Dependency mapping and enterprise risk statements

At a fictional manufacturer, a critical supplier stops delivering, liquidity falls, and the currency used to buy materials strengthens during the same week. A dashboard shows three separate red squares. They may tell one connected story: supplier delay interrupts production, production delay postpones customer receipts, and the cash shortage forces an alternative purchase at a premium and a worse exchange rate. Yet if the currency moved before the outage, part of its effect may be independent. The consultant should not average three colours; she maps the paths and tests timing. One shock can create several impacts, which should not be counted repeatedly as separate losses. Conversely, two independent shocks can occur together; forcing them into one causal story hides the need for distinct responses.

Start with a risk statement that supports a decision rather than a label such as ‘supplier risk’. For example: ‘If the sole supplier of component X stops for two weeks, committed deliveries may be delayed, reducing customer cash receipts before a loan payment and threatening the firm’s monthly liquidity limit.’ This names the exposure, event, duration, impact pathway and affected objective. It is a revisable hypothesis, not a prediction that the event will occur. Separate the driver, such as single-supplier dependence, from the event, such as a factory outage, and the consequence, such as delayed receipts. Different treatments then become testable: a second approved supplier reduces dependence, safety stock absorbs a short interruption, and committed financing may bridge cash but cannot restore production.

Draw a simple map with evidence and timing attached to each arrow: supplier → component availability → production days → delivery date → invoice → collection → cash balance. Add a currency path to the alternative component cost and a credit-limit path to the ability to fund inventory. Do not draw an arrow merely because two variables moved in the same week. Ask for a transmission mechanism, whether the proposed cause preceded its consequence, and whether the relationship persists after another factor is considered. Weak demand might have reduced both cash and production while supplier news happened at the same time. Test confirmed orders and usable inventory before attributing all lost sales to the supplier.

Separate concentration from dependency. Sourcing from one firm is a structural concentration, measurable by its share of purchases or the share of products without an approved substitute. Dependency describes how that firm’s failure reaches output and cash. It could receive only 20% of spend yet supply a component needed on 80% of production lines; spend share would understate impact. Two nominal suppliers in the same region using the same port may provide little real diversification. Test shared transport, power, financing and ownership. A longer vendor list alone is not evidence of reduced exposure.

Do not stop the map at the loss. Add warning points before it: days of critical stock, supplier shipment confirmation, substitute production lead time and cash headroom before debt service. Each needs a definition, owner, update frequency and action when a threshold is crossed. The recommendation becomes executable: qualify an alternative before stock falls below five days, not after the line stops. In the board report, explain that currency exposure may overlap with the substitute premium and that loss ranges cannot simply be added until overlap is removed. Enterprise risk is about effects on a common objective, not a list of silos that pass responsibility around.

Test the map against a second route to the same outcome. Cash might fall because a supplier halted production, or because the firm bought too much inventory before weak seasonal demand. Drawing only a supplier-to-cash arrow invites an expensive second supplier while leaving purchasing discipline untouched. Compare purchase-order dates, usable stock, confirmed customer orders and collections to estimate each route’s contribution. Ask the counterfactual: without the outage, would cash still have crossed the boundary after the earlier spending? If yes, the outage accelerated a pre-existing gap rather than being its sole cause. Treatment order changes: a purchase cap and cash plan may be needed before costly supplier diversification. The board need not see an enormous network; show two principal paths and dotted arrows for relationships still unproved, with evidence in an appendix.

Risk pathways move at different speeds, so one response cannot cover them all. Safety stock may absorb five days immediately but cannot remove annual dependence on a single port; a second supplier needs qualification before becoming real capacity. Add estimated transmission time and supporting evidence to each arrow. If a production halt takes three days to affect cash, there may be time to negotiate delivery or arrange temporary funding. A digital service outage may damage the objective immediately and requires ready response before the event. Timing distinguishes prevention of the initiating event, a barrier that slows propagation and recovery that shortens impact. Spending on the wrong link can leave the objective exposed.