For most manufacturers, supplier performance is measured by a familiar set of metrics: on-time delivery, product quality, and cost. While these measures are important, they don’t always tell the full story about a supplier’s ability to support production over time.
A supplier can consistently meet delivery commitments while changes across its component portfolio introduce new risks. Lifecycle changes, increasing product change notifications, limited sourcing options, and concentrated manufacturing operations can all signal potential problems long before they affect production.
For engineering and procurement teams, knowing how to spot high-risk suppliers before they disrupt production means looking beyond traditional performance metrics. By connecting component-level intelligence with supplier performance data, teams can identify emerging risks earlier, prioritize the suppliers that need attention, and make more informed decisions while they still have options.
Key Takeaways
- A supplier’s on-time delivery record can look strong even when several of its components are approaching end of life.
- Assess both how much production depends on each supplier and the evidence that its parts may become harder to obtain.
- Lifecycle status, manufacturer notices, sole-source exposure, and production-site concentration can provide warnings before deliveries slip.
- Supplier scorecards are more useful when they combine delivery and quality history with current component-level risk.
- Qualified alternatives give engineering and procurement more choices when a manufacturer announces a change or discontinuation.
What Makes a Supplier High Risk?
A supplier is high risk when a supply problem could significantly affect your program and there are credible signs that such a problem may develop. These are two different questions, and it’s worth answering both.
A supplier risk assessment combines criticality with likelihood. Criticality considers what would happen if supply stopped. Likelihood looks at the warning signs, such as lifecycle changes, manufacturing concentration, and diminishing availability. A manufacturer supplying a unique device on a critical board may deserve closer attention than one supplying dozens of widely available passives. These part-level warning signs reveal potential supply exposure. On their own, they do not establish that a manufacturer is financially distressed or operationally unstable.
For electronics teams, it also matters which supplier you’re evaluating. Procurement may buy through a distributor or contract manufacturer, but the component manufacturer controls many of the lifecycle and production decisions. Good distributor performance doesn’t necessarily tell you whether a device family is being retired.
For a broader look at risk categories and contingency planning, see our Supply Chain Risk Management playbook.
Why Do Supplier Scorecards Miss Early Warning Signs?
Most supplier scorecards focus on on-time delivery, quality, and price. Those are important measures, but they mainly tell you how a supplier has performed so far. They don’t always show whether it will be able to support your next production run, much less the next several years.
Consider a manufacturer that continues shipping on time while moving several components to not recommended for new designs (NRND). A product change notice (PCN) might also announce a production-site transfer. Later, a product discontinuation notice (PDN) may confirm that a part is being retired. Each update requires a different response, but none necessarily affects today’s delivery report.
Taken together, these changes may point to growing exposure. McKinsey Global Institute estimates that companies experience supply chain disruptions lasting a month or longer every 3.7 years on average. That broader risk makes it worthwhile to notice the quieter changes before they become an immediate sourcing problem.
“One of the challenges we see with supplier risk is that companies often have the information they need, but it isn’t always connected to the decisions they’re making. A supplier may be performing well today, while changes to its component portfolio are creating risks for tomorrow. The earlier teams can recognize those changes, the more flexibility they have to respond.”
Sarita Benjamin, General Manager, Supply Chain Intelligence, Accuris
The practical answer isn’t to abandon delivery metrics. It’s to put them alongside the component information that helps explain where future problems might come from.
How Can You Tell When a Supplier Is Becoming High Risk?
Review these indicators for the manufacturers behind your most important parts. A single notice may be routine. A pattern of changes across several parts is a reason to investigate.
- More of the parts you use are moving to NRND, last-time buy (LTB), or end of life (EOL)
- PCNs or PDNs are becoming more frequent, particularly notices about fab or assembly-site changes
- Important parts are available from only one manufacturer, with no qualified alternative
- The manufacturing sites behind your parts are concentrated in one facility or region
- Lead times are increasing while stock at authorized distributors is falling
- RoHS, REACH, or PFAS compliance declarations are missing, delayed or out of date
- Parts are appearing in counterfeit alerts
Recognizing these signs is a useful starting point. The next task is to work out which suppliers could affect your programs most, what the changes mean for the parts you use, and where your team should act first. These six steps provide a practical way to do that.
