STRATEGIES FOR MITIGATING NASA'S 

SUPPLIER VIABILITY RISK

REPORT NS106T1

Kristen M. Cheman

Lon C. Cross

Michael E. Dwyer

Melissa A. Horvath

Taylor H. Wilkerson

DECEMBER 2011
NOTICE:

THE VIEWS, OPINIONS, AND FINDINGS CONTAINED IN THIS REPORT ARE THOSE OF LMI AND 

SHOULD NOT BE CONSTRUED AS AN OFFICIAL 

AGENCY POSITION, POLICY, OR DECISION, 

UNLESS SO DESIGNATED BY OTHER OFFICIAL 

DOCUMENTATION.

LMI © 2011. ALL RIGHTS RESERVED.
iii

Strategies for Mitigating NASA’s Supplier Viability Risk

NS106T1/DECEMBER 2011

Executive Summary

Commercial and government organizations are susceptible to operational disruptions caused by the loss of viability of one or more of their suppliers.1 The National 

Aeronautics and Space Administration (NASA) is no exception, as it has programs 

that involve unique components and design requirements, single-source parts, and 

highly regulated materials.

LMI assessed NASA’s supply chain risks based on the characteristics of NASA’s 

line of business and surveys of representative NASA supply chains. LMI developed recommendations for possible mitigation strategies when a supplier’s viability was at risk. Our assessment followed a three-phased approach: 













We researched and assessed best practices for identifying and mitigating 

supply chain risks. 

We developed a methodology for assessing the level of supply chain risk 

associated with the loss of contractors and suppliers. The methodology is 

based on the likelihood and consequences of specific risks.

We provided recommendations for mitigation approaches that are specific 

to NASA. 

To gain a better understanding of the NASA organization and its supply chains, 

we attended a NASA supply chain quality assurance conference and surveyed

supply chain managers at four NASA programs. The survey responses revealed 

three general trends:

NASA supply chain risk mitigation policies are driven primarily by individual programs. 

Constant communication is the principal means of managing supply chain 

risks related to diminished supplier viability.

Efforts to evaluate the viability of suppliers stress past performance in 

terms of on-time delivery and quality.

 1 Suppliers may lose viability for any number of reasons, but we found that NASA is most 

susceptible to supplier bankruptcy; mergers, acquisitions, or divestitures; contract defaults; and 

regulatory non-compliance.
 

iv

We collected industry best practices based on a literature review of more than 

40 sources and interviews of industry supply chain management professionals. 

We used this information to develop five risk identification techniques and five 

risk mitigation strategies. Our final recommendations are supported by a business 

case analysis of each strategy, and we suggest policy, process, and contract language improvements that would aid in the implementation of each strategy. 

We offer a specific recommendation for a supplier viability management structure 

for NASA:











Evaluate suppliers based on risk likelihood and consequence. 

Segment suppliers by the type of program management and define roles 

and responsibilities for NASA and its prime contractors, as illustrated in 

Figure ES-1.2

Prioritize mitigation actions based on the type of program management. 

Engage the NASA supplier base in phases. 

Use a common structure for managing program and enterprise risks. 

Figure ES-1. Risk Management by Program Management Type

 

NASA Role Monitor Mentor Manage

Risk management 

responsibility Prime Prime NASA

Level of NASA 

Involvement

Risk program

Mature prime Novice prime NASA prime

Low

Moderate

High

2 In Figure ES-1, a “mature prime” is defined as a contractor that has a well developed supplier management program. A “novice prime” is defined as a contractor that does not have a well 

developed supplier management program.
v 

Contents

Chapter 1 Overview ................................................................................. 1-1

TASKS AND APPROACH .............................................................................................. 1-1

SCOPE ..................................................................................................................... 1-2

Chapter 2 Data Gathering........................................................................ 2-1

NASA SUPPLY CHAIN QUALITY ASSURANCE CONFERENCE.......................................... 2-1

REPRESENTATIVE SUPPLY CHAINS AND SURVEY RESPONSES ...................................... 2-1

LITERATURE SEARCH................................................................................................. 2-4

General Research ............................................................................................. 2-4

Supply Chain Risk Leadership Council.............................................................. 2-5

Supply Chain Council Database........................................................................ 2-5

COMMERCIAL INTERVIEWS ......................................................................................... 2-5

Manage from the Enterprise .............................................................................. 2-5

Scope the Program............................................................................................ 2-5

Understand Risk Detection Limitations.............................................................. 2-6

Relationships Are Better Than Metrics .............................................................. 2-6

Mitigation Is Supplier and Situation Dependant................................................. 2-6

Chapter 3 General Findings..................................................................... 3-1

SEGMENTING SUPPLIERS BY THE TYPE OF PROGRAM MANAGEMENT ............................. 3-1

SUPPLIER RISKS ....................................................................................................... 3-2

TOP 5 RISK IDENTIFICATION TECHNIQUES.................................................................... 3-3

TOP 5 RISK MITIGATION STRATEGY ............................................................................ 3-4

BUSINESS CASE ANALYSIS......................................................................................... 3-5

DEPTH OF RISK MITIGATION ....................................................................................... 3-6

Chapter 4 Methodology for Risk Quantification and Mitigation................. 4-1

RISK ASSESSMENT .................................................................................................... 4-1

Risk Consequences........................................................................................... 4-1

Risk Likelihood .................................................................................................. 4-3

Risk Matrix......................................................................................................... 4-6

Tailored Risk Mitigation Actions......................................................................... 4-7
 

vi 

Chapter 5 Recommendations and Conclusion......................................... 5-1

IMPLEMENTATION RECOMMENDATIONS........................................................................ 5-1

Governance....................................................................................................... 5-1

Supporting Processes ....................................................................................... 5-2

Supporting Policies............................................................................................ 5-3

Procurement and Contracting Approaches........................................................ 5-3

SUPPLIER VIABILITY MANAGEMENT STRUCTURE FOR NASA......................................... 5-4

Evaluating Suppliers Based on Risk Likelihood and Consequence................... 5-5

Segmenting Suppliers by the Type of Program Management ........................... 5-5

Prioritizing Mitigation Actions Based on Program Management ........................ 5-5

Engaging the NASA Supplier Base in Phases................................................... 5-6

Using a Common Structure for Managing Program and Enterprise Risks......... 5-6

CONCLUSION ............................................................................................................ 5-7

Appendix A Calculating a Z-Score

Appendix B Risk Aggregation

Appendix C List of Sources

Figures

Figure 3-1. Risk Management by Program Management Type .............................. 3-2

Figure 4-1. Consequence Rating Decision Tree ..................................................... 4-2

Figure 4-2. Supplier Risk Matrix.............................................................................. 4-7

Figure 4-3. Risk Mitigation by Program Management Type .................................... 4-8

Figure 5-1. Governance Structure for Supplier Management ................................. 5-1

Tables

Table 2-1. NASA Supply Chain Challenges............................................................ 2-2

Table 2-2. NASA Supply Chain Risk Identification Activities................................... 2-3

Table 2-3. NASA Supply Chain Risk Mitigation Activities ....................................... 2-3

Table 3-1. Mitigation Strategy Business Case Analysis.......................................... 3-5

Table 4-1. Risk Consequence Rating Scheme ....................................................... 4-3

Table 4-2. Metrics for Assessing Risk Likelihood.................................................... 4-3
Contents

vii 

Table 4-3. Z-Score Likelihood Points...................................................................... 4-4

Table 4-4. Additional Metric Likelihood Points ........................................................ 4-5

Table 4-5. Risk Likelihood Rating Scheme ............................................................. 4-6

Table 5-1. Roles of Primes and NASA in Supporting Processes ............................ 5-3
 

viii
1-1 

Chapter 1

Overview

In recent years, commercial and government entities have experienced program 

disruptions due to the loss of one or more suppliers. Supplier viability addresses 

whether a given supplier can reliably provide products and services despite economic and programmatic conditions. Absence of supplier viability may be manifest in terms of business-related events, such as bankruptcy, or process-related 

events, such as insufficient capacity. Supplier viability can have a substantial negative effect on a company’s operations over a broad range of programs. 

The National Aeronautics and Space Administration’s (NASA’s) supply chains 

are particularly susceptible to such effects. As the only U.S. government agency 

responsible for the nation’s civilian space program and aeronautics and aerospace 

research, NASA manages and executes a wide range of distinct and technically 

complex multiyear programs. 

Many of NASA’s programs involve unique components and design requirements, 

as well as highly regulated materials. Because NASA carries a significant portion 

of single-source critical parts1, the failure of an individual supplier can significantly affect a NASA program. If the supplier is used on several programs, the 

impact can negatively affect NASA’s enterprise operations. NASA’s supply 

chains also are susceptible to shifts and instability in program funding, which can 

make it difficult to build enduring relationships with suppliers. In addition, visibility beyond the prime contractor to sub-tier suppliers is often challenging.

TASKS AND APPROACH

We followed a three-phased approach to assess NASA’s supply chain risks and 

develop recommendations for mitigation strategies.

