Strengthening supply chain resilience: how business continuity professionals can support procurement teams

In today’s interconnected global economy, supply chain disruption is no longer an exceptional event but a persistent operating condition. Whether caused by third-party failures, cyber attacks, extreme weather events, geopolitical instability, or transportation bottlenecks, disruptions have become increasingly frequent, severe, and difficult to predict.

Recent research illustrates the scale of the challenge:

The BCI Supply Chain Resilience Report 2024 [1] reported that nearly 80% of surveyed organizations experienced supply chain disruptions over the previous year.
In 2026, Blue Yonder research reported that 34% of respondents do not believe their supply chains are ready for the future, up from 27% with the same view the year before. [2]
The UK Government Office for Science’s 2026 Global Supply Chains: A Foresight Report on Risk and Resilience [3] highlights that supply chains are not linear chains but complex, interconnected networks where risk is frequently concentrated in a small number of suppliers, regions, transport routes, and strategic chokepoints. The report concludes that many vulnerabilities remain hidden several tiers upstream in supply networks, often beyond the visibility of purchasing organizations. Furthermore, climate change and geopolitical tensions are increasingly acting as risk multipliers, amplifying disruption across interconnected systems.

Recent events in the Gulf provide a clear example of the risks. Tensions involving the United States and Iran have highlighted the potential fragility of global trade flows through the Strait of Hormuz and the Red Sea: maritime chokepoints through which significant volumes of oil, liquefied natural gas (LNG), fertilisers, and industrial raw materials transit. Disruptions to shipping in the region have demonstrated how geopolitical events can rapidly affect global energy markets, fertiliser availability, manufacturing inputs, and transportation costs.

These developments point to a critical challenge: organizations often lack the visibility, capacity, and structured processes necessary to ensure that their suppliers are resilient. Procurement teams provide the organizational interface with suppliers and perform due diligence and compliance activities, but they may lack both the specialist expertise required to assess supplier resilience capabilities and the capacity to validate their business continuity arrangements. Operational resilience and business continuity professionals can help address this gap but are frequently located elsewhere within the organization. More closely integrating this expertise into supplier identification, qualification, onboarding, and through-contract management can help organizations define resilience requirements, improve supplier assurance, and strengthen ongoing supply chain risk management.

Defining supplier resilience requirements

The first step in building supplier resilience is to determine what supply chain capabilities are required to maintain critical business services and operations during a disruption. This starts with identifying which suppliers have the greatest impact on critical business functions and establishing clear expectations regarding the resilience capabilities they must demonstrate. Not all suppliers present equal levels of risk. Organizations should therefore adopt a prioritised approach, focusing attention on those suppliers whose failure would have the most significant operational, financial, or reputational consequences.

This principle is reinforced by the UK Government’s Foresight Report, highlighted earlier. This found that risk is typically concentrated among a relatively small number of firms, facilities, and transport routes that perform system-critical functions. Understanding where these concentrations exist will enable organizations to target resilience-building efforts where they will have the greatest impact.

Business continuity and resilience professionals can assist by mapping critical business services, identifying supplier dependencies, understanding upstream vulnerabilities, determining recovery time requirements, and quantifying the impact of supplier disruption. This analysis helps organizations identify which suppliers require enhanced assurance and engagement.

Once critical suppliers have been identified, procurement teams can translate organizational expectations into practical and contractually enforceable supplier requirements. Self-assessment questionnaires are a useful starting point, providing suppliers with an opportunity to describe their governance arrangements, business continuity framework, cyber resilience capabilities, dependency management processes, and supply chain visibility.

However, questionnaires alone rarely provide sufficient assurance. Additional evidence such as business continuity plans, compliance with recognised standards, and incident management procedures should be requested to provide a more complete picture of supplier resilience.

Validating supplier resilience

For critical suppliers, evidence of effective business continuity arrangements should be a fundamental requirement.

Business continuity plans should demonstrate clearly defined escalation procedures, roles and responsibilities, response activities, recovery priorities, communication arrangements, and processes for restoring normal operations. Importantly, these documents should be assessed against predefined and standardised criteria rather than simply collected as part of a compliance exercise.

This remains an area where many organizations fall short.

For higher-priority suppliers, organizations should seek additional evidence regarding the effectiveness of resilience arrangements. This might include:

Business continuity exercise reports
Incident and post-event reviews
Governance and oversight structures
Risk assessment outputs
Continuous improvement programmes
Recovery testing evidence
Supply chain mapping and dependency analysis.

The Foresight Report highlights that many emerging risks originate in upstream raw material extraction, processing facilities, and logistics infrastructure rather than within final manufacturing operations. Consequently, validation activities should seek to understand not only the resilience of direct suppliers but also their exposure to critical dependencies and single points of failure further upstream.

To provide additional assurance, organizations may conduct advisory reviews, independent audits, or supplier maturity assessments. Where regulatory obligations apply, or where commercial leverage permits, organizations may require suppliers to align with recognised standards such as ISO 22301.

Where recovery times are critical, contractual obligations should specify recovery objectives, service restoration expectations, and minimum availability requirements. Contracts may also include obligations relating to resilience testing, reporting, audit access, and improvement plans, along with mechanisms for managing instances of non-compliance.

Throughout this process, business continuity and resilience professionals can provide valuable guidance in defining resilience requirements, evaluating evidence, identifying weaknesses, and recommending proportionate improvement activities.

Ongoing supplier management

Supplier resilience cannot be assured through onboarding activities alone.

Most commercial relationships extend over many years during which threat landscapes, business models, and operational dependencies evolve significantly. Resilience assurance must therefore be a continuous process.

The Foresight Report emphasises that resilience is not a one-off intervention but an ongoing cycle of assessment, adaptation, and improvement. Organizations should adopt a similarly iterative approach with suppliers, regularly reviewing risks, validating assumptions, and strengthening preparedness.

For strategic suppliers, resilience should be developed through collaborative partnerships characterised by transparency, information-sharing, and mutual support.

Regular scenario-based exercises can help organizations and suppliers jointly explore risks such as cyber attacks, transport disruptions, geopolitical crises, supplier insolvency, or extreme weather events.

The most mature arrangements involve suppliers participating in joint exercises with customers, enabling both parties to build a shared understanding of recovery strategies, operational interdependencies, and decision-making constraints before a real disruption occurs.

Conclusion

In an era characterised by geopolitical instability, cyber threats, climate volatility, and increasingly interconnected supply networks, supplier resilience has become a strategic business imperative.

The UK Government’s Foresight Report concludes that climate change and geopolitical developments are likely to increase the frequency and severity of supply chain disruption over the coming decades, particularly around critical global chokepoints and upstream raw material supply networks.

While procurement teams play a central role in supplier selection, due diligence, and contract management, defining resilience requirements and ensuring supplier capabilities are fit for purpose requires specialist expertise and senior leadership support.

Resilience professionals can provide this expertise by helping organizations understand critical dependencies, quantify supplier impacts, establish resilience requirements, and validate supplier capabilities. By working together, procurement and business continuity teams can ensure that supplier assurance programmes move beyond compliance-focused activities and contribute meaningfully to organizational resilience.

Furthermore, integrating supplier assurance into a broader operational resilience framework can help organizations to combine risk identification, monitoring, mitigation, and response structures into a coherent end-to-end capability. In doing so, supplier resilience can become a strategic enabler and competitive advantage.