Supply Chain Risk Mapped as a Network

A supplier list is a table and tells you almost nothing about concentration risk. The same information as a graph answers a specific question: which single removal cuts the most flow, and which single removal cuts something off entirely. Those are different questions with different answers, and conflating them is the most common error here.

Deciding what a node is

Before any measure means anything, the graph has to be built, and the modelling choice dominates. A node can be a legal entity, a site, or a part. The distinction matters enormously: one supplier with four factories looks resilient as an entity and can be a single point of failure as a site, if all four factories share one specialised production line.

Edges are directed by material flow, from supplier to consumer. Weights should be volume or spend if you have them, because unweighted topology treats a supplier of 90% of a component identically to one supplying 2%. And the graph has tiers: your direct suppliers are tier 1, their suppliers tier 2, and the concentration that hurts is almost always discovered at tier 2 or 3, where two of your independent tier-1 vendors turn out to buy from the same place.

Three measures on one supplier graph

S1, S2  raw material suppliers
M1, M2  component manufacturers
A1      assembly
P1, P2  finished products

edges:  S1—M1   S1—M2   S2—M2
        M1—A1   M2—A1
        A1—P1   A1—P2

degrees:  A1=4  M2=3  S1=2  M1=2  S2=1  P1=1  P2=1

Read the degrees first, because degree centrality is what a spend dashboard already gives you: A1 touches four other entities, M2 three. It is a purely local count — it says how many relationships a node has and nothing about what depends on them — so it will rank a node with four interchangeable connections above a node with one irreplaceable one. That is its known weakness and the reason it is never the answer on its own.

Betweenness centrality asks a different question — for every pair of nodes, what fraction of the shortest paths between them passes through this node — and it is worth computing by hand once to see what it rewards. Here is A1:

pairs whose shortest paths run through A1
  (S1,P1) (S1,P2) (S2,P1) (S2,P2)      4 pairs, all paths via A1   → 4.0
  (M1,P1) (M1,P2) (M2,P1) (M2,P2)      4 pairs, all paths via A1   → 4.0
  (P1,P2)                              only path is P1—A1—P2       → 1.0
  (M1,M2)   two shortest paths of length 2: via S1 and via A1  → 0.5
  (S2,M1)   two shortest paths of length 3: via S1 and via A1  → 0.5

betweenness(A1) = 10.0

pairs whose shortest paths run through M2
  (S2,S1) (S2,M1) (S2,A1) (S2,P1) (S2,P2)
      S2's only edge is to M2, so every path leaves through it    → 5.0
  (S1,A1)  two shortest paths of length 2: via M1 and via M2      → 0.5
  (S1,P1)  two shortest paths of length 3: via M1 and via M2      → 0.5
  (S1,P2)  same                                                   → 0.5

betweenness(M2) = 6.5

So both measures rank A1 first and M2 second. Both are computed with the standard definition; the algorithm that makes this tractable on a real graph is Brandes’ 2001 algorithm, which brings unweighted betweenness down to O(nm) from the cubic all-pairs approach, and it is what every graph library implements.

Why the rankings disagree

Now ask the question the page is actually about: which single removal disconnects the network? Delete A1 and P1 and P2 are cut off from every supplier. Delete M2 and S2 is cut off from everything. Both are articulation points — cut vertices, in the Hopcroft-Tarjan sense — and the edge S2–M2 is a bridge, an edge whose removal disconnects the graph.

This is the finding that the centrality rankings hide. M2 is second on both measures, at 65% of A1’s betweenness and three-quarters of its degree. Read as a ranked list, that reads as “less important”. But losing M2 removes S2 from the network completely, which is a categorical outcome, not a proportional one. Centrality measures load; connectivity measures survival, and no threshold on a centrality score will reliably find the second thing.

• Articulation points and bridges answer “what single removal disconnects something”. Linear time, exact, no parameter. Run this first.
• Betweenness answers “what carries the most flow” and is the right measure for capacity and congestion, not for existence.
• Edge and vertex connectivity answer “how many removals before this pair is separated”. Menger’s theorem makes this equal to the number of disjoint paths between them, which is the honest definition of dual sourcing: two suppliers are a real second source only if the paths to them are disjoint all the way down.

The correlation topology cannot see

Every measure above operates on the graph as recorded, and the failures that matter most are the ones the recorded graph does not contain.

Two tier-1 suppliers with no edge between them can be perfectly correlated in practice: same industrial park, same port, same power grid, same specialised fab, same single upstream mine. Nothing in the adjacency structure encodes that, so betweenness will score them as two independent paths and connectivity will report vertex connectivity 2 when the true answer is 1. The remedy is to attach attributes — country, site coordinates, port of exit, upstream material — and to compute connectivity after contracting nodes that share a critical attribute. That contracted graph is a different graph, and it is usually the one with the honest answer.

A second blind spot is that an unweighted graph treats every edge as carrying the same consequence. Add spend or volume as edge weights and the analysis changes shape: the question becomes what fraction of revenue sits behind each cut, which is a max-flow or min-cut computation rather than a centrality ranking, and it produces a number an operations team can act on rather than an ordering they have to interpret.

The last invisible factor is substitutability and time. Topology says an edge exists; it does not say whether a replacement supplier can be qualified in three weeks or eighteen months. For components requiring certification, tooling or regulatory re-approval, the qualification lead time is the risk, and it belongs on the node as a weight rather than in your head.

The data problem is the real problem

Direct suppliers are in your ERP system. Their suppliers are not, and nobody is obliged to tell you. Multi-tier visibility is normally assembled from a combination of supplier questionnaires (self-reported, incomplete, and stale within a quarter), customs and shipping records, corporate registry data, and specialist commercial datasets — each with different coverage and different error modes.

The consequence for analysis is specific and needs stating: a missing edge changes a betweenness score a little and can change an articulation point from true to false entirely. A node looks like a single point of failure precisely when you have not recorded the alternative path, and it stops looking like one the moment somebody fills in a form. So treat the connectivity findings as hypotheses to verify with the suppliers concerned, keep coverage per tier as an explicit metric alongside every result, and re-run the analysis when coverage changes rather than only when the network does.