 First, we researched and assessed best practices for identifying and mitigating supply chain risks. We conducted surveys of managers in NASA’s Logistics Division and gathered data to analyze specific supply chains for the 

Space Shuttle Program, including those for the Multiplexer De-Multiplexer 

subsystem, auxiliary power unit, and ground support systems. We also examined supply chains that support the International Space Station 

Program’s orbital replacement units. We gathered data from a literature 

search of more than 40 documents and conducted interviews with NASA, 

 1 A “critical part” is defined as a part without which the NASA mission cannot be completed. 

Similarly, a “critical supplier” is a supplier that provides a critical part and who is the only certified source of the part. 
 

1-2 

government, and commercial supply chain risk experts. We assessed best 

practices from across the aerospace and other industries and analyzed their 

effectiveness and applicability to NASA. We then determined and provided 

the top five identification and top five mitigation practices for application to 

NASA’s supply chains.

Second, we developed a methodology for assessing the level of supply 

chain risk associated with the loss of contractors and suppliers, based on 

the likelihood and consequences of specific risks. We then identified primary supplier risks and provided NASA-specific tables for assessing both 

risk likelihood and risk consequences based on metrics that we developed. 

We also provided a risk matrix for prioritizing suppliers’ viability in terms 

of their risk to NASA programs, so that actions can be taken on those that 

represent the greatest threat to operations. 

Third, we provided recommendations for mitigation approaches. Based on 

the best practices we identified in our research, we developed a mitigation 

plan that included a business case analysis that described the pros and cons 

of each approach. We also developed recommendations for the policy and 

business process changes necessary to implement the suggested mitigation 

approaches. We then provided procurement and contracting methods necessary to implement each suggested mitigation strategy.





SCOPE

In this study, we focused on the risk of losing suppliers because of a business- or 

process-related cause, including the following: 

 Supplier going out of business due to bankruptcy 

 Supplier making a business decision to discontinue production or services

 Effects of mergers, acquisitions, or divestitures 

 Supplier or sub-tier contractual default

 Supplier’s inability to meet or accommodate changes in regulatory 

requirements

 Supplier capacity constraints 

 Extensive supplier certification time. 
Overview

1-3 

The following one-time events and technical risks were outside the scope of this 

study:

 Natural disasters

 Man-made disasters

 Vandalism

 Terrorism

 Labor issues

Non-compliant products or poor quality assurance

Counterfeit parts 

Technical issues

Programmatic issues. 








 

1-4 
2-1 

Chapter 2

Data Gathering

To fully understand the high-level risks associated with NASA’s supply chain and 

the viability of NASA’s suppliers, we began with background research, attending 

a NASA conference and surveying several representatives from NASA supply 

chains. Based on an initial literature search and a series of interviews of industry 

professionals, we investigated industry best practices related to supplier viability 

management.

NASA SUPPLY CHAIN QUALITY 

ASSURANCE CONFERENCE

Several of our team members attended the 5th Annual NASA Supply Chain 

Quality Assurance Conference at NASA Goddard Space Flight Center on 

October 18-19, 2011. The conference theme, “Managing Risks to Assure Mission 

Success,” focused on supplier risk management. Representatives from NASA and 

its suppliers attended, and each community contributed to presentations and discussions on how to improve supplier management. 

Our attendance at the conference provided us with a clearer picture of supplier 

risks, identification techniques, and mitigation strategies, from both a NASA and 

NASA supplier perspective. Based on our observations from the conference, we 

know that NASA strives to be proactive about supplier risk management, utilizes

set processes for supplier and supply chain risk assessment and identification, and 

continues to seek improvements to its current risk mitigation strategies. The conference also helped us identify representative supply chains that would yield additional insights into NASA’s supply chain risk management practices. 

REPRESENTATIVE SUPPLY CHAINS 

AND SURVEY RESPONSES

We developed a survey to collect input from a select group of NASA supply chain 

managers. Observations from the Supply Chain Quality Assurance Conference 

informed the development of the survey questions. 

The survey sample consisted of four programs: 

1. Ground Support Systems, Space Shuttle Program 

2. Multiplexer De-Multiplexer, Space Shuttle Program 
 

2-2 

3. Auxiliary Power Unit, Space Shuttle Orbiter

4. Orbital Replacement Unit (ORU) Spares, International Space Station 

Program. 

The survey served to elicit responses in the following three areas: 







The challenges NASA supply chains face with respect to maintaining supplier viability. 

Mitigation activities that have been undertaken, or are being undertaken, 

by NASA supply chain managers to reduce the risk of a supply chain disruption attributed to diminished supplier viability. 

Activities that have been undertaken, or are being undertaken, by NASA 

supply chain managers to identify suppliers who are at an increased risk of 

losing their viability. 

Table 2-1 highlights two challenges NASA must consider when devising mitigation strategies associated with supplier viability risk. All of the survey respondents face long lead times (up to 4 years) and extended periods for replacing lost 

suppliers (up to 5 years). 

Table 2-1. NASA Supply Chain Challenges

Challenge

Ground Support

Systems,

Space Shuttle Program

Multiplexer

De-Multiplexer,

Space Shuttle Program

Auxiliary Power Unit,

Space Shuttle Orbiter

ORU Spares,

International

Space Station Program

Order 

lead-times

 6 weeks (common

components)

6 months (long leadtime) 

 6 weeks (common

components)

 6 months (long leadTime)

 12–18 months  1–4 years (ORUs)

 Few days–few 

months

(consumables)

Supplier

replacement

 6–12 months  1–12 months

(item dependent)

 Irreplaceable

(certain parts) 

 5+ years

 May be impossible 

 Significant cost

The survey respondents’ efforts to identify suppliers with viability issues, in anticipation of an operational disruption, are summarized in Table 2-2. 

We divided the responses into two general practice areas: 





Monitoring actions 

Supplier rating schemes.
Data Gathering

2-3 

For example, the Ground Support Systems, Space Shuttle Program, employs a 

supplier rating scheme to assess viability issues. The supplier rating schemes focus on past performance related to quality assurance, rather than tracking selected

predictive indicators associated with supplier viability. For the managers of the 

Multiplexer D-Multiplexer program, constant communication s (i.e., monitoring) 

with the supplier works best. 

When the monitoring of suppliers viability falls to the prime contractor, routine 

communication with suppliers appears to be the most common practice. 

Table 2-2. NASA Supply Chain Risk Identification Activities

Ground Support Multiplexer ORU Spares, 

Systems, De-Multiplexer, Auxiliary Power Unit, International

Space Shuttle Program Space Shuttle Program Space Shuttle Orbiter Space Station Program

 Past performance–  Constant communica-  In 1990s tried predictive  Responsibility belongs to 

focused tions with suppliers works process, which failed prime contractor

 On-time delivery best  In 2004, conducted sup-  NASA participates in 

 Quality plier survey—mixed quarterly review 

results

 Regular communications 

has always worked best 

Table 2-3 summarizes the activities the respondent programs have undertaken, or 

are currently undertaking, to mitigate the supplier viability risks. The responses 

fell into two general categories:





Supplier communications

Enhanced inventory management techniques. 

Table 2-3. NASA Supply Chain Risk Mitigation Activities

Mitigation

Ground Support

Systems,

Space Shuttle 

Program 

Multiplexer

De-Multiplexer,

Space Shuttle 

Program 

Auxiliary Power Unit,

Space Shuttle Orbiter

ORU Spares, 

International

Space Station

Program 

Supplier 

communications

 (No data)  Constant communications by prime 

contractor with 

suppliers to identify 

support issues 

before they affect 

the program

 Prime contractor 

requires suppliers to 

provide 120-day 

advance notice of 

any loss of capability





Boeing must notify 

NASA of any supplier issues

NASA participates 

with Boeing in reviews of their 

suppliers

Inventory  Minimum: 9 × aver-  Minimum stock  Ordered two spare  Placed orders to 

management age monthly demand levels based on or- APUs for each cover expected

techniques 



Maximum: 24 × average monthly demand

Adjustments made

for longer lead-time 

items

der lead-times and 

demand history

orbiter lifecycle (ORUs)
 

2-4 

The survey responses revealed three general trends:

1. NASA policy, as it relates to supply chain risks associated with diminished supplier viability, is driven by the individual program. 

2. Respondents seem to be most comfortable with “constant communication” 

as the principal means of managing supply chain risks related to diminished supplier viability. 

3. Efforts to evaluate the viability of suppliers stress past performance in 

terms of on-time delivery and quality. 

These three trends, which reflect NASA’s approach to managing risk, are not consistent with the industry best practices. It is our experience that a “uniform” 

approach to risk management is the best, as it yields consistent positive results 

across an organization. 

Constant communication is an essential element of supplier management; however, an overreliance on communication and personal relationships can push riskrelated decision making down to lower levels in the organization, undermining an 

established system of risk governance. 

Finally, although past performance in terms of on-time delivery and quality are 

widely used to evaluate suppliers, past performance is not the only valid metric 

for evaluating future supplier viability.

