Supply-Chain Risk for Small Businesses: Map, Rank and Back Up

Small and midsize businesses depend on suppliers they do not control: the distributor that ships parts, the software provider that runs invoicing, the one regional company that services a critical machine. When one of them fails, the problem lands on you.

Size makes this harder. A NIST Manufacturing Extension Partnership (MEP) guide written for smaller manufacturers says plainly that they "continue to be more vulnerable to global supply chain disruptions than larger companies," in part because they may not be able to absorb short-term losses or thinner margins. FEMA's Ready Business guidance makes the same point more broadly: operations "may also be interrupted by the failure of a supplier of goods or services or delayed deliveries."

The good news is that supply-chain risk management does not require a large procurement team. It requires knowing what you depend on, ranking it honestly and preparing a few well-chosen backups. This guide lays out a five-step approach.

Step 1: List everything you depend on

Start with a plain inventory. Include physical suppliers, but also services and technology. The Cybersecurity and Infrastructure Security Agency (CISA), summarizing a resource guide from its information and communications technology supply chain task force, advises identifying the suppliers that have access to, or provide, hardware or software to your business, including cloud services. CISA notes that although that guide focuses on technology sectors, it is relevant for small businesses in any industry.

For example, imagine a hypothetical 12-person heating and cooling contractor. Its list might include two equipment distributors, a refrigerant supplier, a fleet maintenance shop, a scheduling and dispatch app, a payment processor and an answering service. Several of those would not appear on a list of "parts suppliers," yet any one of them going down would stop or slow the business.

Step 2: Map beyond your direct suppliers

Your direct suppliers have suppliers too, and that is where hidden dependencies live. The NIST MEP guide says the most common approach to mapping is to use the bill of materials to drill down on your top five products by revenue, looking at component and raw material suppliers. A mapping process might include:

• Learning where suppliers and their suppliers are located
• Researching suppliers to understand risks tied to the company and to external factors
• Conducting a risk assessment

The guide adds that experts suggest analyzing as many tiers as possible, "because there may be hidden critical suppliers that manufacturers are not aware of." For each key supplier, it recommends capturing the activities performed at the primary site, any alternative sites that could perform the same activity, and how long it would take to begin shipping from the alternate site.

If you are not a manufacturer, apply the same idea to your top revenue-producing services. Ask your most important suppliers directly where their key inputs come from and what their own backup plans are.

Step 3: Rank suppliers by impact

Not every supplier deserves the same attention. Rank them by what their failure would do to you, using the same lens as a business impact analysis. FEMA's Ready Business guidance lists interruption of the supply chain, including failure of a supplier or disruption of transportation, as one of the disruption scenarios a business impact analysis should consider, and notes that timing matters: a disruption just before your busiest season costs far more than the same disruption in a slow month.

Useful questions for ranking include:

• Is this the only source, or are there ready alternatives?
• How long could we operate without it, using stock on hand or a workaround?
• How long would it take to qualify a replacement?
• What share of revenue depends on it?

The NIST MEP guide also suggests looking at the supplier itself. Does it have the capacity to meet your current needs and to grow with you? Is it financially stable? The guide lists losing customers, lawsuits and the loss of key personnel as external indicators of financial risk, and asks whether, if you place smaller orders, a supplier might prioritize other orders ahead of yours.

Step 4: Choose proportionate responses

Once you know your highest-impact dependencies, decide what to do about each. Common options include:

• Add a second source. CISA advises maintaining a diverse supplier base when possible, because "relying on a single critical supplier can increase risk if critical products or services become unavailable." The NIST MEP guide describes multi-sourcing as adding redundancy "to minimize risk while increasing options."
• Hold more buffer stock. NIST MEP lists increasing safety stock, alongside identifying secondary or alternative suppliers, as an example of a supply chain risk management plan.
• Revisit just-in-time habits. The MEP guide does not reject lean principles, but suggests the right question may be "what's the healthiest approach for us right now?"
• Compare total cost, not just unit price. NIST MEP describes total cost of ownership as considering costs beyond the purchase price, such as freight, longer lead times and higher inventory costs, as well as risks like lost sales.
• Check your insurance. FEMA notes that contingent business interruption coverage is available to reimburse losses caused by a supplier failure.

Be proportionate. Redundancy costs money, so spend it where a failure would hurt most. An action list from MIT Sloan Management Review, summarized in the NIST MEP guide, captures the spirit, for example: use redundant suppliers for high-volume parts and less redundancy for lower-volume parts.

Step 5: Build supplier risk into routine business

The final step is to make this ongoing rather than a one-time project. CISA's summary of the resource guide includes several practices that translate to any small business:

1. Evaluate vendors before buying, and have suppliers attest to specific risk management practices at the outset and regularly afterward.
2. Develop a contingency plan for supply chain disruptions, including alternative suppliers and backup plans.
3. Train employees so they understand their role in managing supply chain risk.
4. Continuously monitor and improve the program so it stays relevant.

For monitoring, the NIST MEP guide recommends a small set of key performance indicators, measuring two or three key metrics such as supply chain risk and quality performance, and using standard measures such as on-time delivery where relevant. It notes that these indicators are lagging, so pair them with regular conversations with key suppliers about what is changing on their end.

Finally, connect supplier risk to your broader continuity plan. If a critical supplier fails, your business continuity plan should already say who decides on a switch, which alternate supplier to call and what workaround keeps customers served in the meantime. Our guide Business Continuity Planning Basics: A FEMA Ready Business Walkthrough covers how to set up that plan.

Key takeaways

• List every dependency, including software, cloud and service providers, not just physical suppliers.
• Map critical suppliers beyond the first tier to find hidden single points of failure.
• Rank suppliers by the impact and timing of their failure, and check their capacity and financial health.
• Use proportionate responses: second sources, safety stock, total-cost comparisons and contingent business interruption coverage.
• Make supplier risk routine through vendor evaluation, contingency plans, training and a few tracked metrics.

Sources

• National Institute of Standards and Technology, Manufacturing Extension Partnership, How Small Manufacturers Can Develop Risk Management Strategies for their Supply Chains (October 1, 2021)
• National Institute of Standards and Technology, Manufacturing Extension Partnership, Supply Chain
• Cybersecurity and Infrastructure Security Agency, Developing a Resilient SCRM Plan for Small and Medium-Sized Businesses Fact Sheet
• Ready.gov (FEMA), Getting Ready to Plan
• Ready.gov (FEMA), Business Impact Analysis
• Ready.gov (FEMA), Risk Mitigation