The Supplier Nobody Mapped
Northwind Medical assembles infusion pumps from 340 purchased components. The supply chain team has tier-one supplier agreements with recovery commitments, and 92 percent of tier-one suppliers have signed business continuity attestations. During a tabletop exercise, a participant asks what happens if the tubing connector supplier's own resin supplier fails. Nobody in the room knows who that resin supplier is. Procurement explains that tier-two visibility was deemed too expensive to contract for, and that tier-one contracts require suppliers to manage their own sub-tier risk. Six months later, a resin plant fire in another country halts connector production for eleven weeks. Northwind discovers it has 19 days of connector inventory and no qualified alternate source; qualification of a new connector takes roughly 20 weeks because of regulatory submissions.
1. Was the tier-one attestation approach adequate? Justify your answer using the specifics of this case.
Read the worked answer
No. The attestation approach answered a documentation question, not a resilience question, and the case shows exactly where the gap sat.
The attestations covered 92 percent of tier-one suppliers, which sounds strong until you ask what they attest to. A signed commitment that a supplier will manage its own sub-tier risk transfers the paperwork, not the risk. Northwind retained the consequence: an eleven-week outage caused by a party it had never identified. The program measured supplier preparedness by count of signatures rather than by demonstrated capability at the points where its own production actually depends.
The deeper failure is that the risk assessment never traced the bill of materials to single points of failure. A 340-component pump with a 19-day inventory buffer on a component that takes 20 weeks to requalify is a structural exposure regardless of what any supplier signed. That combination - short buffer, long requalification, no alternate - should have been flagged as a critical dependency and either buffered, dual-sourced, or accepted with a documented decision by the business owner.
The exercise did surface the question, which is a credit to the program, but the answer was treated as a procurement policy matter rather than escalated as an identified risk. When an exercise reveals an unknown critical dependency, the correct response is to investigate it, not to explain why investigating it was deemed too expensive. The cost of the fire almost certainly exceeded the cost of the visibility that was declined.
2. What should Northwind change in its supplier resilience program, and in what order?
Read the worked answer
Sequence matters because resources are finite and the organization has just been through a disruption.
First, do a dependency mapping pass focused on the highest-consequence components, not all 340. Identify components that combine long requalification lead time, low inventory coverage, and single-source status. The connector would have topped that list; there are probably a handful of others. This is a bounded exercise that can be completed in weeks, not a multi-year supplier-visibility program.
Second, for each flagged component, choose a deliberate treatment: qualify a second source, increase buffer inventory to cover the requalification horizon, or hold strategic stock at the supplier under a consignment arrangement. Each has a cost, and the business owner should choose among them with the trade-offs visible.
Third, revise supplier agreements so that critical-path suppliers must disclose sub-tier sources for specified components and notify Northwind of changes. Blanket sub-tier transparency is expensive; targeted transparency for the flagged components is affordable and proportionate.
Fourth, change the attestation metric. Replace "percent of suppliers signed" with "percent of critical dependencies with a tested continuity capability," and validate a sample through evidence rather than signatures.
Finally, feed the resin fire into the risk register with its actual financial and clinical impact, and use that documented impact to justify the budget that was previously declined. Lessons learned that do not change funding decisions tend not to change anything.