Operational Resilience and Supply Chain Risk: How to Protect Critical Operations from Third-Party Disruption

Operational resilience depends increasingly on the reliability of suppliers, contractors, logistics partners, technology providers and sub-suppliers. A disruption outside the organization can quickly interrupt production, compromise safety, delay customer deliveries or block access to critical systems. This article explains how companies can identify critical third parties, map hidden dependencies, monitor early warning indicators and prepare realistic mitigation strategies before a supplier failure becomes an operational crisis.

Introduction

Operational resilience and supply chain risk have become inseparable. A company may control its plants, procedures and internal systems effectively, yet remain exposed to a single supplier, a specialist contractor, a logistics hub, a software platform or an unknown sub-supplier.

When one of these external dependencies fails, the consequences can move quickly across the organization. Production slows down. Maintenance stops. Materials become unavailable. Digital services fail. Safety controls weaken. Customers experience delays. Managers must then make urgent decisions with incomplete information.

Protecting critical operations therefore requires more than a supplier list or a procurement scorecard. The organization must understand which external relationships support its essential activities, how long those activities can tolerate an interruption and which alternatives can work under real operating conditions.

As explained in the AR19 article on operational resilience beyond business continuity, resilience means maintaining control of critical activities while disruption unfolds. It includes prevention, preparation, response, adaptation, recovery and organizational learning. Supply chain resilience applies this same logic to suppliers, contractors, technologies and business partners.

In summary

Supply chain resilience starts by identifying the activities that the organization cannot afford to lose. The company must then map every supplier, contractor, technology, skill and sub-supplier that supports those activities. Effective resilience combines due diligence, early warning indicators, contractual safeguards, alternative sourcing, scenario testing and clear cross-functional governance. The goal is not to eliminate every disruption. The goal is to keep its impact within an acceptable level.

Why does supply chain risk threaten operational resilience?

Supply chain risk threatens operational resilience because many critical business activities depend on resources that the organization does not control directly.

These resources may include raw materials, components, specialist maintenance, outsourced processes, cloud services, software updates, transportation, energy, laboratory testing, technical certifications or external personnel. A problem affecting any of them can become an operational interruption.

The risk increases when the organization depends on:

• one supplier or one production site;

• a component with a long replacement lead time;

• a contractor with unique technical knowledge;

• a digital provider integrated into several processes;

• a logistics route with no practical alternative;

• a supplier that depends on an unknown sub-supplier;

• one geographical area for several critical resources.

These conditions create single points of failure. The commercial value of the contract does not always reveal them. A relatively inexpensive component, licence or service may support an operation worth millions.

ISO/TS 22318 extends business continuity principles to supplier relationships. It focuses on organizations that rely on a continuous supply of resources and need to preserve their ability to deliver products and services. ISO 28000 also provides requirements for security management systems that cover relevant aspects of the supply chain.

Companies should therefore evaluate suppliers according to operational impact, rather than purchasing volume alone.

Which suppliers and third parties should a company consider critical?

A company should consider a third party critical when its failure could interrupt an essential activity beyond the organization’s acceptable tolerance.

This definition includes more than traditional suppliers. It can cover contractors, consultants, outsourced laboratories, maintenance providers, logistics operators, cloud platforms, software vendors, data processors and utility providers.

The assessment should begin with the business activity. Leaders should ask what the organization must continue to deliver during a disruption. They can then trace the resources that support that output.

A supplier becomes particularly critical when it combines several factors:

• low substitutability;

• high operational impact;

• long recovery or replacement time;

• limited stock or capacity buffers;

• geographical or technological concentration;

• access to sensitive systems or facilities;

• responsibility for high-risk operations;

• dependency on further subcontractors.

A supplier can also become critical over time. A temporary contract may gradually expand. A digital tool may become embedded in several workflows. Internal expertise may disappear after years of outsourcing. The organization may then discover that it can no longer operate, repair or recover the process without external support.

For this reason, supplier criticality needs periodic review. Procurement data alone cannot provide the full picture. Operations, maintenance, HSE, quality, IT, finance and risk management must contribute to the assessment.

How can companies map critical supply chain dependencies?

Companies can map critical dependencies by connecting each essential activity with the people, assets, technologies, information and third parties required to deliver it.

The process should start with a business impact analysis or an equivalent operational assessment. The organization identifies the outputs that matter most, establishes the maximum tolerable disruption and maps the resources that support them.

A practical dependency map should answer these questions:

1. Which activity or service must continue?

2. What happens if it stops?

3. How long can the company tolerate the interruption?

4. Which internal and external resources support it?

5. Which supplier, site, technology or skill represents a single point of failure?

6. How long would a real replacement take?

7. Which sub-suppliers or subcontractors sit behind the direct provider?

8. Which alternative could operate under the same technical, safety and quality conditions?

This approach differs from a normal vendor register. A vendor register describes the commercial relationship. A resilience map explains how disruption can travel from a third party into the organization.

Financial regulators have developed a similar principle for important business services. The Financial Conduct Authority expects organizations within its scope to map the people, processes, technology, facilities, information and third parties required to deliver those services. The wider management lesson applies to industrial and service companies as well: start from the critical output and work backwards through every dependency.

