| name | supply-chain-risk |
| description | Assess supply chain risks including single-source dependencies, geographic concentration, disruption scenarios, mitigation strategies, and contingency planning. TRIGGER when: user says /supply-chain-risk, "supply chain risk", "disruption assessment", "supply risk analysis", "resilience assessment", "contingency plan".
|
| argument-hint | [scope/product-line] [risk-category] [scenario] |
| user-invocable | true |
Supply Chain Risk Assessment
Identify, quantify, and mitigate supply chain vulnerabilities to build operational resilience against disruptions ranging from supplier failures to global crises.
Input Gathering
| Input | Description | Required |
|---|
| Supply chain map | Tier 1 and Tier 2+ suppliers, locations, dependencies | Yes |
| Bill of materials (BOM) | Components, sources, lead times, alternate parts | Yes |
| Historical disruption log | Past incidents, duration, financial impact, resolution | Yes |
| Supplier risk data | Financial health, geographic risk, single-source flags | Yes |
| Revenue and margin data | Product contribution to prioritize risk focus | No |
| Insurance and contract terms | Force majeure clauses, business interruption coverage | No |
| Geopolitical intelligence | Trade policy changes, sanctions, tariff risks | No |
Step-by-Step Process
Step 1 — Supply Chain Mapping and Dependency Analysis
Build a multi-tier supply chain map:
| Analysis Layer | What to Map | Tool / Method |
|---|
| Tier 1 suppliers | Direct suppliers by commodity and spend | ERP / procurement data |
| Tier 2+ suppliers | Sub-suppliers of critical Tier 1s | Supplier disclosure, databases |
| Geographic nodes | Manufacturing sites, warehouses, ports, border crossings | Network mapping |
| Logistics routes | Primary and alternate shipping lanes | TMS / carrier data |
| Information systems | EDI connections, shared platforms, cloud dependencies | IT architecture review |
Identify single points of failure: any node whose removal would halt production or delivery.
Step 2 — Risk Identification and Categorization
Catalog risks across six domains:
| Risk Domain | Example Risks | Typical Indicators |
|---|
| Supplier risk | Bankruptcy, quality failure, capacity shortfall | Financial ratios, audit findings |
| Demand risk | Sudden demand spike/collapse, forecast error | Demand variability, market signals |
| Operational risk | Equipment failure, labor disruption, IT outage | Maintenance logs, incident history |
| Environmental risk | Natural disaster, pandemic, climate events | Hazard maps, epidemiological data |
| Geopolitical risk | Trade wars, sanctions, regulatory changes, conflict | Country risk indices, policy tracking |
| Cyber risk | Ransomware, data breach, system compromise | Vulnerability scans, threat intel |
For each risk, document the trigger event, affected nodes, and propagation path through the network.
Step 3 — Risk Quantification
Score each identified risk using a probability-impact matrix:
Probability Scale:
| Rating | Probability | Description |
|---|
| 1 | < 5% | Rare — unlikely in next 3 years |
| 2 | 5-15% | Unlikely — possible but not expected |
| 3 | 15-40% | Possible — could occur within 1 year |
| 4 | 40-70% | Likely — expected within 12 months |
| 5 | > 70% | Almost certain — imminent or recurring |
Impact Scale:
| Rating | Financial Impact | Operational Impact |
|---|
| 1 | < $100K | Minor delay, no customer impact |
| 2 | $100K - $1M | Short delay, limited customer impact |
| 3 | $1M - $10M | Significant delay, some orders affected |
| 4 | $10M - $50M | Major disruption, widespread order delays |
| 5 | > $50M | Catastrophic, production halt, brand damage |
Risk Score = Probability x Impact (range: 1-25).
Classify: Low (1-5), Medium (6-12), High (13-19), Critical (20-25).
Step 4 — Disruption Scenario Modeling
Develop and analyze 3-5 realistic disruption scenarios:
| Scenario | Duration | Revenue Impact | Recovery Time | Probability |
|---|
| Single critical supplier failure | 4-12 weeks | $X M | 8-16 weeks | Medium |
| Port closure / logistics blockage | 2-6 weeks | $X M | 4-8 weeks | Medium |
| Regional natural disaster | 2-8 weeks | $X M | 6-20 weeks | Low-Medium |
| Pandemic / workforce disruption | 8-26 weeks | $X M | 12-52 weeks | Low |
| Cyber attack on key system | 1-4 weeks | $X M | 2-8 weeks | Medium |
For each scenario, model the cascading effects through the supply chain: which products are affected, which customers impacted, and what is the time-phased financial exposure.
