When the Risk Sits in Someone Else's Business
Why resilience no longer stops at your own front door
An organisation can be well run and still be exposed through the businesses it relies on.
Most organisations have spent recent years strengthening what they directly control. Systems have been hardened, plans written, teams trained. That work matters, and it shows. What has moved more slowly is the recognition that a large share of any organisation's risk now sits outside its own walls, in the suppliers, platforms and service providers it depends on every day.
A UK government foresight report on global supply chains, published by the Government Office for Science in June 2026, makes the point plainly. It concludes that traditional approaches to supply chain risk, often focused on direct relationships or single points of failure, are no longer sufficient. Modern supply networks are so interconnected that disruption in one place can quickly affect many others, and their complexity makes them difficult to fully map or monitor.
Why the second tier is where the surprises come from
You know your suppliers. Their suppliers are another matter.
Ask most organisations about their key providers and the answers come easily. The contracts are known, the relationships are managed, performance is reviewed. Ask about the businesses those providers depend on and the picture fades quickly. The report notes that firms are particularly vulnerable when they lack visibility beyond their first tier of suppliers, rely on single critical suppliers or sites, or operate with very little in reserve.
This is where disruption tends to arrive unannounced. The provider you contracted may be sound. The specialist they rely on, or the single site that serves an entire sector, may not be. When it fails, the disruption reaches you all the same, and it usually arrives with less warning than any risk you carry directly.
Why efficiency quietly created the exposure
The savings were always visible. The fragility was not.
None of this happened through carelessness. For decades, organisations were rewarded for running lean. Holding stock was a cost. Using one excellent supplier was simpler than managing three. Each decision was rational, and each one quietly concentrated exposure. The efficiency appeared in the accounts every quarter. The fragility only appears when something breaks.
The lesson is not that efficiency was a mistake. It is that efficiency and resilience sit in tension, and for a long time only one of them was measured. The report describes a broad shift already under way, with organisations moving toward diversified sourcing and deliberate spare capacity, accepting a known cost in exchange for a smaller surprise.
Why there is no single fix
Spare capacity, flexibility and recovery only work together.
The evidence gathered for the report is careful on this point. Holding spare capacity without flexibility can be costly and still fail in an extreme event. Flexibility without any buffer can be overwhelmed by a major shock. Fast recovery counts for little if an organisation returns to exactly the same exposure it held before. Resilience comes from balance, not from any one measure applied enthusiastically.
For boards, this is a useful test of comfort. If the organisation's answer to supplier risk is a single measure, a second source here or a contract clause there, the question worth asking is what happens when the disruption does not respect that measure.
Why this reaches private families as well as boardrooms
A household has a supply chain too. It is rarely called one.
The same dependence runs through private life. A family office relies on wealth platforms, travel providers, staff agencies, security firms and technology it did not build. A residence depends on power, connectivity and a small number of firms trusted to maintain it. These arrangements are chosen with care, and then, quite naturally, assumed.
The questions are the corporate ones in a quieter register. Who do we truly depend on. What would we do this week if one of them failed or was compromised. Which of them holds information or access that matters. Families that can answer calmly have usually thought about it in advance, not during the failure.
Why dependence is a prevention-led question
The time to learn who you rely on is before it is tested.
Dependence itself is not the problem. No organisation or family can, or should, do everything itself. The risk sits in dependence that has never been examined. A prevention-led approach starts by making the picture accurate: naming the handful of providers whose failure would hurt most, understanding what sits behind them, and agreeing in advance who acts, and how, if one of them is lost.
Little of this is technical. Most of it is a set of calm questions asked in ordinary time, recorded plainly and revisited when circumstances change. It is unglamorous work, which is often the mark of the work that matters.
Could you name the failures that would hurt you most?
A short, discreet review can show where operations or a household quietly depend on someone else's resilience.
Most organisations can list their suppliers. Far fewer can say which five failures elsewhere would stop them, or what they would do in the first day if one happened. A calm, practical review can establish that picture quietly, and turn an assumption into something you actually know.
About SJ Group International
A discreet, senior-led consultancy supporting clients through security, risk and crisis matters.
SJ Group International advises private clients, family offices, corporates and other organisations on security, risk, crisis management and preparedness. The firm is known for calm, senior-level support, discreet delivery, and a practical approach shaped by real-world experience.
Explore our Services, view our Training, or make a discreet enquiry.
Clarity before action. Readiness before crisis.