The map must reflect actual operations. Interviews, process walkdowns, field observations and scenario workshops often reveal dependencies that contracts and procedures do not show.

Which weak signals can reveal growing supplier risk?

Weak signals can reveal growing supplier risk before delays, failures or incidents become critical.

Companies often monitor lagging indicators such as missed deliveries, defects or formal non-conformities. These indicators remain useful, but they describe problems that have already occurred. Operational resilience also requires leading indicators.

Potential warning signs include small but recurring delivery delays, increasing use of emergency shipments, unstable product quality, repeated staff changes, slower technical support, unresolved corrective actions and frequent requests for contractual exceptions.

Other signals may come from the supplier’s organization. Financial pressure, rapid turnover, restructuring, loss of specialist personnel or dependence on temporary workers can affect operational reliability. A change of ownership or production location can also alter the original risk profile.

Digital suppliers require specific indicators. Companies should monitor recurring service interruptions, delayed vulnerability management, unclear subcontracting arrangements, expired access reviews, weak incident communication and incomplete recovery tests. NIST SP 800-161 recommends integrating cybersecurity supply chain risk management into the wider enterprise risk process and considering risk across products, services and organizational levels.

AR19’s methodology places particular attention on weak signals, predictive KPIs and the quality of organizational routines. The objective is to recognise emerging conditions before they become incidents or business interruptions.

Useful leading indicators may include the percentage of critical suppliers with a tested continuity plan, the number of overdue audit actions, the share of critical spend under single sourcing, the response time during escalations and the percentage of sub-tier dependencies already mapped.

Each indicator needs an owner, a threshold and a predefined action. Otherwise, the dashboard describes risk without changing decisions.

How should procurement, operations, HSE and IT manage third-party risk together?

Procurement, operations, HSE, IT and risk management should manage third-party risk through one shared governance model.

Each function sees a different part of the exposure. Procurement understands contracts, commercial leverage and supplier relationships. Operations understands process constraints and the consequences of downtime. HSE evaluates safety, environmental and contractor risks. IT and OT teams understand system access, data flows and digital dependencies. Risk management connects these elements and supports prioritisation.

Problems emerge when functions work separately. Procurement may select a cost-efficient supplier without seeing a technical single point of failure. Operations may accept an urgent contractor without completing the required risk assessment. IT may introduce a cloud service without a tested exit plan. HSE may identify a contractor weakness that never reaches the supplier performance review.

An integrated governance process should define:

• one classification method for critical third parties;

• named internal owners;

• minimum due diligence requirements;

• escalation thresholds;

• audit and monitoring frequency;

• incident communication rules;

• responsibilities during disruption;

• periodic management review.

Leadership plays a central role. Managers must decide when efficiency gains no longer justify concentration risk. They must also allocate resources to alternatives, buffers, testing and capability development before a disruption creates urgency.

The AR19 approach to risk management, operational resilience and sustainability links governance, leadership, safety culture and predictive indicators. This integrated model helps organizations avoid treating supplier risk as a procurement issue alone.

Which strategies improve supply chain resilience?

The most effective strategy depends on the nature of the dependency, because dual sourcing does not solve every supply chain risk.

For standard materials, the company may qualify a second supplier or distribute volumes across different geographical areas. For specialist services, it may develop internal knowledge, negotiate emergency support or qualify another technical partner.

For components with long lead times, the organization may increase strategic stock, standardise specifications or redesign the product. For logistics risk, it may approve alternative carriers, routes, ports or warehouses.

Digital dependencies require other measures. These may include data portability, backup procedures, controlled update processes, alternative access methods, tested recovery arrangements and contractual support during transition.

Typical resilience strategies include:

• dual or multi-sourcing;

• strategic stock and capacity buffers;

• product or process redesign;

• alternative technologies or materials;

• cross-training and internal capability development;

• stronger supplier continuity plans;

• contractual audit and notification rights;

• restrictions and controls on subcontracting;

• joint recovery exercises;

• documented exit and transition plans.

Contracts support resilience when they reflect operational reality. They should define incident notification, service levels, audit rights, continuity requirements, subcontracting conditions, access to evidence and exit obligations.

The NIS2 framework confirms the growing importance of these controls. Article 21 includes supply chain security among cybersecurity risk-management measures and requires relevant organizations to consider the vulnerabilities and security practices of direct suppliers and service providers. The related Implementing Regulation 2024/2690 details measures such as security clauses, incident notification, audit rights, vulnerability management and controls over subcontracting for entities within its scope.

These rules apply to specific sectors and entities. However, the underlying management principles offer useful guidance to any organization with critical digital dependencies.

How can organizations test supplier disruption scenarios?

Organizations can test supply chain resilience through realistic scenarios that challenge assumptions, roles and alternatives.

A written continuity plan does not prove that a backup supplier can meet technical requirements. A contract does not prove that a digital provider can recover within the required time. A list of emergency contacts does not prove that people will answer or make the right decisions under pressure.

