Below the Waterline: Finding the Suppliers Your Group Cannot Do Without
Ask a group finance director who their biggest suppliers are and a list will arrive within the hour. Ask which five firms, if they ceased trading tomorrow, would halt a subsidiary's ability to invoice, manufacture or meet a regulatory obligation, and the silence tends to be longer. The two lists are rarely the same.
This gap is not a failure of diligence. It is a consequence of how groups grow. Procurement sits with operating companies because it should: local buyers know the market, the lead times and the personalities involved. But that same localism means concentration risk accumulates quietly, one purchase order at a time, and only becomes visible to the centre when something breaks.
The purpose of dependency mapping is not to pull purchasing into head office. It is to give the board a view of where the group is exposed, so that decisions about mitigation — dual sourcing, stock buffers, contractual protection, contingency planning — can be taken by the people best placed to take them, with the centre aware of the pattern.
Why the Visible Suppliers Are Usually the Wrong Ones
Group reporting tends to capture spend. Spend-based analysis surfaces the suppliers with the largest invoices, which is a useful commercial fact but a poor proxy for vulnerability. A firm accounting for two per cent of group spend may nonetheless be the sole provider of a critical component, the only accredited calibrator in a region, or the holder of a software licence embedded in a product the group sells.
Three categories of dependency typically escape spend analysis entirely.
Single-source technical dependencies. Specialist tooling, bespoke components, proprietary software, calibration and testing services. These tend to be small-ticket and technically specific, which is precisely why nobody has sought an alternative.
Regulated or accredited services. Waste handling, statutory inspection, certain laboratory work, professional certification. Here the constraint is not price but the limited number of providers permitted to do the work at all.
Informal dependencies. The longstanding haulier who flexes delivery schedules at short notice. The individual contractor who holds operational knowledge not written down anywhere. The family-run fabricator that has never signed a formal agreement. These are the hardest to see and often the most fragile, because their resilience depends on relationships rather than contracts.
A Mapping Exercise That Respects Local Knowledge
A dependency map is best built from the bottom up, with the centre providing the template rather than the answers.
Begin with a defined scope. One trading entity, one product line or one site is usually enough for a first pass. Attempting the whole group at once produces a document nobody trusts.
Ask each operating company to identify, for that scope, the inputs without which it could not trade for more than a defined period — thirty days is a workable default for most businesses and a revealing one for many. For each input, record the supplier, the nature of the constraint, the available alternatives and the lead time to switch.
The output should be short. A useful first map for a single entity often runs to fewer than twenty lines. Length is not the objective; accuracy of the constraint is.
Two disciplines improve the result. First, ask the question of operations as well as procurement, because the people running a site know which supplier call they dread. Second, record confidence explicitly — whether the named alternative has been tested or is simply assumed to exist. An untested alternative is a hypothesis, not a mitigation.
Six Questions for Operating Companies
A short, consistent question set makes the returns comparable across the group without imposing a reporting burden.
- Which suppliers could stop your operation within a month if they failed, and how would you find out that they had?
- For each, is there a qualified alternative in the market, and have you used them or merely identified them?
- What is the contractual position — notice periods, termination rights, assignment on insolvency, any security you hold over tooling or intellectual property?
- Does the supplier depend on you as heavily as you depend on them, and does that mutual reliance help or hinder?
- What would it cost, in money and time, to switch, and who would authorise that decision?
- Where does the dependency sit on a person rather than a firm — a named contact, a self-employed specialist, a relationship rather than a contract?
The sixth question is the one most often skipped and most often consequential.
A Rhythm, Not a Register
A dependency register compiled once and filed is of limited value. Concentration shifts as suppliers are acquired, as contracts are retendered and as local markets thin out. What matters is a rhythm of review proportionate to the risk.
A workable arrangement for a mid-sized group is an annual refresh at operating-company level, using the same template and question set, with a consolidated summary going to the board's audit or risk committee. Between cycles, a short trigger list prompts an out-of-sequence update: a supplier entering administration, a change of ownership at a critical vendor, the loss of an accreditation, or the departure of a key individual on the supplier side.
The committee's role is not to approve suppliers. It is to satisfy itself that the group knows where it is exposed, that the exposure is understood at the level where it can be managed, and that the mitigation claimed is real rather than assumed.
Keeping the Centre Informed Without Taking Control
The temptation, once a group sees its dependencies collected in one place, is to centralise. That instinct should be resisted. Local buyers hold market knowledge the centre cannot replicate, and a group procurement function imposed on operating companies tends to slow decisions without improving resilience.
The centre's contribution is different and more valuable: a common language for describing dependency, a consolidated view that no single subsidiary can see, and the authority to escalate where a dependency is material to the group as a whole. That is a governance function, not a purchasing one.
Groups that map their critical suppliers in this way tend to find two things. The first is a small number of exposures that genuinely warrant board attention. The second, more quietly useful, is a better conversation between the centre and its operating companies about risk — one grounded in specifics rather than assurances. Both are worth the effort, and neither requires the group to take a single purchasing decision away from the people closest to the work.
