How to build a supplier risk scorecard for single-source components

When a BOM review turns up a part with one approved supplier, the usual next step is a line item on a risk register and a promise to "look into dual sourcing" sometime after the next launch. A scorecard is what keeps that promise from dying in a spreadsheet nobody reopens.

What the score needs to capture

A single-source risk score isn't one number pulled from a gut feeling. It's a roll-up of a few things procurement and engineering can each defend on their own:

• Part criticality. Does this component sit on every SKU, or one low-volume variant? A connector used across six product lines scores differently than one used on a single end-of-life unit.
• Supplier concentration. One plant, one line, one region. If the supplier's own BOM depends on a sub-tier single source, that risk inherits upward.
• Switching cost. Tooling owned by the supplier, custom fixtures, qualification lead time. A part that takes eighteen months to requalify scores worse than one with a drop-in alternate.
• Geographic and geopolitical exposure. Tariff lanes, port congestion history, a region prone to power curtailment. This is the column teams most often fill from memory instead of data, and it's the one that ages fastest.
• Capacity headroom at the supplier. A plant running at 95% utilization with no announced expansion is a different risk than one with slack.

Weight these the way your category strategy already weights cost, quality, and delivery risk. The scorecard only earns trust when it uses the same rubrics the team relies on elsewhere, not a new one invented for this exercise.

Turning the scorecard into a single-source risk register

A register is the scorecard applied across the BOM, then sorted. Columns worth keeping:

1. Part number and description
2. Current supplier and site
3. Annual spend or volume
4. Risk score (from the components above)
5. Mitigation status: dual-source qualified, in progress, or still open
6. Owner and review date

The register earns its keep when a handful of top-scored parts get a named owner and a next action, not when it's a 400-row file someone updates once a year before an audit. Most teams find the top 10 to 15% of parts by score account for most of the exposure. Start there.

Where the register stalls: finding the second source

This is the step that actually stalls most single-source mitigation plans. The scorecard tells you which parts need a backup supplier. It doesn't tell you where to find a plant that can make the part the way your current supplier does: same process type, comparable scale, logistics that won't blow up the landed-cost model.

Sourcing teams usually start this step the same way: a directory search by NAICS code, a trade-fair floor, a broker's book of contacts. All of it returns companies that claim to do the work. None of it tells you, before a plant visit gets booked, whether the candidate's facility resembles the one you already qualify against. A search that starts from the reference supplier's own site and finds plants that physically match it, same plant type, similar scale, comparable logistics access, gets a ranked shortlist in front of the register's named owner instead of a list of cold-call leads.

Keeping the scorecard current

A score built once at launch is a snapshot, not a risk register. Revisit it on a cadence tied to real triggers: a supplier ownership change, a new plant announcement, a BOM revision that changes volume on the part. Annual review is the floor for anything scoring in the top tier, not the target.

The scorecard's job is narrow. It tells you which parts are exposed and ranks them. What happens after that, finding and qualifying the second source, is where the real time goes. Worth starting that search with a shortlist that already looks like your reference supplier, not a cold list of names.