The Single-Source Sensor

Baseline exposure. Historic frequency is roughly 2 events in 6 years, or about 0.33 per year. An event averaging 11 days at partial stoppage (55% of $42,000 = about $23,100 per day) is roughly $254,000 per event. A naive expected loss is 0.33 x $254,000 ≈ $84,000 per year, before penalty clauses.

Option A - dual source. One-time $260,000 amortised over, say, five years ≈ $52,000 per year, plus 4% of $3.2 million = $128,000 per year recurring, so about $180,000 per year. It removes the structural single point of failure but does not zero the risk: the new source must itself ramp, and split volume can weaken the incumbent relationship.

Option B - buffer. Carrying $60,000 plus capital charge (9% x $1.1 million ≈ $99,000) ≈ $159,000 per year,, plus obsolescence risk if the product mix shifts. A five-week buffer covers disruptions shorter than five weeks; it does not help against a longer event and it does nothing about the underlying concentration.

Option C - accept. Cheapest on paper at roughly zero recurring cost, with an expected loss near $84,000 per year, which is lower than either mitigation.

What the arithmetic does not tell you. The frequency estimate rests on two observations, so the confidence interval is enormous. Expected value is the wrong sole criterion here because the loss distribution is fat-tailed: a 14-day event plus two SLA penalties could exceed $1.2 million in a single year, and the company's tolerance for that outcome is a board-level question, not a spreadsheet output. Judgement, not arithmetic, decides this.

Recommend a hybrid: proceed with Option A, and fund a 2–3 week buffer as a bridge while qualification runs.

Why not pure cost minimisation. Option A at ~$180,000 per year is more than double the expected loss. If the world behaved like the historical average, accepting the risk would be the cheaper decision. The argument for A is that the average is not the thing you are managing. Three reasons:

1. Tail exposure. The penalty clauses alone are $500,000, and an event concurrent with a product launch or a major customer ramp multiplies that. Expected value systematically undervalues low-probability, high-severity events; a manager should price the tail explicitly, not average it away.
2. Estimate quality. With two data points, the true frequency could plausibly be 0.15 or 0.6. When the estimate is that soft, decisions should be robust to a range, and dual-sourcing is robust across the whole range in a way that 'accept' is not.
3. Strategic concentration. 60% of product lines on one distant supplier is a structural condition, not a forecast. Qualification takes 20 weeks, so the option to mitigate is perishable; waiting is itself a choice with a cost.

Why not the full five-week buffer instead. It costs almost as much annually as dual-sourcing while leaving the concentration intact and creating obsolescence exposure. A 2–3 week bridge sized to the observed 9–14 day events covers the qualification window, then is drawn down.

Negotiate the price of A: offer the second source a three-year volume commitment, ask the incumbent for a matched concession to retain 60% of the business, and share qualification testing cost. A 4% premium is a first offer, not a fact.

Treat it as a live risk with an owner, a trigger and a review date - not a project that closes.

Register entry. Owner named (procurement lead, not 'the team'), cause and effect stated, current residual rating after mitigation, and the treatment plan with dates. Update on a fixed quarterly cadence and after any event.

Key risk indicators with thresholds. Examples:

• Supplier on-time delivery: below 95% for two consecutive months → escalate.
• Port or region disruption alerts, weather and labour action: any advisory → activate the buffer-release protocol.
• Buffer coverage in weeks of demand: below two weeks → replenish trigger.
• Second-source qualification milestones: any slip beyond two weeks → report to the executive risk committee.
• Past-due or expiring SLA penalty exposure: review at contract renewal.

Scenario rehearsal. Once, before the next typhoon season, walk through a 14-day disruption: who declares it, who authorises expedite freight (and up to what amount), how allocation across product lines is decided, how customers are notified. A plan nobody has rehearsed is a document, not a control.

Review the economics annually. The 4% premium and the disruption frequency should both be re-tested each year. If the second source proves reliable and competitive, consider rebalancing volumes toward it; if it does not, the dual-source decision should be revisited rather than defended out of habit.

Report the residual, not just the action. The board should see 'exposure reduced from X to Y, remaining gap is Z', so the decision stays visible and the remaining risk is consciously held rather than assumed away.