For this edition of Supply Lines, we examine supply chain mapping and how contract management can support this endeavor. Tor Hough, president of Elm Analytics, LLC, who has spent his career helping firms and agencies map critical supply chains, provided the nuts and bolts for this column. We linked his supply chain mapping insights to actions that contract managers can take.

The fundamentals of supply chain risk management are straightforward. 

Five things essential to every manufacturer are liquidity, labor, parts, demand, and transportation. Take away one of these requirements, and a business cannot operate profitably or sustainably. It will fail in its obligations to customers. Supply chain mapping enables both customers and suppliers to monitor these needs. 

However, supply chains are complex, nonlinear systems and not easily controlled. Supply chain maps can reveal this complexity and allow companies and their customers to identify weak links, points of likely disruption or blockages, fragility, and brittleness in the connections between suppliers of goods and services. 

One of the most fundamental approaches to supply chain risk management is supply chain mapping. Most buyers know their immediate (Tier 1) suppliers. However, few in the public or private sectors know much about the critical suppliers and processes beyond that first tier. 

For example, winter storms in Texas recently had dramatic effects on the polyethylene supply chain, resulting in plastic shortages. These shortages affected packaging supplies and plastic injection molded parts, shutting down automotive supply chains, and creating shortages of building construction products. Most companies at the end of the supply chain—for example, home builders—would not have expected that freezing, ice, and snow in Texas could affect their building schedules elsewhere in the country. However, understanding supply chain relationships would have illuminated these risks and permitted companies along the chain to take mitigation steps. Supply chain mapping provides that kind of understanding: It allows you to identify suppliers in different tiers, all the way back to raw materials.

Mapping Can Erase Chokepoints

Imagine the supply chain of Pretty Sharp Pencil Manufacturing. Pencils are simple products, and although the company does most of the manufacturing in-house, it buys parts from five suppliers.

Pretty Sharp has good relationships with Excellent Erasing, Leading Leads, Fine Ferrules, Wonderful Woods, and the Perfect Paint Company (Tier 1 Suppliers). In fact, Perfect Paint Company worked closely with Pretty Sharp to develop a signature glossy hue.

Unfortunately, Perfect Paint and Excellent Erasing (Tier 2) share the same upstream supplier that provides raw materials crucial for coloring pink erasers and yellow paint. Problematic Pigment Partners (Tier 3) sells iron oxide to Excellent Erasing and arylamide to Perfect Paint. Unfortunately, one night a plant fire levels its sole manufacturing facility.

Perfect Paint is the first to get the call from Problematic Pigment. They, in turn, contact Pretty Sharp to let them know it will be months before they can find another source for the arylamide. Meanwhile, Excellent Erasing notices the weekly shipment of iron oxide from Problematic Pigment hadn't arrived. After a few frantic text messages, Excellent Erasing's salesperson delivers the devastating news to Pretty Sharp. Pretty Sharp Pencil's plant grinds to a halt. How were they not aware of the chokepoint created when two of their suppliers shared the same upstream supplier?

When we think of supply chains, we often picture companies arranged in a hierarchy of tiers. Mapping supply chains reveals an underlying social network, shining light on previously hidden risk. Pretty Sharp might have been able to prevent itself from being shut down by its suppliers’ emergencies if it had mapped its supply chain. Mapping could have identified potential chokepoints so Pretty Sharp could set up countermeasures for single-source parts.

Contract managers are familiar with prime sole-source markets for government-unique needs. Defense contract managers face these situations within markets for ships, fighter jets, satellites, and specialized advisory experts that support their programs. Typically, these requirements cannot be sourced from any other supplier due to proprietary design features that make the prime contractor the only responsible source. These situations are less volatile for the prime, as it can maintain the relationship via budgeted and planned funding profiles.

The same sole-source situation can exist beyond the prime—not because there truly are no other responsible providers, but because no such alternative sources have been established. The government bears the true risk of insufficient supply chain management because alternative sourcing gets passed along to the government program as a “risk-burn-down” cost if the contracts are cost-type, or simply as a carried risk if the contracts are fixed price. Thus we can see the importance of supply chain mapping for contract managers. 

Supply chain mapping and visibility are key to managing supply chain risk. They reveal that buyers can't make meaningful progress towards managing risk without communicating directly with suppliers. Moreover, supply chain mapping provides information that requires new understanding and action on the part of contract managers.

Communication within a supply chain must be handled carefully to avoid breaching privity of contract between primes and their suppliers. Still, communication is possible and important. Contract managers should avoid providing direction to their primes’ suppliers and instead focus on fact-finding and discovery of potential risks. 

