You know your direct suppliers well. You have contracts with them, you audit them, you can name the account manager. Ask who supplies them, and the answers thin out fast. Ask who supplies those suppliers, and almost nobody can say.

This matters because disruptions rarely start at tier one. They start deep in the network and travel upward, arriving at your door as a supplier who suddenly can’t deliver and can’t fully explain why.

The Concentration Nobody Sees

The recurring surprise in tier-two mapping is concentration. Three suppliers you deliberately chose for redundancy all buy a critical input from the same producer. A component you dual-sourced comes from two firms using the same specialty coating house. Your carefully diversified supply base narrows to a single point two steps back, and it looks perfectly diversified from where you’re standing.

Geographic concentration hides the same way. Suppliers in different countries whose own inputs all originate from one region give you the appearance of spread with none of the protection.

Getting The Information

Start by asking. Many tier-one suppliers will disclose their key sources for critical components, particularly if you frame it as joint risk management rather than an audit. Some will refuse for commercial reasons — they’re protecting their own sourcing advantage, which is legitimate.

Where direct disclosure isn’t available, you can infer a good deal. Certificates of origin, customs and shipping records, material certifications, and industry knowledge about who actually produces a given specialty input all narrow the field. For specialised materials, the number of possible producers globally is often small enough to identify by elimination.

Don’t attempt to map everything. Full multi-tier visibility across a full component list is a project that never finishes. Prioritise: components where you have no qualified alternative, long-lead items, anything with a certification or qualification barrier to switching, and anything whose absence stops a line.

Turning the Map into Something Useful

A supplier map that sits in a folder is documentation. To be useful it needs to be connected to monitoring — so that news of a fire, a strike, a port closure, or an insolvency in a region can be matched automatically against the parts of your network exposed to it.

That matching is where the value sits. The difference between hearing about a disruption and knowing within an hour which of your products are affected and by when is the difference between managing an event and being managed by it.

Keeping it Current

Sub-tier relationships change without anyone telling you. A supplier who consolidates purchasing, switches to a cheaper input, or loses their own second source has altered your risk position without altering anything you can see. Build a refresh into your supplier review cycle for critical components — annually is enough for most, and the question takes two minutes to ask.

ticktick.ai holds multi-tier supplier relationships against the components and products they feed, so exposure can be traced from an upstream event to the finished goods it will affect.