Single-Source Dependency: Finding and Fixing Concentration Risk

Single-source dependency is what you have when a critical input, component or service comes from just one supplier, so if that supplier fails, you have no immediate alternative. It's the purest form of supplier concentration risk: a single point of failure sitting inside your supply chain, often unnoticed until it breaks. Reducing it isn't about blanket diversification, which carries its own costs, but about finding where you're dangerously concentrated and fixing the dependencies that would actually hurt. Here's how to think about it.

Why single-source dependency is so dangerous

A single source is efficient: one relationship, better pricing through volume, simpler quality control, right up until that source stops delivering. Then it becomes the reason your whole line stops. What makes it especially dangerous is that the worst concentration is often invisible. You might deliberately dual-source at Tier 1 and still have both suppliers quietly buying the same component from the same Tier 2 factory. On paper you're diversified; in reality a single failure takes out both. Concentration risk hides below the tier you can see.

Single-sourcing isn't always a mistake

It's worth saying that single-sourcing can be a deliberate, sensible choice: for a specialised component only one supplier makes well, or where a deep single relationship delivers real quality and cost advantages. The problem isn't single-sourcing itself; it's unmanaged or unrecognised single-sourcing, the dependency you didn't consciously choose and haven't mitigated. The goal is to know exactly where you're single-sourced, decide whether that's acceptable, and manage the ones that aren't.

How to find your concentration risk

Start by mapping your dependencies for critical inputs: which suppliers provide them, and crucially, where those suppliers source from beneath the surface. Then look for concentration in three forms: a single supplier providing a critical input; several of your suppliers depending on the same sub-tier source; and geographic concentration, where multiple sources sit in one region exposed to the same shock. Quantify each by the value at risk, what a failure would cost, so you can tell a dependency that's merely tidy from one that's genuinely dangerous.

How to reduce it

Once you know where you're exposed, the fixes are well understood, and you apply them where the value at risk justifies the cost.

Qualify a second source. A pre-approved alternate supplier you can switch to quickly is the most direct fix, even if you don't split volume day to day. Diversify deliberately. Split volume across suppliers or regions for your most critical, highest-value dependencies. Hold targeted buffer. Where a second source isn't practical, a safety stock at that node buys time to respond. Design out the dependency. Sometimes the best fix is upstream: standardising a component or qualifying alternatives so you aren't locked to one source at all.

The common thread is proportion: spend on reducing concentration where a failure would genuinely hurt, and accept the dependencies that wouldn't.

Single-source dependency is one of the most common and most overlooked risks in a supply chain, precisely because it looks efficient until it isn't. Find it, quantify it, and fix what matters. For how it fits the wider discipline, see our guide to supplier risk management, and for seeing the hidden concentration beneath Tier 1, our guide to sub-tier supply chain visibility.