Business Continuity Assessment

Your supply chain is only as resilient as your weakest supplier's recovery plan

Most procurement organizations have invested heavily in their own business continuity planning — alternate sites, backup systems, crisis communication protocols. But when a regional disaster, cyberattack, or facility fire hits a critical supplier, your own BCP is irrelevant if the supplier cannot recover. Supply chain resilience requires extending continuity assessment to the supplier base, particularly for single-source and sole-source suppliers where failure means production stops. This template provides a standardized methodology for evaluating whether a supplier can survive a disruption and resume operations within your acceptable downtime window.

Three-layer resilience analysis that goes beyond checking for a BCP document

Many assessments ask one question: "Do you have a Business Continuity Plan?" — and accept a "yes" without verification. This template evaluates resilience across three layers. Layer 1: BCP maturity — is the plan documented, tested, and updated, or does it exist only as a PDF last reviewed in 2019? Layer 2: Disaster Recovery capability — can the supplier restore IT systems, recover data, and resume production within defined RTOs and RPOs? Layer 3: Geographic concentration — are the supplier, their key sub-tiers, and logistics routes all concentrated in the same flood zone, seismic region, or political jurisdiction? The single point of failure analysis specifically flags suppliers where no alternate source exists, generating a prioritized resilience investment roadmap.