How to Spot High-Risk Suppliers in 6 Steps
1. Map Every Part in Your BOMs Back to Its Manufacturer
Begin with the manufacturer part numbers in your active bills of materials (BOMs). Check that each identifier is accurate and matched to the right manufacturer. Otherwise, a supplier assessment can miss parts, count the same part twice, or assign risk to the wrong company.
Next, look across programs. One engineering team may see only a few parts from a particular manufacturer, while the same devices appear in several other products. Combining the records makes the dependency easier to recognize.
BOM Intelligence helps with that groundwork by importing and cleansing BOMs, resolving part-number discrepancies, and matching parts against Accuris component records. It’s valuable time back for engineers: Accuris research reports that 58% of teams spend more than 30 hours a month manually cleaning and extracting BOM data.
For example, imagine four programs that each use a manageable number of connectors from one manufacturer. When the BOMs are reviewed together, the team discovers 140 different parts from that maker. The number is illustrative, but the issue is common: supplier exposure is easy to underestimate when reviews happen product by product.
2. Rank Suppliers by How Much Your Production Depends on Them
Start by identifying the suppliers whose interruption would have the greatest effect. This is the criticality portion of a supplier risk assessment. It prevents the team from spending equal effort on a readily replaceable part and a component that could hold up an entire program.
For each manufacturer, look at:
- How many of its parts appear across your active BOMs
- How many are sole-source, meaning you depend on one manufacturer for that part
- How many lack a qualified form-fit-function (FFF) alternate that meets the required physical fit and electrical function
- Which programs depend on those parts, and how much business those programs represent
Use these factors to create a practical priority list. Reviewing the top 10 to 20% of suppliers by criticality can be a useful starting point, although the right cutoff depends on your portfolio. The aim is to focus investigation where a disruption would be hardest to absorb.
Consider two manufacturers. One supplies 300 passive parts, each with several approved alternatives. Another supplies six application-specific integrated circuits that are used in a major program and have no qualified substitutes. The second manufacturer may present the more serious dependency despite supplying far fewer parts.
3. Run a Supplier Risk Analysis on Part-Level Signals
Once you’ve identified the critical manufacturers, look at what is changing in the parts you buy from them. Supplier risk analysis means examining those signals together, rather than treating each manufacturer notice or part shortage as an isolated event.
Pull together:
- Lifecycle status and years-to-EOL forecasts
- PCN and PDN history over the last 12 to 24 months
- Availability and lead time trends at authorized distributors
- Country of origin and production site data
- Compliance declarations for RoHS, REACH, and PFAS
A single NRND designation may not require immediate action. But if many of the components you use from one manufacturer move toward discontinuation over a relatively short period, it deserves a closer look. The same applies to repeated production-site transfers or a steady decline in authorized stock.
Parts Intelligence brings lifecycle forecasts, PCNs, availability, country of origin, compliance information, and potential form-fit-function (FFF) alternates into one research workflow. Engineers can investigate individual components and compare manufacturer information without searching across multiple sources.
Consider a manufacturer whose components are used across several of your BOMs. If 30% of those parts move to not recommended for new designs (NRND) within a year, and multiple PCNs indicate production transfers to the same fabrication site, that combination warrants closer investigation. While these changes don’t necessarily indicate supplier instability, they may point to growing component availability or sourcing exposure that engineering and procurement teams need to evaluate.
