Annual satellite review vs. quarterly supplier audits: matching cadence to the risk

Most category teams already run a cadence. Quarterly business reviews with tier-one suppliers, annual contract renewals, maybe a risk scorecard refresh somewhere in between. The question that comes up more often now is where a geographic concentration check fits into that calendar, and whether it even needs its own slot.

It does, but not at quarterly pace. Here's why the two cadences are answering different questions.

What a quarterly audit is actually built to catch

A quarterly supplier audit is tuned to things that move fast: on-time delivery slipping, a quality escape, a covenant breach on the supplier's balance sheet, a certification lapsing. These are operational and financial signals, and they genuinely shift quarter to quarter. A supplier that looked fine in March can be on a watchlist by June because they lost a key account or missed a debt payment. That's exactly the kind of change a quarterly cycle is designed to surface before it becomes your problem.

None of that tells you whether three of your "different" suppliers share a loading dock. Financial health and physical location are unrelated variables. A supplier can pass every audit question you ask and still sit two kilometers from your other two suppliers in the same flood-prone industrial corridor, because nobody on the audit checklist asks where the building is.

Why concentration risk runs on a slower clock

Industrial parks don't relocate between audits. A port catchment doesn't shift its exposure to storm surge in a single quarter. The physical geography underneath your supply base is one of the slowest-moving variables in the whole risk picture, which is exactly why reviewing it every three months is overkill and reviewing it every five years is negligent.

An annual cadence sits in the gap those two extremes leave open. Once a year is often enough to catch a new supplier plant going up in the same park as two incumbents, a vendor subcontracting to a facility down the road from one you already flagged, or a cluster that's grown slowly as second-tier suppliers consolidate into the same cheap-land, good-logistics corridor. None of that shows up on a quarterly scorecard, because nobody's asking the scorecard question "where, physically, does this sit relative to everyone else we buy from."

The exception is a trigger event. An acquisition that merges two supplier bases, a new regional sourcing push into a country you haven't mapped before, a flood or earthquake that just hit a region you source from heavily. Those warrant pulling the concentration review forward, the same way a quality failure pulls a quarterly audit forward. Cadence is a default, not a ceiling.

Running both without doubling the workload

The two reviews don't compete for the same meeting slot if you're clear about what each one is for. Quarterly audits stay with procurement and quality, tracking the suppliers you already know are worth watching closely. The annual geography pass is a separate exercise that answers one narrower question: across the whole category, not just the suppliers on a watchlist, how much spend sits inside a single radius.

That's the gap Sourcing Concentration was built to close. It plots a year of category spend against the physical location of every supplier in it, once a year, and hands back a ranked list of clusters, so the industrial park or flood plain that turned into a single point of failure without anyone noticing shows up on a plan instead of staying buried in a vendor address list nobody cross-referenced against a map.

If your quarterly audits are solid but nobody's checked whether half the category sits inside one postcode, that's worth a look before the next renewal cycle, not after something forces the question.