Organisations can improve supply chain resilience by taking a structured and proactive approach to understanding their dependencies, identifying vulnerabilities and strengthening the way they manage third-party relationships.

This has become a strategic priority rather than a specialist procurement concern. The BCI Supply Chain Resilience Report 2024 found that almost 80% of organisations had experienced supply chain disruption during the previous 12 months.

The World Economic Forum’s Global Value Chains Outlook 2026 describes an era of “structural volatility”, in which geopolitical tension, climate pressures, technological change and industrial policy are creating persistent uncertainty. It also reports that 74% of business leaders view resilience as a driver of growth.

Against this backdrop, resilience is not simply about preventing interruption. It is about giving the organisation enough visibility, flexibility and tested capability to continue delivering its most important products and services when part of the supply network fails.

What does supply chain resilience involve?

A resilient supply chain is not necessarily one that avoids every disruption. No organisation can eliminate all supplier, geopolitical, cyber, logistical or climate-related risk.

Instead, resilience depends on knowing which disruptions would matter most, recognising where the organisation is exposed and having credible options for responding. Those options might include alternative suppliers, substitute materials, additional capacity, strategic stock, contractual recovery arrangements or temporary changes to service delivery.

1. Identify critical supplier dependencies

The first step is to determine which suppliers, products, services and resources are essential to the organisation’s priority activities.

This assessment should be informed by a Business Impact Analysis. A BIA establishes which activities are time-critical, how quickly they must be restored and which people, technologies, premises, information and third parties they depend upon.

Not every supplier requires the same level of attention. A supplier should generally be treated as critical when its failure could:

• interrupt a priority product or service;
• prevent the organisation from meeting an important recovery objective;
• cause significant financial, safety, legal or regulatory consequences;
• affect several business areas simultaneously; or
• prove difficult to replace within an acceptable timeframe.

This prioritisation allows assurance and resilience investment to be focused where disruption would cause the greatest harm.

2. Find concentration risks and single points of failure

Many organisations depend heavily on a small number of suppliers without fully recognising the extent of that concentration. The same supplier may support several departments, brands or services, while apparently different suppliers may depend on one manufacturer, cloud provider, logistics hub or geographic region.

These hidden connections can create a single point of failure. If the common dependency is disrupted, multiple parts of the organisation may be affected at once.

Useful areas to examine include:

• sole-source and single-source purchasing;
• suppliers serving several critical business activities;
• common subcontractors or technology platforms;
• dependence on one country, region, port or transport route;
• specialist components with long replacement lead times;
• limited internal expertise or intellectual property ownership; and
• contractual arrangements that do not guarantee priority during widespread disruption.

The consequences of an overlooked single point of failure can be seen in Needhams’ medical cement shortage case study, where disruption to a specialist manufacturing process affected healthcare supply across several countries.

3. Map beyond immediate suppliers

Tier 1 suppliers are the organisations with which a business contracts directly. However, disruption often begins further down the chain with a subcontractor, component manufacturer, raw-material provider or technology service that the customer cannot immediately see.

Effective supplier mapping should therefore extend beyond Tier 1 where the dependency and potential impact justify it. The aim is not to map every link indiscriminately, but to understand the deeper network supporting the organisation’s most important products and services.

The UK National Cyber Security Centre’s supply chain mapping guidance recommends maintaining an up-to-date understanding of suppliers, what they provide and how those products or services are delivered.

4. Assess supplier continuity capability

Supplier resilience should be assessed before appointment and throughout the contract lifecycle. The level of scrutiny should reflect the supplier’s criticality and the consequences of failure.

Organisations may ask critical suppliers to provide:

• business continuity policies and plans;
• recovery objectives and evidence supporting them;
• details of alternative sites, systems, people or production capacity;
• recent exercise reports and improvement actions;
• incident and outage history;
• subcontractor and fourth-party assurance arrangements;
• independent audit or certification evidence; and
• notification and crisis communication procedures.

Recognised standards can provide a useful reference point. ISO/TS 22318:2021 gives specific guidance on applying business continuity principles to supplier relationships and supply chain continuity. Critical suppliers may also be asked to align with or certify against ISO 22301.

Certification can strengthen confidence, but it should not replace supplier-specific due diligence. The organisation still needs to establish whether the supplier’s recovery capability meets its own operational requirements. Needhams provides support with both supply chain resilience and ISO 22301 certification and implementation.