For aerospace and defense organizations, evaluating these risks may also involve additional supplier-vetting obligations and program-specific requirements. Accuris explores these considerations further in its article on Executive Order 14415. (https://accuristech.com/blog/executive-order-14415-raises-the-bar-for-defense-supply-chain-compliance/)
4. Build Supplier Scorecards That Combine Delivery Data with Part Signals
Keep the delivery and quality measures your organization already tracks. Add component-level indicators so the scorecard reflects both the supplier’s recent performance and the exposure building across the parts you use.
| Signal | What to measure | Source | Suggested weight |
|---|---|---|---|
| On-time delivery | % of orders delivered on schedule, trailing 12 months | ERP and purchasing records | 15% |
| Quality | Defect rate (PPM) and open corrective actions | Quality system | 15% |
| Lifecycle trend | Share of the supplier’s parts in your BOMs that are NRND, LTB, or EOL | Component lifecycle data | 20% |
| PCN and PDN activity | Notices per quarter, weighted toward site and process changes | PCN and PDN monitoring | 15% |
| Sole-source exposure | Parts with no qualified alternate | BOM and approved vendor list | 15% |
| Site concentration | Share of parts produced at one site or in one region | Country of origin and site data | 10% |
| Availability and compliance gaps | Lead time trend, authorized stock, missing declarations | Distributor and compliance data | 10% |
The example weights are a starting point, not an industry standard. An aerospace program with lengthy qualification cycles may place more emphasis on sole-source exposure than a product with easily interchangeable components.
Suppose Suppliers A and B both deliver 97% of orders on time. Only 5% of Supplier A’s parts are NRND or worse, and it has no sole-source exposure. For Supplier B, that figure is 35%, with 12 sole-source parts manufactured at one fab. Their delivery scores are identical, but the second manufacturer creates a very different planning problem. These figures are illustrative.
5. Monitor Signals Continuously and Give Each Alert an Owner
Set up ongoing checks for lifecycle status, PCNs, end-of-life (EOL) notices, and compliance changes across the parts used in your critical programs. Quarterly scorecard reviews still have a place, but an important last-time-buy deadline may arrive between meetings.
Each important notification needs a clear next step. Identify the affected parts and programs, assign someone to review the change, and record when an impact assessment is due. Without that follow-through, even a well-timed alert may not change a decision.
For electronics teams, useful supplier risk management software should help with three things:
- Connecting every notice to the parts and programs your team actually uses
- Prioritizing alerts by business exposure, so critical sole-source parts rise to the top
- Putting relevant information into the PLM, ERP, and engineering workflows teams already use
The stakes can be substantial. Research cited by Accuris reports that 72% of teams make up to 10 reactive supply chain decisions annually, with costs of $50,000 or more per decision. The exact cost for any program will depend on its parts, production schedule and available alternatives.
BOM Intelligence continuously monitors BOM-level lifecycle, PCN, compliance, and sourcing signals. Its AI-powered BOM Health Agent goes further by analyzing the components across a BOM, assigning a BOM Health score, and ranking findings by severity. Instead of treating every alert as equally urgent, teams can see which lifecycle, compliance, and availability issues deserve investigation first.
For flagged parts, the agent recommends potential alternates, explains the reasoning behind them, and shows how a proposed substitution could affect lifecycle, compliance, and cost exposure. Teams can tailor risk priorities to their programs, evaluate options before making a change, and leave final qualification and approval decisions with engineering and procurement. That turns a growing list of supplier-related warning signs into a more focused plan for protecting production.
IEC Electronics offers a practical example. Its team previously relied on distributors to email updates about part availability. By using Accuris data across tens of thousands of components, IEC reduced RFP turnaround from 14 days to 3. Its Director of Supply Chain described Accuris as “one of our top three strategic advantages to stay competitive.”
6. Qualify Alternates for Your Highest-Risk Suppliers Before You Need Them
For the highest-exposure sole-source parts, begin evaluating alternatives before you receive a discontinuation notice. In aerospace, defense and medical applications, qualification can involve substantial engineering, quality and regulatory work. Finding a candidate part is only the beginning.