LITERATURE SEARCH

General Research 

To identify and assess supply chain risk management best practices, we conducted 

a literature review and assembled more than 40 academic articles and reports on 

both commercial and government organizations. Our literature review emphasized 

the aerospace industry. Case studies, such as the example of Cisco in the X-SCM: 

The New Science of X-treme Supply Chain Management,

1 were also helpful in 

defining risks and risk mitigation tools and techniques. 

We extracted several more strategies and best practices that help organizations 

identify, understand, prioritize, address, and monitor different types of supply 

chain risk. Our search focused on best practices relating to supplier viability, including business- and process-related events. We also found numerous publications that provided practical strategies to mitigate risks relevant to NASA’s 

business environment. 

 1 Lisa H Harrington, Dr. Sandor Boyson, and Dr. Thomas M. Corsi, X-SCM: The New Science 

of X-treme Supply Chain Management, September 23, 2010 (Routledge; 1 edition). 
Data Gathering

2-5 

Supply Chain Risk Leadership Council 

We concentrated much of our literature review on documents available through 

the Supply Chain Risk Leadership Council. As a current council member, LMI 

continuously works with member companies, such as Boeing, Cisco, FedEx, and 

other industry leaders, to share products and research. The Supply Chain Risk 

Leadership Council’s August 2011 report, Supply Chain Risk Management: A 

Compilation of Best Practices, provided relevant strategies for risk identification 

and mitigation across a broad range of supply chain risks. 

Supply Chain Council Database 

The Supply Chain Council’s database generated numerous resources that outlined best practices for identifying and treating supply chain risk. In particular, 

the Supply Chain Council’s Supply Chain Operations Reference (SCOR®) 

model is a widely accepted evaluation framework for supply chain activities and 

their performance. The Supply Chain Council itself is comprised of nearly 1,000 

corporate members, and our review of the resources in the database provided 

current best practices in risk identification and mitigation practices from across

the industry.

COMMERCIAL INTERVIEWS

Supplier viability and risk management is a widely employed practice in the 

commercial sector. We interviewed several people who are familiar with industry 

best practices and who had specific experiences with supplier viability management. From these interviews, we identified some general findings regarding successful supplier viability management programs.

Manage from the Enterprise 

Suppliers often work with multiple units within a company or organization; however, the viability of the supplier is not dependent on any one business unit. The 

viability of suppliers should, therefore, be managed by the enterprise. This avoids 

duplication of effort across business units and allows a complete view of how the 

supplier serves its customer. Enterprise management of suppliers also promotes a 

more strategic relationship between the supplier and the customer. 

Scope the Program 

Most organizations work with hundreds, if not thousands, of tier 1 (or prime) suppliers, and each supplier is subject to a wide variety of risks. But the definition of 

critical suppliers often includes tier 2 and higher suppliers that provide critical technology or capacity-constrained materials. Attempting to manage every risk for every supplier would require resources that far outweigh any benefits. Supplier
 

2-6 

viability programs are often scoped to focus on the most critical risks, using the 

available resources as effectively as possible.

Suppliers should be prioritized based on their value to the customer organization. 

Value is typically measured by the total volume of business conducted with the 

supplier and the criticality of materials the supplier provides. Focusing on the 

more critical suppliers puts the risk management program’s emphasis where a 

supplier problem could have the greatest impact.

Likewise, the focus should be on the types of risk most likely to cause problems 

for an organization. By narrowing the types of risk that are of concern, a program 

can focus on monitoring and mitigating activities.

Finally, the program should leverage existing supplier management programs to 

avoid duplication of effort and overburdening suppliers with data requirements. 

Understand Risk Detection Limitations 

The more successful risk-management programs recognize that risk, by its very 

nature, involves uncertainty. Due to this uncertainty, no risk management method 

can predict and mitigate every risk event. Our interviewees recognize this and 

build a capability to respond to unforeseen events into their programs. Unforeseen 

events can be caused by a lack of data visibility or inaccurate data, as well as 

changes in market forces over time. Understanding these limitations helps build a 

program that provides the most protection, while recognizing the need for a rapid 

response to unforeseen events. 

Relationships Are Better Than Metrics 

According to all those we interviewed, all successful supply chain risk management programs use metrics to monitor supplier health, but they also foster positive 

relationships with critical suppliers. Since suppliers are more familiar with their 

specific market and financial situations, they are in a much better position to predict problems in their operations or with their suppliers. For this reason, a good 

working relationship with critical suppliers is a better method for monitoring for 

risk than using standard financial metrics. Of course, building a good relationship 

takes time.

Mitigation Is Supplier and Situation Dependant 

All those we interviewed expressed an opinion that the best choice of mitigation 

action depends heavily on the supplier and situation. The decision to direct more 

business to a supplier to help their cash flow or to stop business with the supplier 

and migrate to a more reliable source can hinge on a wide range of factors. For 

this reason, it is not possible to build a standard mitigation response to a given 

risk. Successful programs often have a suite of developed mitigation actions that 

they can employ alone or in combinations to address problem suppliers. 
3-1 

Chapter 3

General Findings

We leveraged data gathered from our attendance at NASA’s supply chain quality 

assurance conference, survey of NASA supply chain managers, literature search, 

and commercial interviews to offer an approach to supplier risk management that 

is dependent on program structure. We defined a list of supplier viability risks that 

are specific to NASA. We then assessed best practices for identifying and mitigating those supply chain risks. 

SEGMENTING SUPPLIERS BY THE TYPE 

OF PROGRAM MANAGEMENT

A well developed supplier management program includes the following: 













A supplier classification system based on supplier performance 

Regular monitoring of supplier performance, including quality and 

delivery

Regular monitoring of supplier financial health

Defined risk mitigation actions with systematic follow-up activities

Supplier mentoring programs 

Sub-tier supplier site visit programs.

NASA has a mixture of programs that are managed by either NASA or a prime 

contractor. It is inevitable that NASA and its various prime contractors will have 

different approaches to supplier risk management and even different capabilities. 

Further, NASA’s primes may have supply management programs at different 

stages of development.

As such, NASA has three basic program structures:







Programs led by a prime contractor with a well developed supplier management program, which we will define as a “mature prime” 

Programs led by a prime contractor without a well developed supplier 

management program, which we will define as a “novice prime” 

Programs led by NASA.
 

3-2 

Being classified as “mature” does not mean a contractor has been in existence for 

a long time or has experience with large number of contracts. The classification is 

solely defined by the development and reliability of the contractor’s supplier 

management program.

The three basic program structures are important, because the approach to managing 

supplier viability and risk changes depends on the structure, as shown in Figure 3-1. 

Figure 3-1. Risk Management by Program Management Type

NASA Role Monitor Mentor Manage

Risk management 

responsibility Prime Prime NASA

Level of NASA 

Involvement

Risk program

Mature prime Novice prime NASA prime

Low

Moderate

High

A prime contractor has responsibility for supplier risk, since it holds the supplier 

contracts. The contractor may operate its own supplier risk management processes, but it must be able to provide NASA with the specific reports and metrics it

requires. When the prime contractor is a novice prime (i.e., the contractor does not 

have a well-developed supplier management program), NASA should take more 

control over the monitoring of supplier viability to supplement the prime contractor’s capabilities. Naturally, if NASA is the prime integrator for a program, then 

NASA must take full responsibility for supplier viability management.

SUPPLIER RISKS

Today’s volatile market presents new financial, geopolitical, regulatory, and operational risks. These risks can lead to problems, such as supply chain disruptions, 

delays, system failures, forecasting errors, and procurement issues. Using our observations from the NASA supply chain conference and the results of our survey 

of NASA supply chain managers, we compiled a list of supplier viability risks 
General Findings

3-3 

that are specific to NASA.1 NASA’s supplier viability management should initially focus on risks to supplier financial health, including the following: 











Bankruptcy 

Supplier leaves business 

Mergers and acquisitions 

Contract default

Regulatory non-compliance. 

This focus can expand over time to include additional areas of risk in the supply 

chain; but initial activity should be limited to these types of risk to allow a manageable program scope.

TOP 5 RISK IDENTIFICATION TECHNIQUES

Based on information on best practices that we compiled during our literature

search and through interviews from across the aerospace and other industries, we 

identified the following proven risk identification best practices: 

1. Use publically available data, information available in-house, and data 

provided during the solicitation process to identify risks before suppliers 

are selected.

2. Identify critical suppliers and monitor them closely. Performing supplier

viability management can be overwhelming for large programs and enterprises. To narrow the scope of the problem, identify suppliers that have the 

greatest effect on the business. 

3. In addition to closely monitoring critical suppliers, maintain relationships 

with suppliers in order to gain additional visibility into supplier risks. Tailor the relationships, including any contact plans or data collection, based 

on the level of perceived risk. 

4. Use metrics (not just past performance) to anticipate supplier viability 

warning signs.

5. Ask the right questions. Utilize period reviews, surveys, or site visits to 

collect information about suppliers. The periodicity of review, scope of 

surveys, and number of site visits should be tailored based on the criticality of the supplier and their perceived risk level. 

