Supply Chain Risk Assessment
Identify, quantify, and mitigate supply chain vulnerabilities to build operational resilience against disruptions ranging from supplier failures to global crises.
Input Gathering
| Input |
Description |
Required |
| Supply chain map |
Tier 1 and Tier 2+ suppliers, locations, dependencies |
Yes |
| Bill of materials (BOM) |
Components, sources, lead times, alternate parts |
Yes |
| Historical disruption log |
Past incidents, duration, financial impact, resolution |
Yes |
| Supplier risk data |
Financial health, geographic risk, single-source flags |
Yes |
| Revenue and margin data |
Product contribution to prioritize risk focus |
No |
| Insurance and contract terms |
Force majeure clauses, business interruption coverage |
No |
| Geopolitical intelligence |
Trade policy changes, sanctions, tariff risks |
No |
Step-by-Step Process
Step 1 — Supply Chain Mapping and Dependency Analysis
Build a multi-tier supply chain map:
| Analysis Layer |
What to Map |
Tool / Method |
| Tier 1 suppliers |
Direct suppliers by commodity and spend |
ERP / procurement data |
| Tier 2+ suppliers |
Sub-suppliers of critical Tier 1s |
Supplier disclosure, databases |
| Geographic nodes |
Manufacturing sites, warehouses, ports, border crossings |
Network mapping |
| Logistics routes |
Primary and alternate shipping lanes |
TMS / carrier data |
| Information systems |
EDI connections, shared platforms, cloud dependencies |
IT architecture review |
Identify single points of failure: any node whose removal would halt production or delivery.
Step 2 — Risk Identification and Categorization
Catalog risks across six domains:
| Risk Domain |
Example Risks |
Typical Indicators |
| Supplier risk |
Bankruptcy, quality failure, capacity shortfall |
Financial ratios, audit findings |
| Demand risk |
Sudden demand spike/collapse, forecast error |
Demand variability, market signals |
| Operational risk |
Equipment failure, labor disruption, IT outage |
Maintenance logs, incident history |
| Environmental risk |
Natural disaster, pandemic, climate events |
Hazard maps, epidemiological data |
| Geopolitical risk |
Trade wars, sanctions, regulatory changes, conflict |
Country risk indices, policy tracking |
| Cyber risk |
Ransomware, data breach, system compromise |
Vulnerability scans, threat intel |
For each risk, document the trigger event, affected nodes, and propagation path through the network.
Step 3 — Risk Quantification
Score each identified risk using a probability-impact matrix:
Probability Scale:
| Rating |
Probability |
Description |
| 1 |
< 5% |
Rare — unlikely in next 3 years |
| 2 |
5-15% |
Unlikely — possible but not expected |
| 3 |
15-40% |
Possible — could occur within 1 year |
| 4 |
40-70% |
Likely — expected within 12 months |
| 5 |
> 70% |
Almost certain — imminent or recurring |
Impact Scale:
| Rating |
Financial Impact |
Operational Impact |
| 1 |
< $100K |
Minor delay, no customer impact |
| 2 |
$100K - $1M |
Short delay, limited customer impact |
| 3 |
$1M - $10M |
Significant delay, some orders affected |
| 4 |
$10M - $50M |
Major disruption, widespread order delays |
| 5 |
> $50M |
Catastrophic, production halt, brand damage |
Risk Score = Probability x Impact (range: 1-25).
Classify: Low (1-5), Medium (6-12), High (13-19), Critical (20-25).
Step 4 — Disruption Scenario Modeling
Develop and analyze 3-5 realistic disruption scenarios:
| Scenario |
Duration |
Revenue Impact |
Recovery Time |
Probability |
| Single critical supplier failure |
4-12 weeks |
$X M |
8-16 weeks |
Medium |
| Port closure / logistics blockage |
2-6 weeks |
$X M |
4-8 weeks |
Medium |
| Regional natural disaster |
2-8 weeks |
$X M |
6-20 weeks |
Low-Medium |
| Pandemic / workforce disruption |
8-26 weeks |
$X M |
12-52 weeks |
Low |
| Cyber attack on key system |
1-4 weeks |
$X M |
2-8 weeks |
Medium |
For each scenario, model the cascading effects through the supply chain: which products are affected, which customers impacted, and what is the time-phased financial exposure.
