The Supplier Risk Most Growing Companies Discover Too Late

For a fast-growing company, the supplier problem that does the most damage is rarely the one on the risk register. It is the single input nobody has a backup for, or the dependency sitting one or two steps behind a trusted vendor. Companies tend to find it when a shipment stops.

Concentration grows quietly

Growth rewards simplicity. A supplier that delivers on time and at a fair price gets more orders, and a second source never gets qualified because the first one works. Over time, a business can end up depending on one vendor for a part it cannot easily replace.

Survey evidence from India's auto-component sector shows how common this is among smaller firms. A study by the Automotive Component Manufacturers Association and Boston Consulting Group, as reported by Autocar Professional in September 2026, found that about two-thirds of small firms had no qualified second source for most of their critical inputs, against about one-third of large firms. The report also found that 42 percent of small-firm leaders spent most or all of their time firefighting, compared with 29 percent at large firms. The article did not give a sample size or define firm sizes, and we could not check the figures against the original report, so they should be read as indicative.

The risk behind the supplier

Even companies that know their direct vendors often cannot see past them. An Achilles survey of 2,805 organisations, reported in March 2026, found that only 6 percent had full visibility into their Tier 2 and Tier 3 suppliers, and nearly half had limited or no visibility beyond their immediate suppliers. Achilles sells supplier risk products and the article did not describe its methodology, so the numbers reflect what respondents say, not audited data.

McKinsey's 2024 supply chain survey of 88 senior executives pointed the same way. Visibility into deeper tiers fell by seven percentage points for a second year, even as 60 percent of respondents reported good visibility at tier one. It is an older and smaller sample, but it shows the gap is not new.

A cheap part can stop a factory

The Nexperia episode in late 2025 shows how a low-value component can have outsized effects. According to Reuters, the Dutch government took control of the chipmaker's headquarters, citing concerns about technology flowing to its Chinese parent, and China responded by halting exports from Nexperia's plant in Dongguan. The plant makes inexpensive chips used in items such as brakes and electric windows. Reuters reported that automakers "from Nissan to Honda" had to cut production, though it gave no scale for the cuts, and said the dispute was partly eased after government talks. An analyst quoted in the piece said China is hard to replace as a supplier but that these episodes are pushing companies to consider second options elsewhere.

The lesson is not about one company or country. It is that a part's price says little about its importance to the product.

Why it gets found late

• Spend is not risk. Procurement teams rank suppliers by cost, so cheap but irreplaceable inputs get little attention.
• Contracts hide dependencies. A vendor may subcontract a key step without the buyer knowing.
• Backups cost money before they pay off. Qualifying a second supplier takes engineering time and often a higher price, which is hard to justify while the first one performs.
• Growth consumes attention. The same leaders who would map supplier risk are busy meeting demand.

What companies can do

The following reflects commonly recommended practice rather than findings from the studies above.

1. List every input and mark which have only one qualified source, regardless of cost.
2. Ask key suppliers who supplies them for the critical parts, and where those suppliers are located.
3. Check suppliers' financial health and customer concentration, since a vendor in distress is a risk to its customers.
4. Qualify a second source for the most critical items before it is needed, and test it with a small share of orders.
5. Hold targeted buffer stock for parts with long replacement times, rather than across the board.

None of this removes risk. Each step has a cost, and a company can overspend on resilience in areas that do not matter. The point is to choose the dependencies deliberately rather than discover them.

Bottom line

Supplier risk becomes visible only after it has already built up. Companies that map it early may pay for some redundancy they never use. Those that do not will often learn the cost from a stopped line.