# Supply Chain Risk

> Assess supply chain risks including single-source dependencies, geographic concentration, disruption scenarios, mitigation strategies, and contingency planning. TRIGGER when: user says /supply-chain-risk, "supply chain risk", "disruption assessment", "supply risk analysis", "resilience assessment", "contingency plan".

- Skill: `ashutoshsrivastava17/supply-chain-risk` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/supply-chain-risk`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/supply-chain-risk/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/supply-chain-risk

---


# Supply Chain Risk Assessment

Identify, quantify, and mitigate supply chain vulnerabilities to build operational resilience against disruptions ranging from supplier failures to global crises.

---

## Input Gathering

| Input                         | Description                                                   | Required |
|-------------------------------|---------------------------------------------------------------|----------|
| Supply chain map              | Tier 1 and Tier 2+ suppliers, locations, dependencies         | Yes      |
| Bill of materials (BOM)       | Components, sources, lead times, alternate parts              | Yes      |
| Historical disruption log     | Past incidents, duration, financial impact, resolution        | Yes      |
| Supplier risk data            | Financial health, geographic risk, single-source flags        | Yes      |
| Revenue and margin data       | Product contribution to prioritize risk focus                 | No       |
| Insurance and contract terms  | Force majeure clauses, business interruption coverage         | No       |
| Geopolitical intelligence     | Trade policy changes, sanctions, tariff risks                 | No       |

---

## Step-by-Step Process

### Step 1 — Supply Chain Mapping and Dependency Analysis

Build a multi-tier supply chain map:

| Analysis Layer          | What to Map                                           | Tool / Method           |
|-------------------------|-------------------------------------------------------|-------------------------|
| Tier 1 suppliers        | Direct suppliers by commodity and spend               | ERP / procurement data  |
| Tier 2+ suppliers       | Sub-suppliers of critical Tier 1s                     | Supplier disclosure, databases |
| Geographic nodes        | Manufacturing sites, warehouses, ports, border crossings | Network mapping        |
| Logistics routes        | Primary and alternate shipping lanes                   | TMS / carrier data      |
| Information systems     | EDI connections, shared platforms, cloud dependencies   | IT architecture review  |

Identify single points of failure: any node whose removal would halt production or delivery.

### Step 2 — Risk Identification and Categorization

Catalog risks across six domains:

| Risk Domain          | Example Risks                                                | Typical Indicators                    |
|----------------------|--------------------------------------------------------------|---------------------------------------|
| Supplier risk        | Bankruptcy, quality failure, capacity shortfall              | Financial ratios, audit findings      |
| Demand risk          | Sudden demand spike/collapse, forecast error                 | Demand variability, market signals    |
| Operational risk     | Equipment failure, labor disruption, IT outage               | Maintenance logs, incident history    |
| Environmental risk   | Natural disaster, pandemic, climate events                   | Hazard maps, epidemiological data     |
| Geopolitical risk    | Trade wars, sanctions, regulatory changes, conflict          | Country risk indices, policy tracking |
| Cyber risk           | Ransomware, data breach, system compromise                   | Vulnerability scans, threat intel     |

For each risk, document the trigger event, affected nodes, and propagation path through the network.

### Step 3 — Risk Quantification

Score each identified risk using a probability-impact matrix:

**Probability Scale**:

| Rating | Probability | Description                           |
|--------|------------|---------------------------------------|
| 1      | < 5%       | Rare — unlikely in next 3 years       |
| 2      | 5-15%      | Unlikely — possible but not expected  |
| 3      | 15-40%     | Possible — could occur within 1 year  |
| 4      | 40-70%     | Likely — expected within 12 months    |
| 5      | > 70%      | Almost certain — imminent or recurring|

**Impact Scale**:

| Rating | Financial Impact   | Operational Impact                        |
|--------|--------------------|-------------------------------------------|
| 1      | < $100K            | Minor delay, no customer impact            |
| 2      | $100K - $1M        | Short delay, limited customer impact       |
| 3      | $1M - $10M         | Significant delay, some orders affected    |
| 4      | $10M - $50M        | Major disruption, widespread order delays  |
| 5      | > $50M             | Catastrophic, production halt, brand damage|

**Risk Score** = Probability x Impact (range: 1-25).

Classify: Low (1-5), Medium (6-12), High (13-19), Critical (20-25).

### Step 4 — Disruption Scenario Modeling

Develop and analyze 3-5 realistic disruption scenarios:

| Scenario                         | Duration   | Revenue Impact  | Recovery Time | Probability |
|----------------------------------|-----------|-----------------|---------------|-------------|
| Single critical supplier failure | 4-12 weeks| $X M            | 8-16 weeks    | Medium      |
| Port closure / logistics blockage| 2-6 weeks | $X M            | 4-8 weeks     | Medium      |
| Regional natural disaster        | 2-8 weeks | $X M            | 6-20 weeks    | Low-Medium  |
| Pandemic / workforce disruption  | 8-26 weeks| $X M            | 12-52 weeks   | Low         |
| Cyber attack on key system       | 1-4 weeks | $X M            | 2-8 weeks     | Medium      |

For each scenario, model the cascading effects through the supply chain: which products are affected, which customers impacted, and what is the time-phased financial exposure.