A useful exercise should start with a severe but plausible event. Examples include the sudden loss of a strategic production site, the failure of a cloud provider, a cyber incident at a logistics partner, the insolvency of a single-source supplier or the unavailability of specialist contractor personnel.

The exercise should verify:

• how quickly the company detects the problem;

• who receives the first warning;

• who has authority to escalate;

• which activity faces interruption;

• whether the impact remains within tolerance;

• whether alternative suppliers can meet quality and safety requirements;

• how the company communicates with customers and stakeholders;

• which decisions require senior management approval.

Tabletop exercises test coordination and decision-making. Technical tests verify backups, access, data recovery or alternative systems. Operational simulations test stock, logistics, equipment, contractor availability and manual workarounds.

After each exercise, the organization should update its dependency map, procedures, indicators and investment priorities. Testing creates value when it changes the system, rather than simply confirming that an exercise took place.

What can companies learn from major third-party disruptions?

Major disruptions show that supply chain risk can originate from physical concentration, digital dependence or hidden technical complexity.

In 2021, a fire affected the Renesas Naka semiconductor plant. The disruption attracted attention because semiconductors supported several downstream manufacturing activities. Renesas restored the plant’s pre-fire production level by June 24, while Toyota described how its technical teams contributed to the recovery by helping reconstruct damaged equipment. The case shows the value of understanding critical sub-tier dependencies and maintaining enough technical knowledge to support recovery.

In July 2024, a defective CrowdStrike content update affected Windows systems across many organizations. Microsoft estimated that the event affected approximately 8.5 million Windows devices. The incident demonstrated how one digital supplier can create widespread operational consequences across different sectors.

These cases involved different causes, but they point to the same question: which critical activity would stop if this external dependency became unavailable?

The answer cannot emerge during the crisis. The organization must establish it through mapping, monitoring and testing.

How does AR19 support operational resilience across the supply chain?

AR19 supports supply chain resilience by connecting technical risk assessment with culture, leadership, field behaviour and organizational performance.

A resilient relationship with suppliers and contractors depends on more than contractual compliance. People must understand risks, report anomalies, communicate clearly and act consistently across organizational boundaries.

AR19 applies assessment, management engagement, leadership development, safety coaching, predictive KPIs and strategic review to complex operational environments. Its experience also includes contractor safety culture and vertical supplier audits designed to identify deeper causes, evaluate operational practices and strengthen shared risk awareness.The audit coaching approach for external suppliers and partners combines verification with field observation, dialogue and capability development. It helps organizations move beyond a purely documentary audit and understand how the supplier actually manages risk during everyday operations.

This approach can support companies that need to:

• classify critical suppliers and contractors;

• map operational and cultural vulnerabilities;

• strengthen contractor governance;

• define predictive supplier KPIs;

• improve risk communication and escalation;

• conduct vertical audits and field assessments;

• test disruption scenarios;

• develop a practical resilience roadmap.

The objective is to transform third-party risk from a fragmented control activity into a shared management capability.

Conclusion: supplier resilience must start before disruption

A company cannot build supply chain resilience by reacting faster after a supplier has already failed. It must understand critical dependencies before the interruption occurs.

The first decision involves identifying which operations truly matter. The second involves mapping the suppliers, contractors, technologies and sub-suppliers that support them. The third involves testing whether monitoring systems, alternatives and escalation processes work under real conditions.

Each organization will reach a different answer. Some need dual sourcing. Others need strategic stock, product redesign, stronger contractor governance or better digital exit plans.

The most important shift concerns perspective. Supplier management should not focus only on cost, delivery and quality. It should also protect the organization’s ability to operate safely, reliably and within acceptable impact limits when external conditions change.

FAQ

What is third-party disruption?

Third-party disruption is an interruption caused by an external supplier, contractor, technology provider or business partner. It can affect production, logistics, safety, digital systems, customer service or regulatory compliance.

How can a company identify a critical supplier?

A company can identify a critical supplier by assessing the operational impact of its failure, the time required to replace it, the availability of alternatives, its geographical or technological concentration and its role in critical activities.

Is dual sourcing always the best resilience strategy?

No. Dual sourcing works when alternative suppliers can meet the required volume, quality, safety and technical standards. For specialised technologies or services, internal capability development, strategic stock, redesign or recovery agreements may provide better protection.

How often should critical suppliers be reviewed?

Companies should review critical suppliers at least periodically and whenever a major change occurs. Relevant changes include new subcontractors, ownership changes, production relocation, service expansion, incidents, recurring performance deterioration or new digital integrations.

What is the difference between supplier risk management and supply chain resilience?

Supplier risk management evaluates and controls risks associated with individual suppliers. Supply chain resilience takes a broader view. It examines how suppliers, sub-suppliers, logistics, technologies, people and processes interact to support critical business activities during disruption.

Sources

• https://www.iso.org/standard/79001.html

• https://www.iso.org/standard/75106.html

• https://www.iso.org/standard/50053.html

• https://www.iso.org/standard/79612.html

• https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final

Alberto Rosso

CEO/Director AR19