Leadership Guide
The Diversification You Don’t Have
You audited n. A careful team audits n-1. Almost nobody checks n-2 — which is exactly where the real risk lives.
What the Framework Reveals
Why three suppliers can still be one point of failure
3
tiers deep the real risk usually sits
3
independently-audited suppliers that can still trace back to one shared source
0
visibility most audits have past the second tier
A biopharma company sources from three suppliers and calls its supply chain diversified. Those three suppliers each source from their own vendors, and a careful buyer has checked that layer too. Two tiers down, the picture is clean. It's the third tier where it usually isn't — where three independently-audited, seemingly unrelated suppliers turn out to be drawing the same input from the same obscure source nobody thought to ask about.
Source: Leadership Guide · Aug 2026 · MKA-23-LG, Executive Summary