1 As mentioned in Chapter 1, we considered only business- and process-related risk events. 
 

3-4 

TOP 5 RISK MITIGATION STRATEGY

In addition to using proven techniques to identify supplier risk, we noted the following proactive commercial risk mitigation strategies that can be used to anticipate and avoid supplier risks before they occur: 

1. Perform initial and ongoing supplier due diligence investigations. This includes using past performances and publically available data to evaluate 

suppliers before they are selected and throughout program execution. The 

evaluation of a supplier’s risk should not rely solely on data provided by 

the supplier. 

2. Follow risk assessment processes for new and existing suppliers. Understand the impact of a particular supplier on a program. Perform risk assessments on critical suppliers. This should include requiring the supplier 

to provide routine reports on key financial metrics, such as those described 

in Chapter 4, and visiting suppliers to perform on-site assessments.

3. Develop relationships with suppliers that focus on risk management. Grow 

existing relationships with suppliers to motivate them to continuously improve their risk management capabilities and encourage information sharing. Form relationships with new suppliers to build trust early. Having a 

number of close working relationships with suppliers helps prepare for situations when risk mitigation calls for joint response actions, renegotiating 

contracts, or investigating new sources. This may also include negotiating 

the option to procure data, methods, and tools, or making a lifetime buy 

from key suppliers. 

4. Establish an enterprise-level team responsible for managing supplier risk.

The team would be responsible for providing policy, oversight, and guidance associated with supplier risk management. The team would disseminate tools, encourage best practices, and and coordinate supplier risk 

management efforts at lower tiers of the organization. The team would be 

available to assist prime contractors with corrective action plans and mitigation strategies.

5. Develop a centrally hosted database of supplier profiles. The profiles contain supplier data collected through the acquisition process (such as past 

performance references and information about the supplier risk management program), metrics reporting, site visit results, survey results, and risk 

assessments. The profiles should be shared across programs. 

Before providing mitigation recommendations to NASA, we must first evaluate 

the commercial best practices as they apply to NASA. Then, we must consider 

how NASA would be involved in the implementation of each mitigation practice. 

These tailored risk mitigation actions are explained by program management type 

in Chapter 4. 
General Findings

3-5 

BUSINESS CASE ANALYSIS

We evaluated each commercial risk mitigation strategy as it applies to NASA. For 

each strategy, we considered a qualitative business case assessment and outlined the

advantages and disadvantages of each approach. (A more robust analysis would 

include a detailed cost analysis, but it would also require access to financial data.)

The advantages and disadvantages of each strategy are summarized in Table 3-1. 

Table 3-1. Mitigation Strategy Business Case Analysis

Mitigation strategy Pros Cons

Perform initial and ongoing supplier 

due diligence investigations. 

Promotes proactive risk detection. Adds terms to new contracts.

Requires resources and systems 

for monitoring.

Follow risk assessment processes 

for new and existing suppliers.

Prioritizes risk mitigation resources. Metrics may not be available for all 

suppliers (e.g., public versus private companies).

Develop relationships with suppliers, focusing on risk management.Promotes risk management 

collaboration.

Incorporates suppliers in the risk 

management team.

Relationships take time and resources to develop.

Establish an enterprise-level team 

responsible for managing supplier 

risk across the NASA enterprise.

Removes the responsibility of 

supplier risk management from an 

individual program’s management 

team.

Builds a knowledge-base and the 

capability for risk management.

Team could be staffed with personnel from NASA centers to get a 

broad perspective and capture lessons learned from across the enterprise.

Need full-time equivalents to staff 

the team.

Develop a centrally hosted database of supplier profiles.Allows for the sharing of supplier 

performance and risk information 

across NASA (and beyond).

Permits supplier performance trend 

analysis.

Requires resources and systems 

for monitoring.

Need to decide where best to host 

the database.

In general, taking action to mitigate supplier risk requires NASA to commit resources to support any monitoring and mitigation activities. While resource requirements differ among the strategies, none of the strategies would require an 

excessive number of new resources relative to the benefits. 

The quantitative benefits of effective risk management are difficult to calculate; 

however, there are clear qualitative benefits to NASA in protecting programs from 

supplier failure. There are also additional benefits to be gained by improving the 
 

3-6 

visibility of supplier performance across the enterprise and building better 

enterprise-level relationships with suppliers.

Effective supplier risk management requires people with supporting tools. By 

working with its suppliers to mitigate risk, NASA will have better tools to manage 

suppliers, reduce program delays due to failed suppliers, and improve long-term 

relationships with key suppliers. 

Applying these supplier risk identification and mitigation approaches will bring 

about benefits at the program level and the effects can be aggregated to the enterprise level. (This concept of using a common structure for managing program and 

enterprise risks is further explained in Chapter 5.) 

DEPTH OF RISK MITIGATION

A common concern for a supplier risk management program is determining how 

deeply to monitor and mitigate supplier risk within the supply chain. Maximum 

risk mitigation would lead programs to engage with suppliers as deeply as possible within the supply chain; however, constraints stemming from privity of contract and program office resources will limit the feasible depth of engagement.

The challenge is that critical suppliers may be two, three, or more tiers into the 

supply chain, and NASA and its prime contractors may not have the ability to influence suppliers at that level. In addition, the number of suppliers can grow exponentially at each succeeding tier within the supply chain, thus creating severe 

workload limitations. 

These limitations make it imperative for NASA to prioritize suppliers based on 

their criticality. Just as we recommend that NASA focus risk management resources on critical items, where a disruption in the supply can significantly impact 

the program, we recommend NASA determine which suppliers at lower tiers in 

the supply chain warrant monitoring or mitigation actions. In other words, NASA 

should consider including a next tier supplier when that supplier is providing a 

component or technology that is critical to the program.

Management of suppliers deeper in the supply chain should be consistent with the 

overall risk management program in terms of monitoring and mitigation methods, 

as well as the responsibilities for engaging the suppliers. NASA should consider 

the risk management expertise available within the supply chain and work with 

prime and sub-tier suppliers to ensure that risk is sufficiently managed without 

duplication of effort. 
4-1 

Chapter 4

Methodology for Risk Quantification 

and Mitigation

Based on the supplier risks identified for NASA, we defined metrics needed to 

gauge the consequences and likelihood of those risks, and then developed a risk 

matrix for prioritizing suppliers in terms of their risk to NASA programs. 

RISK ASSESSMENT

A risk assessment of a supplier or list of suppliers provides a systematic way to 

evaluate potential supply chain problems related to suppliers. Risks can be characterized by two quantities:

1. Consequence—a measure of the severity of the possible risk

2. Likelihood—a measure of the probability of the occurrence of each risk. 

For this study, we identified a method NASA can use to classify the consequence 

and likelihood associated with the loss of a particular supplier. The method involves the use of simple, objective criteria to quantify the likelihood and consequence of experiencing program impacts associated with supplier viability. 

We provide a quantitative method with specific numeric thresholds associated 

with the risk levels. The thresholds may be adjusted to suit the needs of individual 

programs, provided the adjusted thresholds are consistent with qualitative definitions we provide for the consequence and likelihood levels. This consistency is 

needed if ratings are to be aggregated across programs to provide an enterpriselevel perspective of risk. 

Risk Consequences 

Risk consequence measures the effect of a particular risk. In the case of supplier 

viability, risk consequence is synonymous with the impact of a supplier’s failure 

on a program. The consequence is directly related to the criticality of the items 

provided by the supplier to the program’s mission. In general, if the loss of supply 

for an item will affect the success of the mission, then the item is critical.
 

4-2 

We recommend assessing supplier risk consequences based on a decision tree, 

which considers the criticality of the part1 being supplied and the number of certified suppliers that can provide that part. This decision tree is shown in Figure 4-1. 

Figure 4-1. Consequence Rating Decision Tree

 

 

 

Is the part 

critical to the 

program’s 

mission?

Consequence 

Rating = 1

Is the part 

available 

from other 

certified 

sources?

Use the 

consequence rating 

table

Consequence 

Rating = 1

No

Yes

Yes

No

If a supplier is not critical or has multiple sources, then its consequence rating 

is 1. If the supplier is critical, then we use a metric that consists of the number of 

days of supply for the item that NASA has in its inventory, divided by the amount 

of time (in days) needed to certify and start receiving the same product from a 

new supplier. For items with significant technical complexity, the time to certify 

and start production with a new supplier should be multiplied by 1.2 to reflect uncertainty involved in complex production. 

The consequence rating for suppliers—on a 1-to-5 scale—is based on the schema 

defined in Table 4-1. The rating represents the severity (or impact) of a supplier’s 

loss of viability.

1 If a supplier provides multiple parts, consider the one that is most critical to the program.
Methodology for Risk Quantification and Mitigation

4-3 

Table 4-1. Risk Consequence Rating Scheme

Consequence 

rating Qualitative consequence rating definition

Criticality 

indexa

1 (Low)  Minor cost increase that can be absorbed within 

budget

 Minor schedule variance with no milestone impacts

 Minimal reduction in technical performance

>1.5

2 (Minor)  Cost exceeds budget, but sufficient funds are 

available

 Schedule slip, but no major delivery impact

 Minimal reduction in technical performance

1.2 to 1.5

3 (Moderate)  Cost exceeds budget and funding increase may be 

necessary

 Significant schedule slip that is partially recoverable 

at program level

 Some operational requirements may not be met

1.0 to 1.2

4 (Significant)  Cost exceeds budget and funding increase is 

necessary

 Significant slip in schedule and delivery likely to be 

impacted

 Mission success questionable

0.8 to 1.0

5 (Severe)  Large funding increase necessary

 Major impact to schedule

 Mission success unattainable 

<0.8

a Inventory (in days)/certification time (in days).