Step 5 — Mitigation Strategy Development
Define mitigation actions mapped to the highest-priority risks:
| Strategy |
Applicable Risks |
Investment Level |
Risk Reduction |
| Dual / multi-sourcing |
Supplier failure, capacity |
Medium |
High |
| Safety stock buffering |
Demand, supplier, logistics |
Medium |
Medium |
| Near-shoring / reshoring |
Geopolitical, logistics |
High |
High |
| Contractual protections |
Supplier, compliance |
Low |
Medium |
| Supplier development |
Quality, capacity |
Medium |
Medium |
| Digital supply chain twin |
All operational risks |
High |
Medium-High |
| Insurance / hedging |
Environmental, financial |
Low-Medium |
Medium |
| Inventory pre-positioning |
Logistics, environmental |
Medium |
Medium |
Assign each mitigation an owner, budget, and implementation timeline.
Step 6 — Contingency Planning and Response Playbooks
Create actionable playbooks for each critical scenario:
| Playbook Component |
Content |
| Trigger criteria |
Specific conditions that activate the playbook |
| Incident commander |
Named role with decision authority |
| Communication plan |
Internal escalation + customer/partner notification |
| Immediate actions (0-48h) |
Secure supply, activate alternates, assess scope |
| Short-term actions (1-4 wk) |
Reallocate inventory, expedite alternatives, manage demand |
| Recovery actions (1-6 mo) |
Qualify new sources, rebuild buffer, root cause analysis |
| Post-incident review |
Lessons learned, playbook updates, metric recalibration |
Test playbooks through tabletop exercises at least annually.
Output Format
## Supply Chain Risk Assessment — [Scope] — [Date]
### Executive Summary
- Total risks identified: [count]
- Critical risks: [count] | High: [count] | Medium: [count] | Low: [count]
- Maximum single-event exposure: [$X M]
- Current resilience score: [X/100]
- Top 3 risks requiring immediate action: [list]
### Supply Chain Map Findings
- Single-source dependencies: [count] ([% of critical components])
- Geographic concentration: [top 3 locations and % of supply]
- Tier 2+ visibility: [% mapped]
### Risk Register
| ID | Risk Description | Domain | Probability | Impact | Score | Trend | Owner |
|-----|---------------------------|--------------|-------------|--------|-------|-------|-------|
| R01 | ... | ... | ... | ... | ... | ... | ... |
| R02 | ... | ... | ... | ... | ... | ... | ... |
### Scenario Analysis Summary
| Scenario | Exposure | Recovery Time | Preparedness |
|------------------------------|-------------|---------------|--------------|
| ... | ... | ... | ... |
### Mitigation Plan
| Risk ID | Mitigation Action | Owner | Budget | Timeline | Status |
|---------|-----------------------------|-------|--------|------------|--------|
| R01 | ... | ... | ... | ... | ... |
### Contingency Readiness
| Scenario | Playbook Status | Last Tested | Next Exercise |
|---------------------|-----------------|-------------|---------------|
| ... | ... | ... | ... |
### Recommendations
1. [Immediate actions — next 30 days]
2. [Short-term investments — next quarter]
3. [Strategic initiatives — next 12 months]
Quality Checklist
Edge Cases
- Complete lack of Tier 2+ visibility: Use industry databases, supplier questionnaires, and third-party mapping services; start with the highest-spend Tier 1s and work backward.
- Emerging risk with no historical precedent: Use analogous events from other industries; conduct structured expert elicitation; apply scenario planning rather than probabilistic models.
- Interconnected risks (cascading failure): Model dependencies between risks using fault trees or bow-tie analysis; a single event may trigger multiple simultaneous failures.
- Global pandemic or systemic crisis: Standard risk scoring underweights correlated, system-wide events; supplement with stress testing that assumes multiple simultaneous failures.
- Supplier unwilling to disclose sub-tier information: Invoke contractual transparency clauses; use third-party intelligence; treat opacity itself as a risk factor that raises the supplier's score.
- Rapidly changing geopolitical environment: Increase risk review frequency from quarterly to monthly; subscribe to real-time trade policy and sanctions alert services; pre-qualify alternative sources in stable regions.
