How to map the supplier dependencies your purchase ledger misses

The purchase ledger is a starting point for supply chain mapping, not the finished map. It records commercial transactions, while production depends on physical capabilities. An automotive component might pass through several specialist operations before delivery, and two approved suppliers might use the same one. A useful dependency map shows where the business can lose the ability to make an acceptable product.

Follow the product through its route

Begin with a defined component or product family. Trace the operations that create its required characteristics, including external treatments, material preparation, inspection and specialist testing. Record the site performing each critical operation. Use a consistent description of capability so that purchasing, engineering and operations recognise the same dependency.

Ask first-tier suppliers to explain their route with enough detail to assess continuity. The request need not demand every commercial detail of their business. Focus on the inputs and processes whose interruption would affect your deliveries. State the purpose, the handling of sensitive information and how updates will be exchanged.

Distinguish evidence from assumptions

Label information according to its status. A supplier assertion, a reviewed production record and a witnessed alternative-site trial offer different levels of confidence. Record the date and owner of each item. A map that looks precise but mixes confirmed and assumed relationships can create false reassurance during a disruption.

NIST's supplier risk guidance discusses looking beyond the first tier. The practical application is to identify the next unanswered decision. If a shared processor appears critical, determine whether another process route is technically feasible, who can approve it and what evidence qualification would require. Mapping should direct that work rather than become an end in itself.

Look for concentrations across programmes

Review the map across customer programmes, not only within individual parts. A specialist furnace, material grade or logistics route may support unrelated components. These shared dependencies can turn several small purchasing exposures into one significant operational risk. Include internal assets as well, particularly dedicated inspection equipment and people holding scarce process knowledge.

Do not treat geographic proximity as proof of independence. Nearby suppliers can share utilities, transport constraints or specialist subcontractors. Conversely, distant suppliers can provide distinct capabilities with different recovery options. Assess the actual dependency, avoiding a ranking based solely on supplier postcode or procurement category.

Keep the map connected to decisions

Use changes in engineering, sourcing and supplier location as triggers for review. Agree who maintains the map and which changes suppliers should report. Connect critical nodes to continuity actions, such as alternative qualification, tool transfer preparation or a buffer decision. Each action should have an accountable owner and an evidence requirement.

During a review meeting, ask whether the business now understands where a failure would stop delivery and what it would do next. If the map cannot answer those questions, more detail alone will not help. The objective is a maintained picture of operational dependence that supports investment, sourcing and recovery decisions.