Risk Likelihood 

Risk likelihood is defined as the probability or frequency that a risk may occur. In 

terms of supplier viability, risk likelihood represents the level of certainty that a 

supplier will experience a loss of viability. Likelihood is based on the set of metrics which we define in Table 4-2. 

Table 4-2. Metrics for Assessing Risk Likelihood

Metric Definition 

Altman Z-score Z-score is a financial metric used to predict corporate bankruptcy. 

The Z-score calculation includes company earnings, assets, debt, 

sales, and working capital. We explain the calculation of the Zscore in Appendix A.

Program budget/schedule An assessment of the subject program’s actual budget and 

schedule compared to planned budget and schedule. Delayed 

programs and restricted funding can frustrate suppliers and hurt 

company cash flow.

Percentage of business 

with NASA 

The portion of the supplier’s overall business that is with NASA. 

Companies with a high portion of business with NASA are at 

greater risk from NASA program and budget changes. 
 

4-4 

Table 4-2. Metrics for Assessing Risk Likelihood

Metric Definition 

Regulatory burden A qualitative assessment of suppliers operating in a highly 

regulated industry or working with highly regulated materials and 

products. Companies subject to multiple regulations are more at 

risk of disruptions caused by regulatory changes. 

Supplier margin The net profit of the supplier. Companies with higher profit 

margin are less likely to experience financial failures. 

M&A postulated A qualitative assessment of the potential for a supplier to be 

involved in a merger or acquisition. Corporate priorities can 

change after a merger or acquisition, impacting the service to 

NASA.

Percentage of off-shore 

suppliers 

The portion of suppliers used that are foreign in origin. Foreign 

companies are less likely to have readily available financial data 

and are a higher risk due to cultural differences in sharing risk 

exposure information.

Percentage of small 

business suppliers 

The portion of suppliers that are small businesses. Small businesses tend to have a lower tolerance for financial problems and 

are more likely to experience a financial failure.

Because the Altman Z-score is a proven predictor of financial failures, we recommend starting the supplier assessment with a Z-score calculation and assigning 

likelihood points based on the results, as shown in Table 4-3. 

Table 4-3. Z-Score Likelihood Points

Supplier type Z-score Likelihood points

Public company >2.99 0 

between 1.81 and 2.99 5 

<1.81 10

Private company >2.90 0 

between 1.23 and 2.90 5 

<1.23 10

Suppliers can receive likelihood points of 0, 5, or 10 points based on their 

Z-score. If a supplier receives 10 points based solely on its Z-score, then the supplier is considered high risk, and no further evaluation is necessary. If a supplier 

receives a 0 or 5 based on their Z-score, it is still necessary to assess that supplier 

against the other metrics in Table 4-2. 

If the financial data required for the Z-score calculation is unavailable, such as for 

a private company, assign at least 5 likelihood points for the Z-score metric. To 

anticipate the event when a supplier is unable to or will not provide the financial 

data necessary for the Z-score calculation, introduce a contract requirement for 
Methodology for Risk Quantification and Mitigation

4-5 

the supplier to provide the data. If the supplier cannot provide the data or is unwilling to agree to the contract term, NASA can purchase financial reports from 

financial monitoring companies, many of which provide reports on private firms. 

As an example, Dun and Bradstreet maintains “Private Company Insight Reports” 

that offer key company data for more than 250,000 U.S. private companies, including financial data for up to 3 years.

We assigned likelihood points to the remaining metrics based on low and high 

risk criteria. If a supplier has a low risk for a particular metric, it receives 0 points 

for that metric; if a supplier has a high risk for the metric, it receives the corresponding points, as shown in Table 4-4. 

Table 4-4. Additional Metric Likelihood Points

Metric Risk level Risk criteria Likelihood points

Program budget/schedule Low At or below budget, on time or 

ahead of schedule 

0 

High >10% over budget or behind 

schedule

1 

Percentage of business 

with NASA 

Low <50% 0 

High >50% 3 

Regulatory burden Low No 0 

High Yes 3 

Supplier margin Low >5% 0 

High <5% 3 

M&A postulated Low No 0 

High Yes 1 

Percentage of off-shore 

suppliers 

Low <10% 0 

High >10% 1 

Percentage of small 

business suppliers 

Low <25% 0 

High >25% 1 

Once points are determined for each of the nine metrics, the sum of the points for 

a supplier then becomes its total likelihood rating. This rating is converted into a 

1-to-5 score using the scale in Table 4-5. The score represents the likelihood a 

supplier will encounter a viability risk.
 

4-6 

Table 4-5. Risk Likelihood Rating Scheme

Risk level

Qualitative likelihood 

rating definition Likelihood rating

Nearly certain = 5 Most always encountered; practically 

unavoidable event.

Risk score of 10 or more

Highly likely = 4 Expected to occur; typically occurs 

in efforts of a similar nature

Risk score of 6 to 9

Possible = 3 Even likelihood of occurrence; often 

encountered in similar efforts

Risk score of 4 to 5

Unlikely = 2 Hypothetically possible, but uncommon in programs of similar typeRisk score of 2 to 3

Very unlikely = 1 Rarely encountered; standard practices will effectively avoid eventRisk score of 0 to 1

The risk consequence rating scheme in Table 4-1 and risk likelihood rating 

in Table 4-5 are intended to be a starting point for NASA’s risk assessment of its 

suppliers. This study did not include a review of NASA programs to ensure that 

the ranges are appropriate for NASA’s suppliers. With additional analysis, the 

criteria provided can be tuned to allow an appropriate distribution of the suppliers 

into the various risk levels for consequence and likelihood. 

Risk Matrix 

Consequence and likelihood together can be used to identify the risk each supplier 

presents to the program. Using the 1-to-5 ratings for consequence and likelihood, 

the risk of a particular supplier can be plotted on the matrix shown in Figure 4-2. 

The matrix can be used to visualize the risks for individual suppliers in relation to 

one another, prioritize the order in which each is addressed, and plan ways to mitigate each risk. Based on its placement in the matrix, a supplier is determined to 

have a low, medium, or high risk of failure. Suppliers that fall into the green range 

are considered low risk; suppliers that fall into the yellow range are considered a 

moderate risk; and suppliers that fall into the red range are considered a high risk.2

 2 Notice that a supplier with a low consequence rating will always be a low risk, no matter 

how likely the risk is to occur. For this reason, we calculate a supplier’s consequence rating first 

and can eliminate the likelihood rating calculations for suppliers in this category.
Methodology for Risk Quantification and Mitigation

4-7 

Figure 4-2. Supplier Risk Matrix

Likelihood of occurrence

Consequences

(2,5) (3,5) (4,5) (5,5)

(1,4) (2,4) (3,4) (4,4) (5,4)

(1,3) (2,3) (3,3) (4,3) (5,3)

(1,2) (2,2) (3,2) (4,2) (5,2)

(1,1) (2,1) (3,1) (4,1)

1 2 3 4 5

1

2

3

4

5 (1,5)

(5,1)

Low

risk

Medium

risk

High

risk

Tailored Risk Mitigation Actions 

The mitigation actions, if any, applied to a supplier should be based on the supplier’s risk level, as calculated using the consequence and likelihood measures described above. The mitigation actions that NASA employs should also be tailored 

based on the program management structure described in Chapter 3. The depth of 

NASA’s involvement will increase based on the level of risk and the extent to 

which NASA can rely on the prime contractor—if there is one—to manage risks 

associated with supplier viability. Figure 4-3 shows an example of mitigation actions that are a function of risk level and program management structure. 
 

4-8 

Figure 4-3. Risk Mitigation by Program Management Type

Risk program

Mature prime Novice prime NASA prime

High 

Risk

Likelihood

• Implement 

corrective action

plan

• Implement 

corrective action 

plan

• Employ NASA 

supplier risk team

• Employ NASA 

supplier risk team 

• Renegotiate 

contracts

• Provide consulting 

support

Consequence

• Start contracting 

new source

• Make lifetime buy

• Obtain data, 

drawings, tooling

• Start contracting 

new source

• Make lifetime buy

• Obtain data, 

drawings, tooling

Medium 

Risk

Likelihood • Increase supplier 

monitoring

• Increased supplier 

monitoring

• Require more 

frequent /detailed 

reporting

• Increased supplier 

monitoring 

• Require more 

frequent /detailed 

reporting

• Counsel supplier

Consequence • Investigate new 

source

• Investigate new 

source

Low

Risk

Likelihood • Conduct ongoing supplier due diligence

• Conduct routine supplier performance reporting Consequence • Develop relationships with suppliers

1

2

3

1

4

4

4

3

2

2

3 3

3

2

2

3

3

3

4

3 3

3 3

a The numbers to the left of each action in Figure 4-3 represent their mapping to the top five risk 

mitigation practices listed in Chapter 3.