Check the replacement’s specifications, lifecycle outlook, availability, and manufacturer exposure. An alternative from a different manufacturer may reduce concentration, but only if it meets the application’s requirements and remains viable for the product’s expected life.
Parts Intelligence helps engineers compare FFF and close alternates alongside lifecycle, compliance, and availability information. With BOM Intelligence, teams can then evaluate how a proposed change affects the BOM before approving it and apply approved changes across BOMs where appropriate.
Imagine a voltage regulator used in three programs reaches EOL. If engineering and quality have already approved a suitable substitute, procurement has options beyond a rushed last-time buy. If no alternate has been evaluated, the same notice may trigger months of testing or redesign work. That is why early qualification matters.
How Can You Measure Whether Supplier Risk Management Is Working?
| Metric | Typical starting point | What progress looks like |
|---|---|---|
| Critical suppliers with a current risk score | Unknown, or scored once a year | 100%, refreshed monthly |
| Percentage of sole-source parts from high-risk suppliers with a qualified alternate | Limited coverage or not currently tracked | Increasing coverage each quarter, with a goal of 100% for parts where an alternate is technically feasible |
| Time from PCN or EOL notice to impact assessment | Weeks | Days |
| Line-down or redesign events caused by supplier issues | Counted after the fact | Fewer each year, with causes traced to specific signals |
Once critical suppliers have been identified, scored and monitored, the next question is whether the work is helping. The goal isn’t to generate more alerts or larger reports. It’s to give engineering and procurement more time to evaluate changes and more options when a supplier’s circumstances shift. Track a few measures that show whether that’s happening.
Frequently Asked Questions
What is a supplier risk assessment?
A supplier risk assessment looks at both your dependence on a supplier and the signs that it may struggle to support your needs. For electronics teams, that means combining delivery and quality history with part-level indicators such as lifecycle changes, PCNs, sole-source exposure, and concentration of manufacturing sites.
What should supplier scorecards include?
Supplier scorecards should keep the basics, including on-time delivery, quality, and price, but also show what is happening to the components you buy. Useful measures include NRND and EOL exposure, PCN and PDN trends, qualified alternate coverage, manufacturing-site concentration, availability, and gaps in compliance documentation.
What is the difference between supplier risk assessment and supplier risk analysis?
Supplier risk assessment is the overall process of deciding how much exposure a supplier creates, based on criticality and likelihood. Supplier risk analysis is the closer examination of the evidence behind that judgment, including the supplier’s component lifecycle trends, change notices, inventory, manufacturing locations, and compliance information.
What should supplier risk management software do for electronics teams?
Supplier risk management software should connect verified manufacturer data to the parts in your BOMs. Look for monitoring of lifecycle, PCN, EOL, and compliance changes, alerts ranked by program impact, access to potential alternates, and information engineers and buyers can act on in their existing PLM and ERP workflows.
What are the early warning signs of a high-risk supplier?
Watch for several changes occurring together: more parts moving to NRND or EOL, frequent PCNs or PDNs, shrinking authorized inventory, longer lead times, and production concentrated at one site. Sole-source parts without qualified alternates and overdue compliance declarations make those signals more concerning.
How often should you reassess supplier risk?
Monitor changes for your most critical suppliers as they happen, rather than waiting for a scheduled meeting. Revisit the overall supplier risk assessment at least quarterly and whenever something material changes, such as a fab closure, acquisition, trade restriction, or a cluster of EOL notices.
See Supplier Risk While You Still Have Options
Supplier risk rarely begins with a missed delivery. Often, the warning signs are already present in component lifecycle records, manufacturer notices, and sourcing dependencies. Knowing how to spot high-risk suppliers before they disrupt production means connecting those signals to the products that depend on them. Start with the suppliers behind your most critical BOMs and evaluate alternatives while your team still has time to make a considered decision.
Turn supply chain risk into supply chain advantage
Find out how Accuris Supply Chain Intelligence helps engineering and procurement teams spot component risk early, plan for obsolescence and make sourcing decisions with confidence.
