How Are You Vetting Your Supply Chain?

Estimated reading time: 7 minutes

From Reactive to Prepared
Many businesses only strengthen supplier vetting after a disruptive event: a shipment is blocked, a component source disappears, or a customer asks challenging questions. A cybersecurity concern could emerge, or a regulatory request for documentation comes in that cannot be produced quickly.

By then, choices are few and costs are high. The constructive or prepared approach is to build a system before urgency demands one. This is why we say that you need to know the country of origin for all the parts in your product, down to the smallest screw. Pose questions, demand answers, and inform your supply chain of their financial and legal consequence if they make changes to your product without your prior approval.

A company with, for example, an AS9100 Quality System for Aerospace will be able to document these processes, and a third party has already verified that the company is compliant. This does not mean creating bureaucracy for every supplier. It means applying proportionate diligence based on risk and criticality:

• Focus on supplier transparency and audits, and take into consideration the risk for counterfeit products. Perform supplier qualification.
• Provide or demand a secure flow-down of requirements.
• Ensure an industry-specific requirements registration if it’s for defense. All applicable restrictions and specific procedures must apply automatically.
• Demand proof of compliance and ensure your partner can provide process documentation and communications trails.
• Inform your suppliers of the legal and financial consequences, if they have withheld or provided you with inaccurate data.

A low-risk supplier should not receive the same scrutiny as a supplier connected to controlled technology, sensitive data, or mission-critical hardware. Know your Intellectual Property (IP), remember that anything from you with a drawing and employed for defence, will most likely be subject to export compliance.

What Good Vetting Looks Like
Well-run supply-chain vetting is often less dramatic than people imagine. It is usually built on discipline and consistency.

It means asking sensible questions early:

• Where is this product made?
• What are the upstream dependencies?
• Are there single points of failure?
• What certifications are valid? How is data handled?
• Who has access to data?
• What happens if demand doubles?
• What happens if one region closes?
• Who do we call when something changes?
• How do you inform the subcontractor of the consequences if the information is inaccurate?

It also means revisiting answers over time. A supplier approved three years ago may not represent the same risk profile today, so continuous monitoring is more important than one-time onboarding.

At CONFIDEE, our models are built on the belief that supply-chain assurance should extend from onboarding to end-of-life, combining experienced people with tailored systems that document and monitor the chain throughout the product lifecycle.

A Boardroom Issue?
Supply-chain vetting should not be delegated so far down the organization that leadership only hears about it when disasters occur.

For companies in defence and aerospace, supplier resilience affects delivery capability, customer trust, security posture, and long-term competitiveness. Those are leadership concerns.

Executive boards routinely review financial exposure, market risk, and strategic priorities. Increasingly, they should ask the same level of questions about compliance risks, supply-chain dependence and supplier assurance. Because when non-compliance arrives, it is rarely experienced as a procurement problem. It is experienced as a business problem.

A Final Thought
Every company has suppliers. Fewer companies truly know them. In a more uncertain world, that distinction matters.

The companies that will perform best in the years to come will probably not be those that buy or produce the cheapest or fastest. It will be those who understand and monitor their supply chain and use this expertise to cooperate more closely, act earlier, adapt quicker, and consequently create a competitive advantage. This is the real value of vetting—not paperwork, but readiness.

In the next article of this series, I will address how to classify your products: Is it defence, dual-use, or civil?

Didrik Bech is a Board Member at CONFIDEE.

• < Previous Page