For any risk level, the mitigation strategies for that risk level, as well as any 

below it, should be implemented. 
5-1 

Chapter 5

Recommendations and Conclusion

NASA would benefit from an effective enterprise supplier management capability, 

but this capability needs to fit within NASA’s business needs and programmatic 

goals.

IMPLEMENTATION RECOMMENDATIONS

To implement the five top mitigation strategies, supplier viability management 

must be embraced at all levels of the enterprise. This will require the implementation of policies and processes throughout the supply chain. In this section, we outline several supporting policies and processes that may be used, along with some 

suggested additions to the existing procurement and contracting processes. 

Governance 

NASA should establish a three-tiered governance structure, as shown in Figure 5-1: 

NASA’s enterprise supplier risk team, NASA program managers, and the prime for 

a particular program. 

Figure 5-1. Governance Structure for Supplier Management

NASA 

Enterprise 

Risk Team

Program Managers

Mature 

Prime

Novice 

Prime

NASA 

Prime

Policy, Guidance,

and Mentoring Visibility

Guidance Summary

Reports

Guidance and 

Mentoring Reports Data Management

These are the players that, to various degrees, will perform and implement the risk 

mitigation strategies. 
 

5-2 

Supporting Processes 

The following processes will aid in the implementation of the recommended mitigation strategies:

1. Establish a NASA enterprise-level supplier risk team with a formal charter 

and roles and responsibilities. The team is responsible for overall supplier 

risk program management and mitigation actions. The team develops 

standard risk management practices and tools. It also ensures that the supplier profile database is up-to-date and utilized across the enterprise.

2. Share risk management practices with primes according to their specific 

needs. This effort would focus on the novice and NASA primes. The 

NASA supplier risk team would mentor novice primes in developing a 

mature supplier risk management system. For NASA primes, the NASA 

supplier risk team would ensure NASA program managers are aware of 

and leverage standard risk management practices and tools. The primes 

can share the processes with suppliers that have sub-tier suppliers.

3. Prioritize suppliers based on funding and criticality. Establish a process 

for building relationships with critical suppliers that is consistent with the 

Federal Acquisition Regulations. Perform periodic visits to critical supplier sites to collect metrics and foster relationships. The organization performing the site visits would depend on the type of program management 

involved, as shown in Table 5-1. 

4. Establish a regular process for collecting and aggregating data and metrics for suppliers. Store the information in a central supplier profile database that is hosted in a place where it can be utilized and shared across the 

enterprise.

Table 5-1 summarizes the roles of the prime and NASA with respect to the processes described above.
Recommendations and Conclusion 

5-3 

Table 5-1. Roles of Primes and NASA in Supporting Processes

Supporting

processes

Role of NASA 

enterprise

supplier risk 

team

Role of NASA 

program 

manager

Role of mature 

prime

Role of novice 

prime

Role of NASA 

prime

1. Establish a 

NASA enterprise-level 

supplier risk 

team.

Perform Follow resulting 

policy and guidance

Follow resulting 

policy and guidance

Follow resulting 

policy and guidance 

Follow resulting 

policy and guidance 

2. Share risk 

management 

practices 

with primes.

Develop Perform Receive 

minimal 

guidance

Receive 

substantial guidance

Receive 

substantial guidance

3. Prioritize 

suppliers 

and build relationships.

Provide 

guidance

Provide 

assistance to 

prime, as 

necessary

Perform Perform with 

guidance from 

NASA supplier 

risk team.

Perform

4. Establish 

process for 

data collection.

Provide 

guidance and 

aggregate data

Receive data; 

assist with 

data collection, 

as necessary

Collect data in 

own format

Provide 

summary to 

NASA 

Report quarterly 

(or monthly for 

high risk 

suppliers)

Collect data in 

NASA format

Provide summary 

to NASA, with 

additional detail 

as needed

Report quarterly 

(or monthly for 

high risk 

suppliers)

Collect data in 

NASA format

Provide detailed 

reports to NASA

Report monthly

Supporting Policies 

NPD 7500.1 can be modified to support the proposed mitigation strategies. Potential language for inclusion under the policy section of NPD 7500.1 is shown below:

Programs and projects will include supplier risk identification and mitigation procedures in accordance with applicable guidance. 

Procurement and Contracting Approaches 

The following procurement and contracting procedures will also support a proactive supplier viability management program:

1. Integrate risk mitigation into NASA’s sourcing process. Add language to 

procurement documents requiring prime contractors to provide a description of their supplier risk management processes. Evaluate the responses 

relative to the “mature prime” criteria described in Chapter 3. Utilize the 

proposed risk metrics and supplier risk matrix during the procurement 

process—before a supplier is selected.
 

5-4 

2. Use the supplier profile database for analysis and evaluation. Once a supplier profile database is established, use it and any past performance references to evaluate prime contractors and their sub-tier suppliers. The 

database should enable NASA program managers to evaluate potential 

suppliers during source selection. The database should also enable NASA 

program managers and the NASA supplier risk team to track trends in 

supplier viability.

3. Incorporate contract language that requires metrics reporting. The metrics should support NASA’s role based on the type of program management. For a mature prime, NASA will need access to high-level data for 

the monitoring role (for example, results of risk assessments, identified 

risks, and mitigation plans). For novice prime and NASA Prime, NASA 

will need access to the detailed data used in performing assessments and 

developing mitigation actions, for example: names of sub-tier suppliers 

and associated demographics, business, and financial data. 

Prime contractors can collect the data according to their own supplier risk 

management processes, as long as they can translate the information and 

provide it in a format that is preferred by NASA. 

As discussed in Chapter 3, the range and depth of data NASA should pursue will depend on a number of factors including analytic capacity, privity 

of contract, and the nature of relationships within the supply chain. 

4. Incorporate contract language that states NASA reserves the right to become involved in a supplier’s risk management process as necessary. Privity of contract will limit the level of NASA’s direct access to processes and 

data; however, appropriate language can allow NASA to obtain as much information as possible to serve as the ultimate owner of program risk.

These processes, policies, and procurement and contracting approaches will vary 

depending on whether NASA or a prime contractor is managing the program. 

SUPPLIER VIABILITY MANAGEMENT STRUCTURE 

FOR NASA

We recommend NASA consider a supplier viability management structure that 

consists of five basic elements as shown below. We describe each element in detail on the following pages. 







Evaluating suppliers based on risk likelihood and consequence. 

Segmenting suppliers by the type of program management.

Prioritizing mitigation actions based on program management.
Recommendations and Conclusion 

5-5 





Engaging the NASA supplier base in phases.

Using a common structure for managing program and enterprise risks. 

Evaluating Suppliers Based on Risk Likelihood 

and Consequence 

We recommend NASA follow a risk assessment approach that evaluates the likelihood of supplier failure and the consequence to NASA if that failure occurs. As 

explained in Chapter 4, the assessment of likelihood utilizes a set of metrics; but, 

ultimately, it is converted to a 5-point scale to reflect uncertainty in the metrics 

themselves and to support a simplified assessment. Similarly, a consequence rating (which considers the criticality of the part being supplied and the number of 

certified suppliers that can provide the part) is assigned to suppliers and is also 

based on a 5-point scale. 

Together, the likelihood and consequence ratings can be used to identify the risk 

each supplier presents to a program. The pair of ratings can be used to plot suppliers on a risk matrix to visualize supplier risks in relation to one another, to prioritize the order in which each is addressed, and to plan ways to mitigate each risk.

Segmenting Suppliers by the Type of Program Management 

NASA’s level of involvement in its supplier risk management depends on the 

management structure of the program, as defined in Chapter 3. For example, supplier reporting frequency will be different for a prime that has a well developed 

supplier risk management program compared to one that does not. In addition, 

NASA’s risk management responsibilities will be different, depending on whether 

NASA or a prime contractor is the lead integrator for a program. Whether monitoring, mentoring, or managing the supplier risk for a program, NASA should 

always play some role in the overall supplier risk management plan and this role 

should be determined at the start of the program. 

Prioritizing Mitigation Actions Based 

on Program Management 

Mitigation actions are highly dependent on the specific supplier, the risks they 

face, and other situational elements. In selecting appropriate mitigation actions for 

medium- or high-risk suppliers, NASA should consider the program management 

structure. The depth of NASA’s involvement will increase based on the level of 

risk and the extent to which NASA can rely on the prime contractor—if there is 

one—to manage risks associated with supplier viability. We provided a methodology for assessing the level of risk and developing tailored mitigation actions in 

Chapter 4. 
 

5-6 

Engaging the NASA Supplier Base in Phases 

NASA and its prime contractors work with thousands of suppliers; therefore, it is 

unreasonable to expect NASA to be able to monitor and manage each supplier for 

risk exposure. That is why NASA and its prime contractors should approach supplier risk management in a phased approach that addresses suppliers according to 

their criticality.

