The Single-Source Component and the CFO's Arithmetic

Expected value is a sound tool for frequent, independent, bounded losses that average out. This risk violates all three conditions.

• It is not a recurring annual coin-flip. The relevant question is exposure over the life of the dependency and the qualification cycle. At 3 per cent a year, the chance of at least one disruption over ten years is 1 − 0.97¹⁰ ≈ 26 per cent - a one-in-four chance of a $6.2m loss, not a $186,000 line item.
• The loss is not bounded at $6.2m. The four-week estimate is the supplier's best case for a flood event; and the model excludes customer defection, which is an uninsurable revenue loss several times larger than the disruption itself.
• The comparison is wrong. $186,000 expected loss against a $300,000 one-off cost compares a recurring exposure with a capital investment that also yields value across future years and other products.

The deeper flaw: expected value averages away ruin. An organisation can survive a bad year; it may not survive losing its two anchor customers. Decision rules for ruin-adjacent risk are not EV rules.

A layered portfolio, sequenced cheapest-first, with residual risk quantified at each layer:

1. Buffer stock. Four to six weeks of the component is a low five-figure working-capital commitment and buys the time needed for any other action. Fastest lever, available this quarter.
2. Contract and insurance. Confirm whether contingent business interruption cover responds to a supplier flood, and check what the contract actually requires of the supplier - BCP evidence, notification, alternate-site obligations, and critically who owns the tooling, because tooling ownership is what lets you move production in a crisis.
3. Stress the assumption. A joint tabletop with the supplier will test whether four weeks is credible for a flood at that site. It is usually optimistic, and discovering that now is free.
4. Accelerate qualification. Parallel testing, customer waivers, and pre-qualifying a candidate now rather than in nine months may compress the timeline meaningfully for modest cost.
5. Only then commit to the $300,000 second source, sized against the residual risk the cheaper layers leave.

Note that the supplier's refusal to fund redundancy is a negotiating position, not a fixed constraint; tooling ownership and qualification waivers change the leverage.

Continuity asks: can we keep operating through the disruption? Resilience asks a prior question: is our supply architecture able to absorb, adapt and recover - and can we change it when the answer is no?

The buffer stock answers the continuity question. It does not touch the structural fact that a $4 part in a $400 assembly can stop the business, sourced from one site in a flood plain, with a nine-month recovery lever. That gap between the impact and the time to fix is the resilience finding, and it is what the exercise should make visible to the board.

Ownership: it belongs on the enterprise risk register with a stated appetite and a board-level owner, not in procurement. A concentration that can remove two anchor customers is not a purchasing decision; procurement lacks the authority to fund a $300k mitigation against a risk it does not own. Frame the ask to the board in their language: probability over the dependency's life, bounded and unbounded loss, mitigation cost, and residual risk if deferred - including the explicit statement that deferral is a decision, not an absence of one.