Skip to content

Supply Chain Mapping

Method — instantiates Dependency Exposure

Traces physical dependencies upstream through multiple supplier tiers — parts, materials, facilities, transport routes, geographies — to reveal the hidden convergence that a direct-vendor view can never see.

You know who you buy from. You usually don't know who they buy from — and that is where the surprise lives. Supply Chain Mapping traces physical dependencies upstream through multiple tiers: past your direct (tier-1) suppliers to their suppliers, and theirs, following parts, raw materials, factories, transport routes, and geographies until the picture is deep enough to matter. Its distinguishing move is multi-tier reach and the concentration it exposes: the fact that your four "independent" suppliers all depend, three tiers up, on a single factory, a single port, or a single region. That convergence is invisible from a direct-vendor list and is precisely the fragility this method exists to surface. It is dependency exposure aimed at the physical, upstream world.

Example

An automaker feels well-hedged on a critical sensor: it dual-sources from four different tier-1 suppliers on three continents, so no single vendor failure can stop the line. Supply Chain Mapping tests that comfort by tracing upstream. Tier-1: four suppliers, genuinely independent. Tier-2: their board assemblers, still fairly diverse. Tier-3: the actual sensor chip — and here the branches collapse. All four tier-1 suppliers, it turns out, ultimately source that chip from one specialized fab in one seismic region.

The apparent diversification was an illusion. A single event upstream — the kind of foundry or regional disruption that produced the recent global chip shortages — would idle every one of the four "independent" paths at once. The map converts a hidden n-tier convergence into a marked single point of failure, which is what justifies the expensive next steps: qualifying a second fab, or buffering that one chip specifically, rather than adding yet another redundant tier-1 that shares the same upstream.

How it works

The method's distinctive discipline is bounded upward tracing. It starts from the finished product and walks the depends-on relations toward their origin, but because the upstream tree branches without limit, its first real decision is the scope boundary: how many tiers deep and which commodities are worth the effort, since mapping everything to the mine is impossible and mapping only tier-1 is useless. Within that boundary it records supplier, facility, material, and route relations as a map, then looks for the pattern that direct views miss — convergence, where independent-looking branches share an upstream node, a chokepoint route, or a single geography. Concentration, not just existence, is what it is hunting for.

Tuning parameters

  • Tier depth — how many levels upstream to trace. Each tier deeper reveals hidden convergence but costs sharply more effort and runs into suppliers who won't disclose their own sources.
  • Commodity scope — whether to map all inputs or only the critical, hard-to-substitute ones. Focusing on the few chokepoint materials is usually where the leverage is.
  • Concentration lens — whether convergence is measured by supplier, by facility, by transport route, or by geography. The same chain can look diversified on one axis and dangerously concentrated on another.
  • Disclosure reliance — how much the map depends on suppliers truthfully naming their sources. Upstream tiers are often opaque, and an unverified tier-3 claim can hide the very convergence you're looking for.

When it helps, and when it misleads

Its strength is seeing what direct procurement cannot: it repeatedly overturns a false sense of diversification by revealing that nominally independent suppliers share a hidden upstream origin, a single logistics chokepoint, or a single vulnerable region. It is the mechanism when physical, upstream concentration is the danger and when the failure that hurts you originates several steps beyond anyone you have a contract with.

Its central difficulty is visibility: you generally can't see past the tiers your suppliers are willing to disclose, so the map's deep levels are often incomplete or based on unverified claims — and a convergence that hides in an un-mapped tier is exactly the one that will surprise you. It is also effortful, and it maps structure, not likelihood — a marked chokepoint isn't necessarily a probable failure, just a concentrated one. The discipline is to bound the effort to the commodities that matter, verify critical upstream claims rather than trusting them, and treat a mapped convergence as a candidate for real mitigation (a qualified alternate, a targeted buffer) rather than a finding to file. A dependency on a sole source — the only qualified supplier of an item — is the concentration this method most needs to flag[1].

How it implements the components

  • dependency_scope_boundary — its first decision is how many tiers deep and which commodities to trace, keeping an otherwise infinite upstream search bounded and reviewable.
  • dependency_map — it records the physical depends-on relations (supplier, facility, material, route) across tiers as an upstream map.
  • single_point_of_failure_marker — its core payoff: marking the upstream convergence points where independent-looking branches collapse onto one shared source, chokepoint, or geography.

It does not read the contracts governing those suppliers (Contract and SLA Review), rate providers and assign relationship owners (Vendor Risk Map), or design the buffers and alternates a flagged chokepoint calls for (FMEA Dependency Table).

  • Instantiates: Dependency Exposure — Supply Chain Mapping applies the archetype to physical, multi-tier upstream dependencies.
  • Sibling mechanisms: Vendor Risk Map · Contract and SLA Review · Assumption Log · Architecture Dependency Review · Critical Dependency Dashboard · Dependency Graph · Dependency Registry · Dependency Review Workshop · FMEA Dependency Table · Impact Analysis · Software Bill of Materials

Notes

Supply Chain Mapping and Vendor Risk Map are complementary, not redundant: the vendor map looks outward at the providers you contract with and rates them; supply-chain mapping looks upward past them, at the sub-suppliers you have no contract with and often can't see. The upward view is where shared-origin concentration hides.

References

[1] A sole-source dependency (only one qualified supplier exists) differs from a single-source one (you chose one of several available). Supply Chain Mapping is what distinguishes them at depth — and a sole source discovered several tiers upstream, behind apparently diverse direct suppliers, is the highest-value thing the method finds. ↩