There is a type of cost that never appears in the budget plan: the cost of an unmanaged supply disruption. It has no dedicated P&L line. It shows up in COGS that exceeds forecasts, in OEE that collapses, in lead times that double, in customers who don't wait. In 2021, that cost became visible for thousands of Italian manufacturing companies at the same moment.

With the post-pandemic global reopening, aggregate demand rebounded faster than supply chains could absorb. Container shipping costs reached historically elevated levels, with increases in the range of 200-300% versus pre-pandemic levels. Average lead times extended significantly across virtually all manufacturing segments. Companies with a single qualified supplier for a critical input had no choice: pay whatever the market demanded, or stop.

Why supplier concentration is not a risk manageable in emergencies

The key distinction is this: supplier concentration is not a risk that can be managed at the moment it materializes. It is a structural risk that materializes before it is possible to qualify alternatives. The time required to qualify a new supplier for a critical input, especially in high-precision sectors or those with regulatory requirements, is measured in months. In many cases, in years.

This means that the response to the 2021 crisis, for companies that had not already built dual sourcing, was at best partial. Emergency suppliers could be sought, at significant premiums. Production could be slowed. The problem could be pushed toward customers. But the vulnerability could not be eliminated in the short term.

The CIPS-GEP 2026 report documents the structural transformation that followed: the Procurement function, traditionally considered operational support, assumed the role of strategic risk oversight. Dual sourcing, second- and third-tier supplier mapping, and geographic diversification of inputs have become operational requirements, not optional best practices.

Dual sourcing is not a cost: it's a real option

The most common objection to dual sourcing is cost: maintaining two qualified suppliers for the same input is more expensive than one. True under normal conditions. It stops being true the moment you factor in the expected cost of the alternative.

Available data from the 2020-2025 period indicate that the cost of dual sourcing, the price differential versus a single supplier plus the qualification and management cost of the second supplier, proved systematically lower than the cost of a single unmanaged disruption. This holds even in cases where the alternative supplier was never actually used: simply having qualified it reduced the company's risk profile in a measurable way.

It follows the same logic as an insurance policy. You don't buy it because you predict the claim. You buy it because the premium cost is lower than the expected damage cost multiplied by its probability. The difference from a policy is that dual sourcing, in stress periods, can actually be used: it is not only passive protection, but also operational capacity.

How to track it: the KPI missing from the Procurement dashboard

The percentage of critical inputs with at least one qualified alternative supplier must become a function KPI, monitored with the same discipline as credit risk or COGS. Vedrai Observatory defines a target of 100%: every input classified as critical must have at least one qualified alternative supplier, preferably from a different geographic origin than the primary source.

Classifying inputs as critical requires assessment across three dimensions: weight on COGS, substitution time in the event of disruption, and availability of qualified alternatives on the market. Not all inputs require dual sourcing: only those for which a disruption would have significant impacts on operational continuity and for which qualifying an alternative is feasible in the medium term.

Monitoring should be done quarterly, with an analysis of changes versus the prior quarter. A decline in the percentage of inputs with a qualified alternative supplier is a warning signal, regardless of reasons. It is the type of deterioration that does not surface in traditional Procurement KPIs and that sets the stage for the next crisis.

Extended mapping: second- and third-tier suppliers

First-tier dual sourcing is not sufficient if the second supplier depends on the same sub-suppliers as the first. This is the hidden risk that the 2021 crisis made visible: in many cases companies had two qualified suppliers, but both sourced from the same geographic area or the same component manufacturers. When the crisis hit that common source, both alternatives were blocked simultaneously.

Mapping second- and third-tier suppliers is operationally complex. It requires the cooperation of direct suppliers, who often protect information about their own supply chain. But it is the necessary condition for building genuine resilience. Companies that in 2025 were least exposed to geopolitical risks were those that had completed this mapping before it became urgent.

Three questions for the CPO

What is the current percentage of critical inputs with at least one qualified alternative supplier from a different geographic origin than the primary source? If you don't have this number, you don't have a measure of supply risk.

For how many of these alternative suppliers has second-tier mapping been completed? An alternative supplier that depends on the same sub-suppliers as the primary does not reduce risk: it conceals it.

What would be the operational cost today of a disruption from the primary supplier for your most relevant critical input? If the answer is "we don't know precisely," this is the number to produce before the next budget cycle.

‍