Evaluating Supplier Risk Management

Supply chain mapping demonstrates that traditional contractor responsibility determination criteria and past performance records may not be enough to ensure selection of the contractor that offers the best risk profile for an organization’s needs. Contract professionals must consider contractors’ management of subcontractors at Tiers 2 and 3, and even beyond, in their supply chains.

How is your prime contractor ensuring that subcontractor supply chains have acceptable risk management practices? 

How are you ensuring that they are so ensuring?

Can consent to subcontract requirements extend deeper into supply chain risk management areas? Can contract managers use the power of consent to require your primes to have better awareness of their supply chains? Could supply chain mapping be a required consent criterion or even a Contract Data Requirements List item? 

Currently, the Federal Acquisition Regulation only requires consent as it applies to approved pricing systems. DCMA’s Contractor Purchasing System Review Guidebook and its Appendix 24 (dealing with pricing system reviews) only speak to supply chain issues related to approved pricing systems information security and vendor quality rating approach.  The guide speaks to a contractor’s ability to identify “critical suppliers,” but does not mention supply chain risk even once.

Contract managers should consider requiring additional supply chain risk management as a core component of contract development, including work statements and incentive plans. Furthermore, contract managers should not stop at requiring mapping: They should also request a review of the prime contractor’s process for identifying and responding to risks and events across the mapped supply chain.

We have turned a blind eye toward this form of performance assurance for too long. The COVID-19 pandemic has highlighted supply chain risk and forever changed the way we view global events. Recent Texas weather events and the looming humanitarian crisis on the southern border show supply chain mapping to be an ongoing need, not just a Black Swan pandemic concern. 

Promoting Supply Chain Data Sharing

Sharing information between government and industry is a perennial challenge. Government tends to be overly focused on security and industry tends to be obsessed with achieving competitive advantage via proprietary data and information asymmetry. While we haggle over data rights generally, detailed supply chain risk data could be an area where government and industry have a shared interest and opportunity to collaborate.

We often treat supply chain mapping as a business intelligence function; i.e., we gather data from our suppliers to make better tactical and strategic decisions. We often fail to recognize our shared interdependence. Effective supply chain mapping involves an exchange of data between the customer and its upstream suppliers and ensures that each party has the knowledge it needs to thrive.

The government should consider crafting policies to promote data sharing for supply chain risk management—for example, favoring vendors with set-asides or price evaluation advantages for providing supply chain data transparency.

Contract managers should create novel approaches to give companies incentives to share critical supply chain data and mandate provision of it as a contract deliverable. Contract managers should also employ sound supplier relationship management techniques, including encouraging open and honest data sharing. 

If incentive plans penalize prime contractors or subcontractors for having supply chain disruptions, then they will not provide transparent situational awareness. Instead, contract managers should provide incentives for open feedback and appropriate response to disruption. Penalize contractors only if supply chain disruptions demonstrably result from hidden information, gross negligence, or malpractice.

The government also should be open to sharing information about risks to contractors’ supply chains. This demonstrates the spirit of reciprocity that all parties desperately need to mitigate disruptions and to encourage information sharing and collaboration between the government and industry. 

Keeping the Entire Value Chain Informed

Most supply chain failures occur one or more tiers removed from contractors’ customers. As a rule, North American manufacturers have well-ordered relationships with their direct suppliers. Sophisticated systems monitor production scheduling, logistics, and quality. 

However, upstream from the manufacturer, suppliers often fail to follow the same best practices. A supplier gets production forecasts from its original equipment manufacturing customers but doesn't communicate the forecasts to its upstream suppliers. This same supplier might have redundant production lines to ensure uninterrupted delivery of high-value end items but might purchase unique parts from a source that lacks similar countermeasures. 

When you have effective supplier management with your direct suppliers, it is easy to assume that they apply the same practices upstream with their suppliers. However, this is rarely the case. Building resilience into your supply chain almost always requires your suppliers to up their game. 

At the most practical level this means that contract managers must ensure that appropriate clauses flow down to lower-tier subcontractors. Make sure that the entire value chain is aware of the requirements that are expected by the customer.

Contract managers can take this to the next level by, for example, by providing demand forecasts not just to prime contractors, but also to their subcontractors and suppliers. Government customers can also provide demand information to their contractors in the form of quarterly forecasts and require that they be flowed to all approved subcontractors and suppliers in the value chain.

Contract managers can also wargame demand-surge scenarios with prime contractors and ensure that the resulting contingency supply playbooks are shared with critical suppliers in the value chain. Wargaming can help the web of critical suppliers and the government identify and plan to mitigate potential weaknesses in the system in the face of force majeure events, such as pandemics, catastrophic weather, political upheaval, and other disruptions. 