1---2name: supply-chain-risk3description: Assess supply chain risks including single-source dependencies, geographic concentration, disruption scenarios, mitigation strategies, and contingency planning. TRIGGER when: user says /supply-chain-risk, "supply chain risk", "disruption assessment", "supply risk analysis", "resilience assessment", "contingency plan".4---56# Supply Chain Risk Assessment78Identify, quantify, and mitigate supply chain vulnerabilities to build operational resilience against disruptions ranging from supplier failures to global crises.910---1112## Input Gathering1314| Input | Description | Required |15|-------------------------------|---------------------------------------------------------------|----------|16| Supply chain map | Tier 1 and Tier 2+ suppliers, locations, dependencies | Yes |17| Bill of materials (BOM) | Components, sources, lead times, alternate parts | Yes |18| Historical disruption log | Past incidents, duration, financial impact, resolution | Yes |19| Supplier risk data | Financial health, geographic risk, single-source flags | Yes |20| Revenue and margin data | Product contribution to prioritize risk focus | No |21| Insurance and contract terms | Force majeure clauses, business interruption coverage | No |22| Geopolitical intelligence | Trade policy changes, sanctions, tariff risks | No |2324---2526## Step-by-Step Process2728### Step 1 — Supply Chain Mapping and Dependency Analysis2930Build a multi-tier supply chain map:3132| Analysis Layer | What to Map | Tool / Method |33|-------------------------|-------------------------------------------------------|-------------------------|34| Tier 1 suppliers | Direct suppliers by commodity and spend | ERP / procurement data |35| Tier 2+ suppliers | Sub-suppliers of critical Tier 1s | Supplier disclosure, databases |36| Geographic nodes | Manufacturing sites, warehouses, ports, border crossings | Network mapping |37| Logistics routes | Primary and alternate shipping lanes | TMS / carrier data |38| Information systems | EDI connections, shared platforms, cloud dependencies | IT architecture review |3940Identify single points of failure: any node whose removal would halt production or delivery.4142### Step 2 — Risk Identification and Categorization4344Catalog risks across six domains:4546| Risk Domain | Example Risks | Typical Indicators |47|----------------------|--------------------------------------------------------------|---------------------------------------|48| Supplier risk | Bankruptcy, quality failure, capacity shortfall | Financial ratios, audit findings |49| Demand risk | Sudden demand spike/collapse, forecast error | Demand variability, market signals |50| Operational risk | Equipment failure, labor disruption, IT outage | Maintenance logs, incident history |51| Environmental risk | Natural disaster, pandemic, climate events | Hazard maps, epidemiological data |52| Geopolitical risk | Trade wars, sanctions, regulatory changes, conflict | Country risk indices, policy tracking |53| Cyber risk | Ransomware, data breach, system compromise | Vulnerability scans, threat intel |5455For each risk, document the trigger event, affected nodes, and propagation path through the network.5657### Step 3 — Risk Quantification5859Score each identified risk using a probability-impact matrix:6061**Probability Scale**:6263| Rating | Probability | Description |64|--------|------------|---------------------------------------|65| 1 | < 5% | Rare — unlikely in next 3 years |66| 2 | 5-15% | Unlikely — possible but not expected |67| 3 | 15-40% | Possible — could occur within 1 year |68| 4 | 40-70% | Likely — expected within 12 months |69| 5 | > 70% | Almost certain — imminent or recurring|7071**Impact Scale**:7273| Rating | Financial Impact | Operational Impact |74|--------|--------------------|-------------------------------------------|75| 1 | < $100K | Minor delay, no customer impact |76| 2 | $100K - $1M | Short delay, limited customer impact |77| 3 | $1M - $10M | Significant delay, some orders affected |78| 4 | $10M - $50M | Major disruption, widespread order delays |79| 5 | > $50M | Catastrophic, production halt, brand damage|8081**Risk Score** = Probability x Impact (range: 1-25).8283Classify: Low (1-5), Medium (6-12), High (13-19), Critical (20-25).8485### Step 4 — Disruption Scenario Modeling8687Develop and analyze 3-5 realistic disruption scenarios:8889| Scenario | Duration | Revenue Impact | Recovery Time | Probability |90|----------------------------------|-----------|-----------------|---------------|-------------|91| Single critical supplier failure | 4-12 weeks| $X M | 8-16 weeks | Medium |92| Port closure / logistics blockage| 2-6 weeks | $X M | 4-8 weeks | Medium |93| Regional natural disaster | 2-8 weeks | $X M | 6-20 weeks | Low-Medium |94| Pandemic / workforce disruption | 8-26 weeks| $X M | 12-52 weeks | Low |95| Cyber attack on key system | 1-4 weeks | $X M | 2-8 weeks | Medium |9697For each scenario, model the cascading effects through the supply chain: which products are affected, which customers impacted, and what is the time-phased financial exposure.9899### Step 5 — Mitigation Strategy Development100101Define mitigation actions mapped to the highest-priority risks:102103| Strategy | Applicable Risks | Investment Level | Risk Reduction |104|-----------------------------|-------------------------------|-----------------|----------------|105| Dual / multi-sourcing | Supplier failure, capacity | Medium | High |106| Safety stock buffering | Demand, supplier, logistics | Medium | Medium |107| Near-shoring / reshoring | Geopolitical, logistics | High | High |108| Contractual protections | Supplier, compliance | Low | Medium |109| Supplier development | Quality, capacity | Medium | Medium |110| Digital supply chain twin | All operational risks | High | Medium-High |111| Insurance / hedging | Environmental, financial | Low-Medium | Medium |112| Inventory pre-positioning | Logistics, environmental | Medium | Medium |113114Assign each mitigation an owner, budget, and implementation timeline.115116### Step 6 — Contingency Planning and Response Playbooks117118Create actionable playbooks for each critical scenario:119120| Playbook Component | Content |121|----------------------------|-------------------------------------------------------------|122| Trigger criteria | Specific conditions that activate the playbook |123| Incident commander | Named role with decision authority |124| Communication plan | Internal escalation + customer/partner notification |125| Immediate actions (0-48h) | Secure supply, activate alternates, assess scope |126| Short-term actions (1-4 wk)| Reallocate inventory, expedite alternatives, manage demand |127| Recovery actions (1-6 mo) | Qualify new sources, rebuild buffer, root cause analysis |128| Post-incident review | Lessons learned, playbook updates, metric recalibration |129130Test playbooks through tabletop exercises at least annually.131132---133134## Output Format135136```137## Supply Chain Risk Assessment — [Scope] — [Date]138139### Executive Summary140- Total risks identified: [count]141- Critical risks: [count] | High: [count] | Medium: [count] | Low: [count]142- Maximum single-event exposure: [$X M]143- Current resilience score: [X/100]144- Top 3 risks requiring immediate action: [list]145146### Supply Chain Map Findings147- Single-source dependencies: [count] ([% of critical components])148- Geographic concentration: [top 3 locations and % of supply]149- Tier 2+ visibility: [% mapped]150151### Risk Register152| ID | Risk Description | Domain | Probability | Impact | Score | Trend | Owner |153|-----|---------------------------|--------------|-------------|--------|-------|-------|-------|154| R01 | ... | ... | ... | ... | ... | ... | ... |155| R02 | ... | ... | ... | ... | ... | ... | ... |156157### Scenario Analysis Summary158| Scenario | Exposure | Recovery Time | Preparedness |159|------------------------------|-------------|---------------|--------------|160| ... | ... | ... | ... |161162### Mitigation Plan163| Risk ID | Mitigation Action | Owner | Budget | Timeline | Status |164|---------|-----------------------------|-------|--------|------------|--------|165| R01 | ... | ... | ... | ... | ... |166167### Contingency Readiness168| Scenario | Playbook Status | Last Tested | Next Exercise |169|---------------------|-----------------|-------------|---------------|170| ... | ... | ... | ... |171172### Recommendations1731. [Immediate actions — next 30 days]1742. [Short-term investments — next quarter]1753. [Strategic initiatives — next 12 months]176```177178---179180## Quality Checklist181182- [ ] Supply chain mapped to at least Tier 2 for critical components183- [ ] All single-source dependencies identified and documented184- [ ] Risk register covers all six domains (supplier, demand, operational, environmental, geopolitical, cyber)185- [ ] Probability and impact scores based on data, not assumptions alone186- [ ] At least 3 disruption scenarios modeled with financial exposure estimates187- [ ] Mitigation strategies assigned to specific owners with budgets188- [ ] Contingency playbooks drafted for the top 3 critical scenarios189- [ ] Playbooks tested via tabletop exercise within the last 12 months190- [ ] Risk assessment reviewed and approved by senior leadership191- [ ] Monitoring cadence established: critical risks monthly, all risks quarterly192193---194195## Edge Cases196197- **Complete lack of Tier 2+ visibility**: Use industry databases, supplier questionnaires, and third-party mapping services; start with the highest-spend Tier 1s and work backward.198- **Emerging risk with no historical precedent**: Use analogous events from other industries; conduct structured expert elicitation; apply scenario planning rather than probabilistic models.199- **Interconnected risks (cascading failure)**: Model dependencies between risks using fault trees or bow-tie analysis; a single event may trigger multiple simultaneous failures.200- **Global pandemic or systemic crisis**: Standard risk scoring underweights correlated, system-wide events; supplement with stress testing that assumes multiple simultaneous failures.201- **Supplier unwilling to disclose sub-tier information**: Invoke contractual transparency clauses; use third-party intelligence; treat opacity itself as a risk factor that raises the supplier's score.202- **Rapidly changing geopolitical environment**: Increase risk review frequency from quarterly to monthly; subscribe to real-time trade policy and sanctions alert services; pre-qualify alternative sources in stable regions.
ashutoshsrivastava17