Strong supplier performance can encourage buyers to consolidate spend, gradually increasing dependence on a single source even as service and quality improve. Managing concentration requires procurement to measure replacement capability, capacity and upstream dependencies alongside traditional supplier scorecards.
Performance Scores Can Conceal Dependency
Supplier scorecards typically measure current execution: delivery, quality, responsiveness, cost and compliance. Those indicators help identify operational problems, but they do not reveal the commercial consequences of losing a supplier. A vendor can lead every performance measure while also representing the category’s largest continuity exposure.
Dependency often develops gradually. Strong performance attracts additional volume, while competing suppliers receive fewer orders and have less incentive to reserve capacity. Engineering teams may adapt specifications to the preferred supplier’s processes, and recurring renewals can reduce competitive tension. Eventually, the apparent efficiency gain is supported by an increasingly narrow set of alternatives.
An illustrative category with three suppliers shows the mechanism. If the strongest vendor consistently delivers 98% on time, compared with 94% and 91% for its competitors, reallocating volume appears commercially rational. If that supplier ultimately receives 80% of demand, however, its failure could overwhelm the residual capacity available elsewhere. The purchasing decision has improved average performance while increasing the potential severity of disruption.
Spend share is only the starting point. A category-level concentration measure, including an adapted Herfindahl-Hirschman Index of the type used in competition analysis, can reveal cumulative dependency across suppliers. It must be combined with operational measures such as qualification lead time, available tooling, approved production sites, inventory cover and the capacity that alternative suppliers can release at short notice.
Contracts and Capacity Need Explicit Guardrails
Concentration thresholds should be established by category rather than imposed as a single enterprise rule. A high-volume office services contract can usually be transferred more quickly than a regulated component requiring customer approval, validated tooling or technical testing. The acceptable level of dependency therefore depends on business impact and time-to-switch, not spend alone.
Contracts can turn continuity planning into enforceable commercial architecture. Allocation rights, capacity reservations, emergency communication requirements, audit provisions and access to tooling or technical documentation can reduce uncertainty during disruption. Where indexed pricing or volume commitments are offered in return, the buyer must test whether those concessions produce credible capacity access rather than an unenforceable expectation of preferential treatment.
Alternative suppliers also require active maintenance. A nominal second source provides little protection if it lacks current specifications, qualified materials or sufficient economics to remain engaged. Giving backup suppliers limited recurring volume, preserving qualification status and documenting ramp-up lead times may carry a visible cost, but it protects against the much larger margin and service consequences of an extended shutdown.
Scenario exercises can test whether those controls work. A 30-day outage, a 50% capacity reduction or the loss of transport from a supplier’s region should be translated into affected products, customers, revenue and inventory. That analysis creates a defensible basis for deciding whether to dual-source, hold stock, fund additional tooling or accept the exposure.
Upstream Opacity Is The Next Concentration Test
The least visible dependency may sit beyond the contracted supplier. Several apparently independent vendors can rely on the same sub-tier manufacturer, technology platform, port or raw-material source. EU NIS2 rules also place supply-chain security within the risk-management obligations of covered entities, increasing the importance of third-party cyber dependencies. Concentration governance must therefore test common upstream nodes, not merely count direct suppliers; otherwise, diversification can exist on a sourcing chart while operational exposure remains unchanged.