Supply Network Strategy & Resilience
The shape of the supply network: design, make-versus-buy, capacity, dual sourcing, where dependency concentrates, scenario analysis and the continuity that follows. Resilience is designed years before it is needed, because qualification lead times mean an alternative source cannot be created during a disruption. An organisation supplies from the network it built, not the one it would now choose.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 22 LINKSResilience is not redundancy on paper: two approved suppliers on one continent, or two sites drawing the same intermediate, are one failure wearing two names.
06 · QUALITY MATURITY — SUPPLY NETWORK STRATEGY & RESILIENCE, REACTIVE TO ADAPTIVE
The network is the set of suppliers currently used. Nobody has drawn it past the first tier.
Approved supplier lists exist per material and dual sourcing is a stated preference, unmapped against where the alternatives actually originate.
The network is mapped beyond the first tier for critical materials, so shared origins, single sites and geographic concentration are visible rather than assumed away.
Fragility is scored and monitored, qualification of alternatives is maintained rather than nominal, and the cost of resilience is a stated decision.
The network is designed for the disruptions it expects, and a supply event is absorbed rather than escalated — which is a property of the design rather than the response.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 2 regulatory bodies: ICH, ISO.
RECORDS & OBJECTIVE EVIDENCE
- The supply network map for critical materials, extending beyond the first tier
- Single-point-of-failure analysis covering site, supplier, material and geography
- Qualification status of alternative sources, including when each was last verified
- Continuity risk assessments per critical material, with mitigations and owners
- Records of supply disruptions, and how the network absorbed or failed to absorb them
COMMON INSPECTION FINDINGS
- Two approved suppliers drawing from the same upstream manufacturer
- Network mapping that stops at the direct supplier, so shared origin is invisible
- Alternative sources approved on paper but never qualified in practice
- Critical materials with no continuity assessment at all
- A previous disruption with no change to the network that permitted it
Qualification lead time is the constraint that defines resilience
In most industries a second source can be brought on during a disruption. In regulated manufacture it cannot: a new API source needs qualification, comparability work, possibly stability data and a regulatory variation, and the elapsed time is measured in quarters or years rather than weeks. Whatever alternatives exist at the moment a disruption begins are the only alternatives available for its duration.
That single fact reframes the economics. Dual sourcing is usually evaluated as an ongoing cost against a probabilistic benefit, which makes it easy to defer. It is better understood as an option purchased in advance whose exercise price during a disruption is otherwise infinite — because the alternative cannot be created at that point at any price.
Concentration hides one level up
A network with three qualified suppliers of a material looks resilient until all three source their key intermediate from the same plant, or all three sit in one region exposed to the same event. Supplier-level dual sourcing that does not extend to the tier behind it provides the appearance of redundancy and none of the substance.
The analysis is unglamorous and rarely done: map the critical materials to their suppliers, then map those suppliers to their sources for the inputs that matter, and look for the names and locations that repeat. Where the map cannot be completed because suppliers will not disclose their sources, that is itself a finding — and a contractual gap that could have been closed at qualification.
Make versus buy allocates capability, not just cost
Outsourcing decisions are made on cost and capital, and they allocate something else: technical capability. An organisation that outsources manufacture and retains no process understanding cannot assess a deviation its contract manufacturer reports, judge a proposed change, or evaluate whether an investigation reached root cause — which means it cannot exercise the oversight it remains accountable for.
The internal capability required to be a competent customer is real, ongoing and usually excluded from the outsourcing business case. It is also the first thing cut when savings are pursued after the fact, which is how organisations arrive at a position of full accountability and no ability to act on it.
SPEQ interpretation — resilience should be assessed against the network map, not the supplier list
Supply risk is usually managed supplier by supplier: assess each, score each, act on the weak ones. That process cannot see the risks that arise from the shape of the network — the single site behind three suppliers, the region concentration, the material with one qualified source that appears in eleven products.
Those are visible only from the map, and they are the failures that produce shortages. SPEQ’s view is that a periodic network-level review — asking what single failure would stop the most products, and how long the alternative would take to qualify — should sit alongside supplier assessment rather than being assumed to emerge from it. It reliably surfaces exposures no individual supplier assessment could raise.
FREQUENTLY ASKED
Why can’t a second supplier be brought on during a disruption?
Because qualification, comparability work, potential stability data and a regulatory variation take quarters to years. The alternatives that exist when a disruption starts are the only ones available for its duration, which makes dual sourcing an option purchased in advance rather than a cost weighed against a probability.
How does supplier concentration hide?
One tier up. Three qualified suppliers can share a single upstream intermediate plant or sit in one exposed region, so supplier-level redundancy gives the appearance without the substance. Mapping critical materials to suppliers and then to their sources is the analysis; where suppliers will not disclose, that is a contractual gap that could have been closed at qualification.
What does outsourcing manufacture actually cost beyond price?
Technical capability. Without retained process understanding an organisation cannot assess a reported deviation, judge a proposed change, or evaluate an investigation — so it cannot exercise oversight it remains fully accountable for. That capability is ongoing, real, and usually excluded from the business case then cut when savings are pursued later.
What does a network-level resilience review add?
Exposures no supplier-by-supplier assessment can surface: the single site behind three suppliers, the region concentration, the material with one qualified source appearing in eleven products. Asking what single failure would stop the most products, and how long the alternative would take to qualify, is what produces those answers.