We recommend the following order for addressing supplier risk: 

1. Sole-source, critical part suppliers 

2. Sole-source, high volume ($) suppliers 

3. Multiple source, critical part suppliers 

4. Multiple source, high volume ($) suppliers 

5. Long-term suppliers 

6. Other suppliers. 

This phased approach will allow NASA to address the highest risk areas in its

supply chain, while developing a knowledge base for supplier risk management 

within NASA Headquarters.

Who takes action in terms of engaging the supplier base will depend on the type 

of program management. Under routine circumstances, mature primes will work 

with their suppliers independently. Novice primes will take the lead when working with their suppliers, with guidance from the NASA supplier risk team. NASA 

primes will engage the suppliers directly.

As discussed in Chapter 3, the depth to which NASA should engage the supplier 

base will depend on a number of factors, including analytic capacity, privity of 

contract, and the nature of relationships within the supply chain. 

Using a Common Structure for Managing Program 

and Enterprise Risks 

NASA needs two levels of supplier viability management: at the program level

and at the enterprise level. We recommend NASA assess supplier viability risk at 

the program level and aggregate the results to the enterprise level. This can be 

done by assigning a criticality weight to each program that reflects the importance 

of the program to NASA’s overall mission. The program weights should be percentages that all sum to 100 percent. 
Recommendations and Conclusion 

5-7 

Each supplier’s consequence rating can then be multiplied by the weights of all programs the supplier supports. So the total consequence rating for a supplier becomes:

Equation 5-1. Total Consequence Rating

Consequencetotal = ∑ Consequenceprogram × Weightprogram. 

The likelihood of supplier risk should be consistent across programs and at the 

enterprise level, so it does not need an aggregation method. Additional information on this calculation and an example are included in Appendix B. 

Following this approach, NASA will be able to conduct a single assessment of 

suppliers to capture the risk at the program and enterprise levels. This reduces the 

burden on suppliers and program managers, while providing a consistent method 

for evaluating and tracking risk exposure. 

The methodology for risk analysis at the program level presented in this report is 

intended as a guide—individual program managers may tailor the risk criteria 

ranges and other values as they deem appropriate. Thus, program results aggregated at the NASA level will convey the perspectives of the individual programs. 

Provided that the program tailoring is consistent with the standard definitions in 

Table 4-1 and Table 4-5, the aggregated results should be sufficiently consistent 

to enable analysis at the enterprise level.

CONCLUSION

Like other commercial and government organizations, NASA’s supply chains are 

vulnerable to supplier viability risk, in terms of business- and process-related 

events. Monitoring specific supplier viability risks (beginning with a supplier’s 

financial health and eventually growing to other areas of risk), evaluating the likelihood and consequences of risks for each supplier, following risk identification 

best practices, and implementing key risk mitigation strategies will allow NASA 

to alleviate supplier risk for individual programs first, and then roll benefits up to 

the NASA enterprise level.
 

5-8 
A-1 

Appendix A

Calculating a Z-Score 

The Z-score model1 uses financial statement ratios and multiple discriminate 

analysis to assess a company’s risk of going into bankruptcy. The Z-score has 

proven to be an accurate tool for predicting financial distress and is widely used 

as a risk assessment tool. There are two Z-score calculation methods, one for publicly traded companies and one for private companies. 

Z-SCORE FOR PUBLIC COMPANIES

The Z-score calculation for publically traded companies is shown in Equation A-1. 

Equation A-1. Z-Score Calculation for Publically Traded Companies

Z = 3.3

EBIT

Total Assets + 1.2

Net Working Capital

Total Assets + 1.0

Sales

Total Assets

+ 0.6

Market Value of Equity

Book Value of Debt

+ 1.4

Accumulated Retained Earnings

Total Assets

where Z is the Z-score for the company 

and EBIT is earnings before interest and taxes. 

In practice, Altman found that a score between 1.81 and 2.99 indicates that a firm 

is having financial difficulty and a score below 1.81 predicts bankruptcy. 

Z-SCORE FOR PRIVATE COMPANIES

Because privately owned companies have different financial structures, there is a 

different Z-score calculation for private companies. That calculation is shown in 

Equation A-2. 

 1 Stephen Ross, Randolph Westerfield, and Jeffrey Jaffe, Corporate Finance, 5th Edition, 

Irwin/McGraw-Hill, 1999. Edward Altman developed the Z-score model for predicting corporate 

bankruptcy.
 

A-2 

Equation A-2. Z-score Calculation for Private Companies

Z = 0.717

Net Working Capital

Total Assets + 0.847

Accumulated Retained Earnings

Total Assets

+ 3.107

EBIT

Total Assets + 0.420

Book Value of Equity

Total Liabilities

Sales

+ 0.998 Total Assets

The results for private companies are interpreted differently, as well. A Z-score 

below 1.23 predicts bankruptcy, a score between 1.23 and 2.90 indicates financial 

difficulty, and a score above 2.90 indicates the firm is financially healthy.
B-1 

Appendix B

Risk Aggregation

NASA needs two levels of supplier viability management: at the program level 

and at the enterprise level. The framework we are recommending for NASA to 

manage supplier risk can be used at both. This is a useful approach to allow program level assessments to be used to evaluate the total risk to NASA.

Our recommended risk assessment approach is based on an evaluation of a supplier’s likelihood of failure and the consequence of failure to the NASA program’s mission. The likelihood and consequence ratings for the supplier are then 

plotted using a matrix, as shown in Figure B-1. 

Figure B-1. Recommended Risk Assessment Matrix Likelihood of occurrence

Consequences

(2,5) (3,5) (4,5) (5,5)

(1,4) (2,4) (3,4) (4,4) (5,4)

(1,3) (2,3) (3,3) (4,3) (5,3)

(1,2) (2,2) (3,2) (4,2) (5,2)

(1,1) (2,1) (3,1) (4,1)

1 2 3 4 5

1

2

3

4

5 (1,5)

(5,1)

Low

risk

Medium

risk

High

risk

To aggregate this assessment from the program level to the enterprise level, we 

need to understand how the perspectives of likelihood and consequence differ at 

those two levels. The likelihood of supplier failure does not change from the program perspective to the enterprise perspective. In other words, the likelihood is an 

assessment of the supplier’s financial health, and the financial health is in no way 
 

B-2 

dependant on who is observing the supplier. For this reason, the same likelihood 

assessment of a supplier can be used at both the program and the enterprise levels. 

The consequence of a supplier failure, on the other hand, changes in two ways as 

we move from a program to an enterprise perspective. The first consequence 

change is in the importance of the individual program to the NASA enterprise 

mission. A supplier failure that can significantly impact a program may not be a 

large concern at the enterprise level if the program is not critical to NASA’s mission. Likewise, a supplier failure that has a moderate impact on a program may 

have a large impact at the enterprise level if that program is critical to achieving 

NASA’s enterprise goals. So, the consequence of failure must be weighted by the 

importance of the program to the enterprise. 

The second way the perception of consequence changes at the enterprise level is 

by the number of programs a supplier supports. While a supplier failure may have 

a moderate impact on a specific program, the impact at the enterprise may be severe if that supplier is supporting multiple NASA programs.

We recommend a consequence aggregation method that accounts for the ways 

that consequence changes at the enterprise level. The recommended approach is 

based on assigning a weight to each NASA program. Each supplier’s consequence

rating can then be multiplied by the weights of all programs the supplier supports. 

So the total consequence rating for a supplier is shown in: 

Equation B-1. Calculation for Total Consequence Rating

×

ASSIGNING PROGRAM WEIGHTS

Not all NASA programs are equal in their importance to the NASA mission. To recognize the relative importance of the programs in aggregating risk, we assign a percentage weight to each program, with the total of program weights across the NASA

enterprise summing to 100 percent.

This weighting approach achieves two goals. First, it puts the program level consequence of failure into an enterprise perspective based on the importance of the 

program. Second, the enterprise consequence of a supplier failure is increased as 

the supplier supports more programs. 
Risk Aggregation

B-3 

CALCULATING ENTERPRISE CONSEQUENCE

Calculating the consequence of a failure at the enterprise level is then a matter of 

summing the program consequences and program weights for a given supplier. 

Note that the program consequences for a supplier can differ across programs. 

The same supplier can be providing a critical technology to one program and 

common commercial parts to another. This is a simple summation calculation to 

arrive at the total enterprise consequence of a supplier failure.

AGGREGATION EXAMPLE

The following example, illustrated by Figure B-2, illustrates our recommended 

approach. 

Figure B-2. Aggregation Example

P1 P2 P3

S1 S2 S3

In this example, there are three programs (P1, P2, and P3) and three suppliers (S1, 

S2, and S3). S1 supports P1 and P2; S2 supports P2; and S3 supports P1, P2, and P3. 

In an evaluation of the significance of the significance of each program to 

NASA’s overall mission, P2 has been weighted to reflect its greater importance, 

followed by P3 and then P1, as shown in Table B-1. 

