is always a precise probability of loss

B. It is a ranking aid based on assigned likelihood and impact categories

C. It eliminates the need for expert judgement

D. It proves that low-frequency catastrophic risks are unimportant

Correct Answer: B. It is a ranking aid based on assigned likelihood and impact categories

Question 7

Which method is especially useful for revealing waiting, inventory and non-value-adding activity across an end-to-end flow?

A. Value-stream mapping

B. Invoice reconciliation

C. Market segmentation

D. Financial budgeting

Correct Answer: A. Value-stream mapping

Question 8

What is the principal purpose of horizon scanning?

A. To guarantee prediction of future events

B. To identify emerging external signals that may alter exposure

C. To approve supplier invoices

D. To measure employee productivity only

Correct Answer: B. To identify emerging external signals that may alter exposure

Question 9

A recovery time objective is longer than the time to impact. What does this imply?

A. No treatment is necessary

B. A temporary bridge such as inventory or substitution may be required

C. The dependency is automatically low risk

D. The risk register should be deleted

Correct Answer: B. A temporary bridge such as inventory or substitution may be required

Question 10

Which is an appropriate governance practice when using AI to support supply-chain mapping?

A. Accept every inferred relationship without review

B. Remove data provenance to simplify the map

C. Use human validation, confidence labels and audit trails

D. Share all supplier data publicly

Correct Answer: C. Use human validation, confidence labels and audit trails