assess-third-party-concentration-risk

name	assess-third-party-concentration-risk
category	data
description	Assess shared supplier dependencies, common-mode exposure, substitution limits, and exit feasibility. Use when apparently diverse vendors, services, regions, or contracts may fail through one hidden dependency.

assess-third-party-concentration-risk

When to use

• Use for portfolio, platform, critical-service, or enterprise supplier concentration decisions.
• Use ordinary vendor performance monitoring for one supplier without systemic dependency concerns.

Preconditions

• Confirm critical outcomes, assessment boundary, risk horizon, supplier-data authority, architecture and contract owners, continuity objectives, decision-maker, and confidentiality controls.

Procedure

1. Build a dependency inventory of direct suppliers, subcontractors, platforms, regions, facilities, networks, identities, data stores, specialists, licenses, and financial dependencies.
2. Map supplier-to-service and service-to-outcome relationships with criticality, volume, replaceability, recovery objectives, contract dates, and evidence confidence.
3. Identify common-mode exposure across parent ownership, cloud, payment rail, logistics route, geography, technology, labor pool, key person, insurer, or regulatory permission.
4. Reconcile contract declarations with architecture, invoices, operational telemetry, incidents, and supplier assurance; retain unknown dependencies visibly.
5. Perform a substitutability test covering functional parity, capacity, interoperability, data portability, security, accessibility, approvals, skills, lead time, and total transition cost.
6. Test exit feasibility through notice rights, assistance, formats, deletion, licenses, source access, knowledge transfer, staffing, parallel run, acceptance, and independent rollback.
7. Stress simultaneous and cascading scenarios rather than treating every vendor failure as independent.
8. Quantify or rank exposure with transparent denominators, confidence, time-to-harm, minimum service, and decision thresholds.
9. Compare mitigation options such as diversification, redesign, inventory, capacity reservation, contractual rights, portability, manual service, and risk acceptance.
10. Assign actions, triggers, residual-risk authority, exercises, and evidence-based review cadence.

Failure plan

• Do not claim diversification from vendor count when suppliers share a parent, platform, route, region, or irreplaceable specialist.
• Stop any live failover or data movement that lacks authorization, protected handling, acceptance checks, and rollback.
• Preserve unknown subcontractors, untested alternatives, contract limits, and capacity gaps as open exposure rather than scoring them away.

Done

• A concentration map traces critical outcomes through direct and common-mode dependencies with confidence and ownership
• A scenario stress test records time-to-harm, minimum service, cascade paths, substitution limits, and recovery decisions
• Substitutability test and exit feasibility evidence cover capacity, data, integration, skill, contract, acceptance, and rollback
• Mitigation verification proves reduced exposure, exercised alternatives, residual-risk approval, and monitored triggers