Table B-1. Program Weights

Program Weight

P1 20%

P2 50%

P3 30%
 

B-4 

According to our approach, the first step is assessing the suppliers’ risk at the program level. The program risk ratings for these suppliers are shown in Table B-2: 

Table B-2. Program Risk Ratings

Supplier Likelihooda P1 Consequenceb P2 Consequenceb P3 Consequenceb

S1 3 4 3 N/A

S2 4 N/A 5 N/A

S3 5 3 3 3 

a The likelihood ratings are based on the schema defined in Chapter 4, Table 4-5. a The consequence ratings are based on the schema defined in Chapter 4, Table 4-1.

Given this information, the enterprise consequence ratings for each supplier are as 

follows: 

S1

S2 = 5 × 50% = 2.5 

S3 = 3 × 20% + 3 × 50% + 3 × 30% = 3.0

= 4 × 20% + 3 × 50% = 2.3 

When plotted in the risk assessment matrix (see Figure B-3), we can see that S3

shows the highest risk to the enterprise due to the number of programs the supplier supports, even though it only exhibits a moderate risk to any program. 

Figure B-3. Aggregation Example Plotted in the Risk Assessment Matrix Likelihood of occurrence

Consequences

1 2 3 4 5

1

2

3

4

5

S1

S2

S3
C-1 

Appendix C

List of Sources

The following books, reports, articles, briefings, NASA survey respondents, and 

interviews contributed to the development of this report: 

BOOKS

Lisa H Harrington, Dr. Sandor Boyson, Dr. Thomas M. Corsi, X-SCM: The New 

Science of X-treme Supply Chain Management, September 23, 2010 

(Routledge; 1 edition). 

Dave Nelson, Patricia E. Moody, Jonathan Stegner, The Purchasing Machine,

2001 (The Free Press). 

Stephen Ross, Randolph Westerfield, and Jeffrey Jaffe, Corporate Finance, 5th

Edition, Irwin/McGraw-Hill, 1999. 

REPORTS

Air Force Space Command, Space and Missile Systems Center Standard, Program 

and Subcontractor Management, SMC Standard SMC-S-019, 13 June 2008. 

Arkes, Jeremy, Mary E. Chenoweth and Nancy Y. Moore. “Best Practices in Developing Proactive Supply Strategies for Air Force Low-Demand Service 

Parts.” RAND Corporation, 2010, URL: 

http://www.rand.org/content/dam/rand/pubs/monographs/2010/RAND_MG85

8.sum.pdf. 

Bickel, Robert, Clifford A. Grammich and Nancy Y. Moore. “Developing Tailored Supply Strategies.” RAND Corporation, 2007, URL: 

http://www.rand.org/pubs/monographs/MG572.html. 

Galluzzi, Michael, Martin Steele, Oliver de Weck, and Edgar Zapata. “Foundations of Supply Chain Management for Space Application.” American Institute of Aeronautics and Astronautics 2006-7234, Space 2006, September 19-

21, 2006, URL: http://strategic.mit.edu/docs/3_84-AIAA-2006-7234.pdf. 

Supply Chain Risk Leadership Council. “Supply Chain Risk Management: A 

Compilation of Best Practices.” August, 2011, URL: 

http://www.scrlc.com/articles/Supply_Chain_Risk_Management_A_Compilat

ion_of_Best_Practices_final[1].pdf. 
 

C-2 

ARTICLES

“How to fortify your supply chain through collaborative risk management.” 

PricewaterhouseCoopers LLP (2009). 

Parry, Glenn; Mills, John; Turner, Celine. “Lean competence: integration of theories in operations management practice.” Supply Chain Management 15.3 

(2010): 216-226. 

“The making of a lean aerospace supply chain.” Supply Chain Management 4.3 

(1999): 135. 

Pagell, Mark; Wu, Zhaohui. Building a more complete theory of sustainable supply chain management using case studies of 10 exemplars.” Journal of Supply 

Chain Management 45.2 (Apr 2009): 37-56. 

Reuter, Carsten; Foerstl, Kai; Hartmann, Evi; Blome, Constantin. “Sustaintable 

global management: The role of dynamic capabilities in achieving competitive 

advantage.” Journal of Supply Chain Management 46.2 (Apr 2010): 45-63. 

“Inter-organizational governance, learning and performance in supply chains.” 

Supply Chain Management 15.2 (2010): 101-114. 

Creazza, A; Dallari, F; Melacini, M. “Evaluating logistics network configurations 

for a global supply chain.” Supply Chain Management 15.2 (2010): 154-164. 

Pagell, Mark; Wu, Zhaohui; Wasserman, Michael E. “Thinking differentloy about 

purchasing portfolios: An assessment of sustainable sourcing.” Journal of 

Supply Chain Management 46.1 (Jan 2010): 57-73. 

Collin, Jari; Eloranta, Eero; Jan Holmström. “How to design the right supply 

chains for your customers.” Supply Chain Management 14.6 (2009): 411-417. 

“Developing key performance indicators for supply chain: an industry perspective.” Supply Chain Management 14.6 (2009): 422-428. 

Fawcett, Stanley E Andraski, Joseph C; Fawcett, Amydee M; Magnan, Gregory 

M. “The Art of Supply Change Management.” Supply Chain Management 

Review 13.8 (Nov 2009): 18. 

Varga, Liz; Allen, Peter M; Strathern, Mark; Rose-Anderssen, Chris; Baldwin, 

James S; Ridgway, Keith; et al. “Sustainable Supply Networks: A Complex 

Systems Perspective.” Emergence: Complexity and Organization 11.3 (2009): 

16-36. 

Foster, Finley. “How to spot—and Help—an At-risk supplier.” Supply Chain 

Management Review 13.5 (Jul 2009): 18. 
List of Sources

C-3 

Rose-Anderssen, Christen; Baldwin, James S; Ridgway, Keith; Allen, Peter M; 

Varga, Elizabeth. “Knowledge Transformation, Learning and Changes Giving 

Competitive Advantage in Aerospace Supply Chains.” Emergence: Complexity and Organization 11.2 (2009): 15-29. 

Trautmann, Gerhard; Turkulainen, Virpi; Hartmann, Evi; Bals, Lydia. “Integration in the Global Sourcing Organization–An Information Processing Perspective.” Journal of Supply Chain Management 45.2 (Apr 2009): 57-74. 

Rose-Anderssen, Christen; Baldwin, James; Ridgway, Keith; Allen, Peter; Varga, 

Liz; Strathern, Mark; et al. “A cladistic classification of commercial aerospace 

supply chain evolution: IMS.” Journal of Manufacturing Technology 

Management 20.2 (2009): 235-257. 

Ellegaard, Chris. “Supply risk management in a small company perspective.” 

Supply Chain Management13.6 (2008): 425-434. 

Keogh, Olive. “At braking.” Supply Management 13.21 (Oct 16, 2008): 24-28,31. 

Friedman, Dick. “System Contracts: Add Specific Performance Guarantees To 

Avoid Problems.” Supply House Times 51.5 (Jul 2008): 30. 

Collin, Jari; Eloranta, Eero; and Jan Holmström. “How to design the right supply 

chains for your customers.” Supply Chain Management14.6 (2009): 411-417. 

Chopra, Sunil and ManMohan S. Sodhi. “Managing Risk to Avoid Supply-Chain 

Breakdown.” MIT Sloan Management Review Vol 46, No 1, 2004, URL: 

http://www.kellogg.northwestern.edu/research/risk/projects/Sunil%20Chopra.

pdf. 

Christopher, Martin, “Understanding Supply Chain Risk: A Self-Assessment 

Workbook.” Cranfield University, School of Management, Department for 

Transport, 2003, URL: 

https://dspace.lib.cranfield.ac.uk/bitstream/1826/4373/1/Understanding_suppl

y_chain_risk.pdf. 

Kelly, Jim and Jennifer Lawrence. “Checklist: Four Steps to Mitigating Supplier 

Risk and Protect Your Supply Chain. Supply & Demand Chain Executive, 

March 31, 2010, URL http://www.sdcexec.com/article/10269270/checklistfour-steps-to-mitigating-supplier-risk-and-protect-your-supplychain?print=true. 

Tatsumi, Byron. “Balance Supplier Risk Versus Reward.” Supply & Demand 

Chain Executive, March 1, 2011, URL: 

http://www.sdcexec.com/article/10234236/balance-supplier-risk-versusreward?print=true.
 

C-4 

BRIEFINGS

Healey, Janice and Jenny Arthurs (2005, June). “Leveraging D&B’s trusted supplier information to help you mitigate risk in your supplier portfolio.” 

Harrington, Lisa (2011, October). “Supply Chain Strategies and Practices for 

Volatile Conditions.” 

NASA SURVEY RESPONDENTS

Ground Support Systems, Space Shuttle Program. 

Multiplexer De-Multiplexer, Space Shuttle Program.

Auxiliary Power Unit, Space Shuttle Orbiter.

Orbital Replacement Unit (ORU) Spares, International Space Station 

Program.

INTERVIEWS

Ted Bujewski, Industrial Base and Supply Chain Manager, NASA

Mike Galluzzi, NASA Kennedy Space Center

Lisa Harrington, the lharrington group 

Kim Miller, Senior Manager BCA SM Business Operations 

The Boeing Company 

David Morrow, ESSF Supplier Risk Management Lead

U.S. Air Force Global Logistics Center