### Step 5 — Mitigation Strategy Development

Define mitigation actions mapped to the highest-priority risks:

| Strategy                    | Applicable Risks              | Investment Level | Risk Reduction |
|-----------------------------|-------------------------------|-----------------|----------------|
| Dual / multi-sourcing       | Supplier failure, capacity    | Medium          | High           |
| Safety stock buffering      | Demand, supplier, logistics   | Medium          | Medium         |
| Near-shoring / reshoring    | Geopolitical, logistics       | High            | High           |
| Contractual protections     | Supplier, compliance          | Low             | Medium         |
| Supplier development        | Quality, capacity             | Medium          | Medium         |
| Digital supply chain twin   | All operational risks         | High            | Medium-High    |
| Insurance / hedging         | Environmental, financial      | Low-Medium      | Medium         |
| Inventory pre-positioning   | Logistics, environmental      | Medium          | Medium         |

Assign each mitigation an owner, budget, and implementation timeline.

### Step 6 — Contingency Planning and Response Playbooks

Create actionable playbooks for each critical scenario:

| Playbook Component         | Content                                                     |
|----------------------------|-------------------------------------------------------------|
| Trigger criteria           | Specific conditions that activate the playbook               |
| Incident commander         | Named role with decision authority                          |
| Communication plan         | Internal escalation + customer/partner notification          |
| Immediate actions (0-48h)  | Secure supply, activate alternates, assess scope             |
| Short-term actions (1-4 wk)| Reallocate inventory, expedite alternatives, manage demand   |
| Recovery actions (1-6 mo)  | Qualify new sources, rebuild buffer, root cause analysis      |
| Post-incident review       | Lessons learned, playbook updates, metric recalibration      |

Test playbooks through tabletop exercises at least annually.

---

## Output Format

```
## Supply Chain Risk Assessment — [Scope] — [Date]

### Executive Summary
- Total risks identified: [count]
- Critical risks: [count] | High: [count] | Medium: [count] | Low: [count]
- Maximum single-event exposure: [$X M]
- Current resilience score: [X/100]
- Top 3 risks requiring immediate action: [list]

### Supply Chain Map Findings
- Single-source dependencies: [count] ([% of critical components])
- Geographic concentration: [top 3 locations and % of supply]
- Tier 2+ visibility: [% mapped]

### Risk Register
| ID  | Risk Description          | Domain       | Probability | Impact | Score | Trend | Owner |
|-----|---------------------------|--------------|-------------|--------|-------|-------|-------|
| R01 | ...                       | ...          | ...         | ...    | ...   | ...   | ...   |
| R02 | ...                       | ...          | ...         | ...    | ...   | ...   | ...   |

### Scenario Analysis Summary
| Scenario                     | Exposure    | Recovery Time | Preparedness |
|------------------------------|-------------|---------------|--------------|
| ...                          | ...         | ...           | ...          |

### Mitigation Plan
| Risk ID | Mitigation Action           | Owner | Budget | Timeline   | Status |
|---------|-----------------------------|-------|--------|------------|--------|
| R01     | ...                         | ...   | ...    | ...        | ...    |

### Contingency Readiness
| Scenario            | Playbook Status | Last Tested | Next Exercise |
|---------------------|-----------------|-------------|---------------|
| ...                 | ...             | ...         | ...           |

### Recommendations
1. [Immediate actions — next 30 days]
2. [Short-term investments — next quarter]
3. [Strategic initiatives — next 12 months]
```

---

## Quality Checklist

- [ ] Supply chain mapped to at least Tier 2 for critical components
- [ ] All single-source dependencies identified and documented
- [ ] Risk register covers all six domains (supplier, demand, operational, environmental, geopolitical, cyber)
- [ ] Probability and impact scores based on data, not assumptions alone
- [ ] At least 3 disruption scenarios modeled with financial exposure estimates
- [ ] Mitigation strategies assigned to specific owners with budgets
- [ ] Contingency playbooks drafted for the top 3 critical scenarios
- [ ] Playbooks tested via tabletop exercise within the last 12 months
- [ ] Risk assessment reviewed and approved by senior leadership
- [ ] Monitoring cadence established: critical risks monthly, all risks quarterly

---

## Edge Cases

- **Complete lack of Tier 2+ visibility**: Use industry databases, supplier questionnaires, and third-party mapping services; start with the highest-spend Tier 1s and work backward.
- **Emerging risk with no historical precedent**: Use analogous events from other industries; conduct structured expert elicitation; apply scenario planning rather than probabilistic models.
- **Interconnected risks (cascading failure)**: Model dependencies between risks using fault trees or bow-tie analysis; a single event may trigger multiple simultaneous failures.
- **Global pandemic or systemic crisis**: Standard risk scoring underweights correlated, system-wide events; supplement with stress testing that assumes multiple simultaneous failures.
- **Supplier unwilling to disclose sub-tier information**: Invoke contractual transparency clauses; use third-party intelligence; treat opacity itself as a risk factor that raises the supplier's score.
- **Rapidly changing geopolitical environment**: Increase risk review frequency from quarterly to monthly; subscribe to real-time trade policy and sanctions alert services; pre-qualify alternative sources in stable regions.