Ask a small team which supplier they could not live without and you get a name. Ask what happens the Monday after that name stops answering and you get a shrug — because the dependency lives on an invoice, and invoices never made it onto the risk register.
The supplier concentration map is the antidote, and it is one page: six columns built from the purchase ledger in an afternoon — supplier (the legal entity on the invoice, not the rep's first name), what it gates (the operational thing that stops: all customer cartons, the only powder-coat line within 300 km), share of revenue through it, time-to-first-damage (hours for packaging, days for standard components, weeks for tooling), second-source status (qualified / on paper / none — a name in someone's head is "none" with better handwriting), and the exit ramp: the specific first move, "merchant 40 minutes south, 3-day lead, +4 percent," not "find someone."
The 20% gate turns the share column into obligations: above 20% of revenue through one supplier, a qualified second source becomes a dated line item this quarter; 10–20%, a second source on paper verified twice a year; under 10%, know the fallback name and the order floor.
The damage clock decides the order of work, not the dollar column. Four days of packaging stock means a packaging outage reaches customers in four days — faster than most incident processes wake up. The highest-concentration supplier with the shortest clock gets its second source first.
The 30/60/90 exit ramp hedges without breaking up: days 0–30 samples and a written price (evidence, not a relationship); days 31–60 move 10% of real volume — a small order teaches you how they package, invoice, and behave when something goes wrong; days 61–90 make the split the default and write it into the next renewal. An untested second source is a hope with a logo.
Five traps: building the map from the AP ledger alone (it misses the exclusive distributor and the tooling shop nobody else can run — ask the floor what stops if this stops arriving); "they'd never fail us" (friendship is not capacity, and capacity is not priority — when allocation gets tight, contracts and volume get fed); dual-sourcing the cheap stuff while the exclusive line that gates revenue stays unmapped; paper diversity — two suppliers, one upstream factory (one question: where is this made?); and the map never re-run — concentration creeps through savings consolidation and loyalty pricing, so rebuild it every quarter.
The worked example: a nine-person joinery with 78% of sheet goods through one regional distributor — the concentration that earned the best pricing in the region, and four quiet years that made it invisible. Then the distributor's parent tightened credit terms, the account froze for nine business days over a disputed invoice, and 4-day board leads became 21 days — with $46,000 of contracted fit-outs scheduled into exactly that window. They found out on a Tuesday, from the delivery driver.
One afternoon and the map ranked it: sheet goods 78% share, eleven-day damage clock. A timber merchant 40 minutes south quoted in two days — 3-day lead, +4%, samples passed the same week. The 30/60/90 ramp ran through the quarter: 10% real volume in month one, 30% by month two, the split written into the annual pricing conversation with both suppliers. The hedge cost about $1,900 a year — roughly one delay fee, never mind two. Eight months later the distributor's own supply chain broke for three weeks, and the joinery shipped both remaining fit-outs on time on a 70/30 split nobody had to improvise. The counterfactual ends with the delivery driver delivering the bad news about your biggest quarter.
The full page — with the map columns in detail, the traps, and the worked example — lives at Hive Ops Notes.
Free: The First 30 Minutes — the incident quick-start checklist. If your operation needs the full system: Ops Starter Kit ($14), Ops Starter Kit Vol. 2 ($27), or the Ops Mega Bundle (all 5 kits, $49).
Top comments (0)