Supply chain risk: single-sourcing, tariffs, and the customer concentration trap

Both numbers should sit next to EBITDAEBITDAEBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) measures a company's operating profitability before financing and accounting decisions, used to compare core performance across firms.View full definition → margin in your risk dashboard, because both can move it fast.

The worked example: quantifying the hit

Assume the Ohio supplier has:

• Annual revenue: $80 million
• Top customer share: 40% ($32 million)
• Gross marginGross marginGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition →: 22%
• Fixed costs (plant overhead, salaried labor): $9 million/year

The resin outage causes a 3-week production stoppage on lines serving that customer. Lost shipments: $2.4 million of revenue that quarter (roughly 4 weeks' worth of that customer's run rate, pushed out).

Even if the revenue is only delayed, not lost, two costs are real and immediate:

1. Expedite costs: air freight or spot-market resin at a premium, commonly 20-40% above contract price in a shortage (estimate; spot premiums vary widely by chemical and cycle).

2. Penalty clauses: many OEM (original equipment manufacturer) contracts include late-delivery penalties, sometimes structured as a percentage of the missed shipment's value per day.

Simple math: if the customer contract carries a 0.5%-per-day penalty on missed shipment value, and the shipment is 10 days late, that is a 5% penalty on $2.4 million: $120,000, straight out of gross margingross marginGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition →. At 22% gross margingross marginGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition →, that $120,000 penalty is equivalent to wiping out the margin on roughly $545,000 of sales ($120,000 ÷ 0.22).

Now add the strategic cost: the customer starts dual-sourcing to avoid a repeat. If it shifts even 15% of its volume to a competitor permanently, that is $4.8 million of annual revenue gone, at 22% margin, about $1.06 million of annual gross profit gone. That is the real concentration tax, and it does not show up until the next fiscal year's numbers.

Tariffs: the second lever on the same risk

Trade policy compounds supplier concentration risk. If your sole-source input crosses a border, tariff exposure becomes a margin variable overnight.

Since 2018, Section 301 tariffs (US Trade Representative authority under the Trade Act of 1974) have applied to many Chinese-origin industrial inputs, including certain plastics, metals, and machine components, with rates that have shifted repeatedly through 2024-2025 trade policy changes. In the EU, the equivalent exposure runs through the European Commission's Common Customs Tariff and anti-dumping duties on categories like steel and aluminum.

The finance implication: a single-source supplier abroad is not just an operations risk, it is an unhedged tariff position. If your resin supplier's feedstock is tariffed at 25% and you have no domestic alternative, that cost either compresses your margin or has to be passed to a concentrated customer who may resist the increase, since they have leverage.

Financial due-diligence check: model a tariff-shock scenario (for example, +10 to +25 percentage points on a key input) and see what it does to gross margingross marginGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition → without a price pass-through. If margin goes negative, you have an uninsured exposure, and lenders reviewing your credit facility will ask this question during covenant review.

Regulatory and disclosure angles

Concentration risk shows up in real regulatory and reporting frameworks, not just internal models:

• SEC Regulation S-K (US public companies): Item 101 requires disclosure of dependence on a single customer or small number of customers if material to the business, and Item 105 requires risk factor disclosure, which routinely includes customer concentration language in 10-KKThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → filings.
• Sarbanes-Oxley Act (SOX) Section 404: requires internal controls assessment, which for manufacturers should include controls around supplier qualification and contract concentration, since a single-source failure can be a material weakness in operational continuity, not just a footnote.
• EU Corporate Sustainability Due Diligence Directive (CSDDD), adopted 2024 with phased application through the later 2020s, pushes large EU-operating companies to mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → and disclose supply chain risk, including dependency concentration, as part of due diligence obligations (check current European Commission CSDDD guidance for implementation timelines, as they have shifted).

For lenders, concentration risk usually surfaces in loan covenants: asset-based lending facilities may include customer concentration limits, and breaching them can trigger a borrowing base reduction, tightening liquidity exactly when you need it most.

Practical due-diligence checklist

Before financing, acquiring, or extending credit to a manufacturer, check:

1. Customer revenue concentration, top 1, top 3, top 5, trended over 3 years.

2. Contractual protections: are there minimum purchase commitments, or can the customer walk with 30 days' notice?

3. Second-source status for every input above roughly 5% of COGS (cost of goods sold).

4. Tariff and FX exposure on cross-border inputs, and whether contracts allow price pass-through.

5. Covenant sensitivity: run the concentration-loss scenario against existing debt covenants to see if a customer or supplier shock triggers default.

What good risk management looks like in the numbers

Well-run mid-size manufacturers treat diversification as a financial hedge, not a nicety. Practical moves finance teams should push for:

• Dual-sourcing critical inputs, even at a 3-5% cost premium (estimate), because the premium is cheap insurance against a shutdown.
• Customer diversification targets, for example capping any single customer below 20-25% of revenue over a multi-year plan.
• Contractual risk-sharing: pass-through clauses for tariff and raw material price shocks, common in auto supply contracts through indexed pricing formulas.
• Business interruption insurance that explicitly covers supplier failure, not just your own facility, since standard property policies often exclude upstream disruption.

🎬 [VIDEO: "How Supply Chain Risk Became a Balance Sheet Problem" - youtube.com - search for recent explainer content from CNBC or Bloomberg on supply chain concentration and corporate risk, illustrating how single-source dependency shows up in earnings and credit ratings]

Key Takeaways

• Customer and supplier concentration are quantifiable financial risks: model them with the same rigor as interest rate or FX exposure, using concentration ratios and scenario-based margin impact.
• A single-source input disruption can hit margin through expedite costs and contractual penalties immediately, and through customer attrition over the following 12-24 months, the second effect is usually larger.
• Tariff exposure on single-source foreign inputs is an unhedged cost position; stress-test gross margingross marginGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition → against a plausible tariff shock (for example +10 to +25 points) before assuming pass-through is possible.
• Regulatory frameworks (SEC Reg S-KKThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition →, SOX 404, EU CSDDD) increasingly require or incentivize disclosure of concentration risk, and lenders bake concentration limits into loan covenants.
• Due diligence should always include: top-customer revenue sharerevenue shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.View full definition →, second-source status on major inputs, and a covenant stress test against a concentration-loss scenario.