5. Validate claims rather than collecting documents

A continuity plan demonstrates intent, but it does not prove that the supplier can recover as expected. Plans may be incomplete, based on outdated assumptions or dependent on resources that would not be available during a widespread incident.

Supplier assurances should therefore be validated proportionately through:

• structured continuity questionnaires and evidence reviews;
• interviews with operational and continuity personnel;
• site visits or remote walkthroughs;
• independent audits and certification reviews;
• joint tabletop exercises;
• technical or operational recovery tests; and
• reviews of actual incidents and lessons learned.

Particular attention should be paid to the assumptions connecting the supplier’s plan to the customer’s plan. For example, a supplier may expect to restore service within five days while the customer needs it within 24 hours. Both plans may appear credible independently, but the combined arrangement would fail to meet the business requirement.

6. Exercise disruption scenarios with suppliers

Exercises help organisations determine whether response arrangements, recovery strategies and communication routes will work under pressure. They also reveal misunderstandings about responsibilities, priorities and decision-making authority.

Useful supply chain exercise scenarios include:

• loss of a critical supplier or manufacturing site;
• failure of a common technology or cloud provider;
• a cyber incident affecting a supplier and its customers;
• closure of a port, border or transport route;
• shortage of a specialist component or raw material;
• insolvency of a strategic supplier; and
• simultaneous demand surges across several customers.

Joint exercises are particularly useful because they test coordination across organisational boundaries. Needhams’ business continuity and crisis simulation exercises can be designed to examine these practical interdependencies.

7. Build credible alternatives

Diversification can reduce dependence on one supplier, but adding another supplier does not automatically remove the risk. Two suppliers may use the same subcontractor, production region, software platform or logistics route.

Alternatives need to be assessed and made usable before disruption occurs. This may involve:

• pre-qualifying secondary suppliers;
• agreeing contracts and minimum capacity in advance;
• testing substitute materials or components;
• maintaining appropriate strategic stock;
• designing products or processes so alternatives can be introduced;
• retaining internal knowledge needed to transfer supply; and
• documenting the authority and process for activating contingency arrangements.

The correct solution will depend on the impact of disruption, recovery timescale, availability of alternatives and cost of maintaining the option. In some cases, additional stock may be appropriate. In others, redesigning a service or reducing recovery time at the existing supplier may offer better value.

8. Collaborate with critical suppliers

Resilience is stronger when supplier relationships support honest and timely communication. A purely transactional relationship may discourage suppliers from raising emerging problems until they have already become incidents.

Regular reviews, shared risk assessments, early-warning arrangements and joint exercises can help both parties understand their dependencies and develop more coordinated responses. Organisations should also make their recovery priorities and minimum service requirements clear, rather than expecting suppliers to infer them from a general contract.

9. Integrate supply chain resilience into governance

Supply chain resilience should not sit solely within procurement. Procurement teams may manage the commercial relationship, but business owners understand operational requirements, continuity teams define recovery needs, cyber teams assess technology risk and senior leaders determine risk appetite and investment priorities.

A joined-up governance model should establish:

• who owns each critical supplier relationship;
• who can accept supplier-related risk;
• how critical suppliers are identified and reviewed;
• which resilience standards and evidence are required;
• how concerns are escalated;
• how incidents are communicated and managed; and
• how lessons and improvements are tracked.

Supply chain dependencies should also be included within the organisation’s wider operational resilience and business continuity framework. This ensures that supplier arrangements are assessed against the same important business services, impact tolerances and recovery priorities used elsewhere in the organisation.

A practical supply chain resilience cycle

How often should supply chain resilience be reviewed?

Critical supplier information should be monitored continually and reviewed formally at planned intervals. An annual review may be suitable for stable relationships, but higher-risk suppliers may need more frequent assessment.

An additional review should be triggered when:

• a supplier, subcontractor or delivery model changes;
• a new product, technology or business service is introduced;
• an incident exposes an unexpected dependency;
• the organisation’s recovery requirements change;
• the supplier experiences financial or operational difficulty;
• geopolitical, environmental or regulatory conditions change; or
• an exercise identifies a significant weakness.

In summary

Improving supply chain resilience requires more than requesting continuity plans from suppliers. Organisations need to understand which third parties support their most important activities, map hidden dependencies, identify concentration risks and verify that recovery arrangements are credible.

Resilience is strongest when continuity requirements are built into supplier selection, contracting, assurance, exercising and ongoing governance. This gives the organisation a clearer view of its exposure and practical options when disruption occurs.