Nothing in the research behind this guide says dual sourcing always beats single sourcing. Supply-chain risk is several different risks, and each needs a different response. Preventing a disruption and responding after it are not substitutes: the best mix depends on how likely and how long a disruption is and on your cost structure, and relying on one strategy is usually worse than a portfolio. Map your dependencies first, then choose between buffering and bridging deliberately.
Published · Updated
Supply-chain risk can be split into breaks, delays, forecast errors, procurement, receivables, inventory and capacity risks, and each needs a different mitigation. A single generic risk register, or a single buffer, will misallocate effort. The split is a practitioner framework: it helps structure judgment but does not quantify the risks or prescribe how much buffer to hold.
Mitigation reduces the chance or impact of a disruption; contingency is the response after it occurs. They are not substitutes to choose between once. The best mix depends on how likely and how long disruptions are and on the firm's cost structure, and relying on a single strategy is usually dominated by a portfolio. This result comes from a model with illustrative parameters; real disruption likelihoods are hard to estimate and supplier behaviour is more complex than the model.
Firms that experienced supply-chain disruptions underperformed matched peers over the following years and carried higher equity risk, and the damage lasted beyond the announcement window. That points to disruption impairing operations and confidence for longer than the event itself. The study is observational: unobserved differences may contribute to both the disruption and the underperformance.
The same event can cripple one network and be absorbed by another, because of visibility, flexibility, collaboration and buffering. The resilience framework therefore assesses both vulnerabilities and capabilities rather than prescribing maximum inventory or multiple suppliers. A related view puts resilience in a combination of redundancy and flexibility, supported by a culture that takes disruption seriously and practises the response.
For a single-sourced item the questions are concrete: what is the consequence if this supplier fails, how long would the gap last, what can bridge it (stock, a qualified alternative, a design change), and what does each cost to keep ready?
These steps come from the Supply chain and supplier resilience playbook. Each has a checkpoint you can observe.
Map tier-one and critical tier-two suppliers, sites, ports and shared services. For each, estimate the operational impact and the time to recover if it stopped.
CheckpointA dependency map with the ten highest-impact exposures and a recovery-time estimate for each.
Common failureCounting suppliers as if two sources in the same region were independent.
Classify suppliers by spend, criticality and performance. For strategic or constrained suppliers, set a joint improvement plan; for replaceable poor performers, qualify an alternative.
CheckpointEvery critical supplier has a named strategy, owner and review date.
Common failureApplying a standard scorecard to every supplier and changing nothing.
For each top exposure, compare the cost and recovery time of a buffer (stock, capacity, dual source) against a bridging action (collaboration, visibility, flexible routing).
CheckpointA decision per exposure with cost, recovery time and the failure mode it addresses.
Common failureBuying inventory for every risk, including the ones inventory cannot cover.
Run a tabletop or simulation of the most plausible disruption. Walk through detection, decision rights, customer communication and recovery, and fix the gaps you find.
CheckpointA rehearsed response with named decision rights and a measured recovery time.
Common failureKeeping the continuity plan in a folder that nobody has opened.
These sources are a taxonomy, conceptual frameworks, a model with illustrative parameters and an observational study. None gives the point at which a second supplier pays back; that depends on the likelihood and length of disruption and on your costs, which you have to estimate.
Each finding below is quoted from Portolan's research library, with the limits the library records for it. Applying a result from another setting, such as a hospital or a factory, to yours is an analogy, not a proof.
Supply-chain risk is not one thing: the authors distinguish breaks, delays, forecast errors, procurement, receivables, inventory and capacity risks. Each needs a different mitigation, so a generic risk register or a single buffer will misallocate effort.
Where it stops. The taxonomy is a practitioner framework; it helps structure judgment but does not quantify the risks or prescribe optimal buffers.
Mitigation (reducing the chance or impact of a disruption) and contingency (responding after it occurs) are not substitutes to choose between once; the best mix depends on disruption likelihood, duration and the firm's cost structure. Relying on a single strategy is usually dominated by a portfolio.
Where it stops. The analysis is model-based with illustrative parameters; real disruption likelihoods are hard to estimate and supplier behaviour is more complex than the model.
Firms that experienced supply-chain disruptions underperformed matched peers over the following years and carried higher equity risk. The damage persisted beyond the announcement window, suggesting disruptions impair operations and investor confidence for longer than the immediate event.
Where it stops. The study is observational and compares disrupted firms with matched peers; unobserved differences may contribute to both disruption and underperformance.
Resilience is framed as a balance between vulnerabilities and capabilities: the same event that cripples one network is absorbed by another because of visibility, flexibility, collaboration and buffering. The framework assesses both sides rather than prescribing maximum inventory or multiple suppliers.
Where it stops. A conceptual framework, not a causal test of resilience investments. Scores depend on the quality of the risk assessment behind them.
Resilience comes from a combination of redundancy and flexibility, supported by a culture that takes disruption seriously and practises response. Firms that build these capabilities before a crisis can turn disruption response into a competitive advantage.
Where it stops. The article synthesises cases and practitioner experience rather than controlled evidence; resilience investments are hard to value before an event.