Taking Account of Infrastructure

Most supply chains are dependent on infrastructure outside of the manufacturer’s or supplier's direct control. Infrastructure risk rises with the length of a supply chain, the number of borders crossed, and the number of transportation modes employed. Disruption in any of the following sectors can interrupt the flow of goods between a manufacturer and its upstream supplier:1

• Transportation,
• Financial services,
• Communications,
• Government facilities, and/or

• Energy.

But supply chain maps rarely incorporate critical infrastructure resources.

Border crossings, ports, customs processors, intermodal terminals, warehouses, and sequencing facilities are all physical locations on the supply chain. Goods can be held up at any one of them or combinations thereof. Identifying these facilities and monitoring geopolitical, environmental, geological, and labor impacts is key to early discovery of potential supply chain interruptions. 

For contract managers, the solution to missing infrastructure information is market intelligence. Are you aware of all the nodes and channels that your requirement flows through on its way from raw material to customer delivery? Do you monitor these nodes and channels for possible disruptions, major price changes, supplier consolidations, geopolitical risks, weather impacts, and other events that can affect your ability to respond to customer demands and needs?

Category management is a critical tool for enabling deep, continuous, and comprehensive market intelligence. It allows contract managers to consider alternatives to meeting customer needs. Alternative solutions can shift the government’s supply chain risk. Opening to new sources can shift away from reliance on a sole-source, high-risk, globalized supply chain to an innovative domestic option, such as emerging U.S. additive manufacturing capability. 

Agencies should establish market intelligence offices across their primary spending categories to monitor and analyze supply chain risks and opportunities. Strategic sourcing plans should also be generated and maintained for every critical supply or service.

Supply Chains Are Social Networks

Ask a working supply chain manager to rank his or her reasons for mapping supply chains, and the top answer almost always will be “to improve supply chain visibility.” When hurricanes, earthquakes, plant fires, floods, and pandemics strike, the discussion turns quickly to the need for greater transparency. But framing the problem this way ignores a key outcome of supply chain mapping: healthier, more intelligent, more resilient suppliers throughout the supply base.

Supply chains are social networks. Supply chain mapping takes full advantage of this fact and draws suppliers at all tiers onto one network. Building this network requires engagement, so effort must be rewarded. Manufacturers that bring their suppliers into the network improve communication with their direct suppliers and ensure that their suppliers are doing the same upstream. 

But current contract management practices do not include a network-building approach to relationships with contractors. We think of supplier relationship management as post-award meetings, program reviews, and past performance reporting. We rarely include upstream suppliers in those meetings or that reporting. As a result, we are doing little to ensure that vital information is flowing up and down the supply chain.

Consider, for example, a case in which weather in Southeast Asia shifts natural rubber prices. Does our current contracting practice ensure that information is communicated to the manufacturers of the rubber stoppers for glass COVID-19 vaccine vials? If we were ensuring the information was passed on, those stopper-makers could make smart investments to reduce future cost growth or supply shortages that will affect government customers and national vaccine delivery. Contract managers should consider whether existing contract types can encourage sound cost control at this level. 

Much of what we know about trust between people applies to companies in the context of supply chain mapping. Trust is earned. It is built incrementally over time. Supply chain mapping efforts need to start simple and build in complexity as trust between the manufacturer and its suppliers grows. Do not start a supply chain mapping effort by inflicting a formidable survey on suppliers. Start by asking a small number of high-level questions that will allow you to identify broad areas of concern. When necessary, drill into more detail with specific suppliers regarding immediate, tangible concerns.

When a network member behaves in a manner that earns trust, it is imperative to call out and reward that action. Prompt and explicit recognition builds trust. When a supplier responds to a request for data, acknowledge the engagement and use the data to return analytic byproducts of value. For example, if you have determined that several of your suppliers share a single source for a critical raw material, communicate the existence of this choke point to every company involved. Feeding data up the supply chain builds resilience and fosters trust between trading partners.

The COVID-19 pandemic exposed the fragility of supply chains and the risks inherent in many of our current practices. Manufacturers of even simple products discovered they are vulnerable to disruption in upstream supply. Supply chain mapping is essential to gathering the data and enabling the communications needed to cultivate resilience in supply chains.

The past year has shown us that we need to plan for supply chain disruption signals such as adverse weather, infection outbreaks, global trade restrictions, and hoarding behaviors. The first step to planning for any contingency is to map the battlespace, and contract managers cannot expect our contractors to do that without concerted direction and oversight. 
1. A good reference to U.S. national infrastructure can be found at the Cybersecurity & Infrastructure Security Agency (