Step 5 — Mitigation Strategy Development
Define mitigation actions mapped to the highest-priority risks:
| Strategy | Applicable Risks | Investment Level | Risk Reduction |
|---|
| Dual / multi-sourcing | Supplier failure, capacity | Medium | High |
| Safety stock buffering | Demand, supplier, logistics | Medium | Medium |
| Near-shoring / reshoring | Geopolitical, logistics | High | High |
| Contractual protections | Supplier, compliance | Low | Medium |
| Supplier development | Quality, capacity | Medium | Medium |
| Digital supply chain twin | All operational risks | High | Medium-High |
| Insurance / hedging | Environmental, financial | Low-Medium | Medium |
| Inventory pre-positioning | Logistics, environmental | Medium | Medium |
Assign each mitigation an owner, budget, and implementation timeline.
Step 6 — Contingency Planning and Response Playbooks
Create actionable playbooks for each critical scenario:
| Playbook Component | Content |
|---|
| Trigger criteria | Specific conditions that activate the playbook |
| Incident commander | Named role with decision authority |
| Communication plan | Internal escalation + customer/partner notification |
| Immediate actions (0-48h) | Secure supply, activate alternates, assess scope |
| Short-term actions (1-4 wk) | Reallocate inventory, expedite alternatives, manage demand |
| Recovery actions (1-6 mo) | Qualify new sources, rebuild buffer, root cause analysis |
| Post-incident review | Lessons learned, playbook updates, metric recalibration |
Test playbooks through tabletop exercises at least annually.
Output Format
## Supply Chain Risk Assessment — [Scope] — [Date]
### Executive Summary
- Total risks identified: [count]
- Critical risks: [count] | High: [count] | Medium: [count] | Low: [count]
- Maximum single-event exposure: [$X M]
- Current resilience score: [X/100]
- Top 3 risks requiring immediate action: [list]
### Supply Chain Map Findings
- Single-source dependencies: [count] ([% of critical components])
- Geographic concentration: [top 3 locations and % of supply]
- Tier 2+ visibility: [% mapped]
### Risk Register
| ID | Risk Description | Domain | Probability | Impact | Score | Trend | Owner |
|-----|---------------------------|--------------|-------------|--------|-------|-------|-------|
| R01 | ... | ... | ... | ... | ... | ... | ... |
| R02 | ... | ... | ... | ... | ... | ... | ... |
### Scenario Analysis Summary
| Scenario | Exposure | Recovery Time | Preparedness |
|------------------------------|-------------|---------------|--------------|
| ... | ... | ... | ... |
### Mitigation Plan
| Risk ID | Mitigation Action | Owner | Budget | Timeline | Status |
|---------|-----------------------------|-------|--------|------------|--------|
| R01 | ... | ... | ... | ... | ... |
### Contingency Readiness
| Scenario | Playbook Status | Last Tested | Next Exercise |
|---------------------|-----------------|-------------|---------------|
| ... | ... | ... | ... |
### Recommendations
1. [Immediate actions — next 30 days]
2. [Short-term investments — next quarter]
3. [Strategic initiatives — next 12 months]
Quality Checklist
Edge Cases
- Complete lack of Tier 2+ visibility: Use industry databases, supplier questionnaires, and third-party mapping services; start with the highest-spend Tier 1s and work backward.
- Emerging risk with no historical precedent: Use analogous events from other industries; conduct structured expert elicitation; apply scenario planning rather than probabilistic models.
- Interconnected risks (cascading failure): Model dependencies between risks using fault trees or bow-tie analysis; a single event may trigger multiple simultaneous failures.
- Global pandemic or systemic crisis: Standard risk scoring underweights correlated, system-wide events; supplement with stress testing that assumes multiple simultaneous failures.
- Supplier unwilling to disclose sub-tier information: Invoke contractual transparency clauses; use third-party intelligence; treat opacity itself as a risk factor that raises the supplier's score.
- Rapidly changing geopolitical environment: Increase risk review frequency from quarterly to monthly; subscribe to real-time trade policy and sanctions alert services; pre-qualify alternative sources in stable regions.
