Supply chain management
Supply chain management identifies and reduces the external dependencies that can stop a core service, and it supplies the visibility that the resource review in 5.7 needs.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names supply chain management as a supporting discipline; the standard does not define its scope. Within 5.8, the contribution is the map of suppliers, inputs and logistics that a core service depends on, the assessment of their resilience, and the contractual and practical arrangements that keep supply going. The resilience question is not only whether a supplier is financially sound. It is whether the supplier can deliver when its own site, system or workforce is disrupted, and whether the organization has an alternative.
Why it matters
Supply chains are where resilience claims are most often tested and least often evidenced. A tier-one contract does not show what sits beneath it. A single-source component can stop a service even when every direct supplier is healthy. The discipline also carries a relationship dimension: a supplier that is treated as a partner is more likely to warn the organization early. That is context work and communication work as much as procurement.
What good looks like
Map the critical inputs and the suppliers behind them, including the tier-two dependencies that matter. For each critical supplier, record the dependency, the alternative, the contract terms and the early-warning relationship. Test one alternative or buffer. Review the map when a service, a product or a supplier changes. Include the logistics route as part of the dependency.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask which supplier failure would stop a core service and what the alternative is. A tier-one contract register does not answer the dependency question.
- Critical supply map The inputs, suppliers and routes a core service depends on, including tier-two where material
- Supplier resilience assessment The supplier's own continuity and the evidence obtained
- Alternative and buffer The qualified alternative, buffer or substitution for each critical input, with the time to activate
- Contract and relationship The continuity, notification and exit terms, and the early-warning contact
Where it commonly fails
- Only tier-one suppliers are mapped, so a hidden dependency is missed.
- A single-source input is treated as a commercial matter, not a resilience risk.
- Contract terms are assumed to guarantee supply in a widespread disruption.
What to do before the second edition
Ask procurement to name the one input that would stop the service and the qualified alternative. If either answer is missing, the supply chain gap is live.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines