Supply Chain Risk, Sole Sources and Dual Sourcing
Most aerospace supply risk sits below tier 1, in the mills, forges, foundries and special process houses your suppliers share. Map those sub-tiers from the cert pack and FAI, keep a short owned risk register, plan obsolescence with SD-22, and dual source only where a stoppage is costly and the second source can be kept qualified.
Updated
Single source, sole source and dual source are different problems
A sole source is a part or process that only one supplier can provide, usually because of design data, tooling, a qualification or a specification approval. A single source is a part that more than one supplier could make, but you buy from one by choice. Dual source means two suppliers are qualified and both are actively shipping. The response to each is different, so label every item correctly before you spend money on mitigation.
The federal definition is narrower than the way buyers use the term. FAR 2.101 defines a sole source acquisition as a contract entered into after soliciting and negotiating with only one source. That describes how a contract was placed, not whether alternatives exist. In supply chain risk work the useful question is physical: if this supplier stopped shipping tomorrow, who else could build a conforming part, and how long before their parts would be accepted?
| Term | What it means in practice | Typical cause | Usual response |
|---|---|---|---|
| Sole source | No other supplier can deliver a conforming item today | Proprietary design, unique tooling, a qualified product listing held by one maker, a customer-approved processor list with one name | Protect the relationship, buffer stock, watch financial and capacity signals, plan a long qualification or redesign |
| Single source | Others could do it, but only one is set up and approved on your side | Price, convenience, an FAI that exists only at one shop, inertia | Decide whether a second source is worth its qualification cost; keep the data package portable |
| Dual source | Two approved suppliers, both shipping | Deliberate risk decision or a customer requirement | Give each enough volume to stay current; keep both FAIs and approvals valid |
| Hidden single point | Two approved suppliers that share one sub-tier mill, forge, foundry or process house | Concentration below tier 1 that nobody mapped | Sub-tier mapping; require notification of sub-tier changes |
The last row is the one that surprises programs. Two machine shops are not two sources if both buy the same forging from the same forge, or both send parts to the one anodizer your customer approved.
Where the risk usually sits: below tier 1
Most supply interruptions on machined and fabricated hardware start at a sub-tier, not at the shop holding your purchase order. The sub-tiers that concentrate risk are the ones with few qualified players, long lead times, or approvals that cannot be transferred quickly.
| Sub-tier | Why it concentrates risk | What to find out |
|---|---|---|
| Material mills and service centers | Specialty alloys, product forms and thicknesses come from a short list of melters; DFARS specialty metals rules can narrow it further | Melt source, country of melt, product form and spec, whether the shop buys from stock or from a mill allocation |
| Forgings and castings | Dies, patterns and process qualifications belong to one supplier; requalifying a new forge or foundry can mean new first articles and testing | Who owns the tooling, where it physically sits, the qualification status and the forge or foundry's own lead time |
| Special process houses | Heat treat, chemical processing, NDT and welding often require Nadcap accreditation or a customer approval naming the specific facility | Which processor is used, its approval scope, and whether a second approved processor exists |
| Electronic and electromechanical parts | Parts go end of life on the manufacturer's schedule, not yours | Lifecycle status, authorized channel, last time buy dates, approved alternates |
| Test labs | Environmental and qualification test capacity is limited and scheduled weeks out | Which lab, its accreditation, and how far ahead it books |
The Defense Department named castings and forgings as one of five priority areas in its February 2022 report Securing Defense-Critical Supply Chains, written in response to Executive Order 14017, alongside microelectronics, energy storage and batteries, kinetic capabilities, and strategic and critical materials. That is a useful signal for any buyer whose parts start as a forging or casting. Our forging and casting pages describe the tooling and qualification steps that make those sub-tiers slow to replace.
Have a part like this?Send it in under a minute. A person replies within 1 business day.How to map your sub-tiers without a consultant
Start from paperwork you already receive. A complete cert pack and a first article report together describe most of a part's supply chain, and building the map from them costs a few hours per part number rather than a survey project.
- Pick the parts that matter. Rank part numbers by consequence of a stoppage: flight-critical items, long lead items, and anything on the critical path of a delivery.
- Read the AS9102 Form 2. The product accountability form lists raw material, special processes and functional tests with their specifications, suppliers and certificate references. It is a ready-made list of the sub-tiers that touched the part. See our first article inspection guide for the forms.
- Read the material cert. Note the mill, heat or lot number, melt location and spec. The certs and traceability page covers what a complete cert shows.
- List every outside process in route order. Machining, heat treat, NDT, finish, marking and cleaning each have a facility name.
- Mark approvals that block substitution. A process that must be done by a customer-approved or Nadcap-accredited facility, a forging with a qualified die, or a part on a qualified products list cannot be moved quickly.
- Look for overlap. Put all suppliers for your top parts in one sheet and sort by sub-tier name. Shared nodes are your hidden single points.
Keep the map as data, not a slide. A sheet with part number, tier 1 supplier, sub-tier name, sub-tier role, approval constraint and last verified date can be filtered when a sub-tier has a fire, a strike or an accreditation lapse.
DMSMS planning and SD-22
Diminishing manufacturing sources and material shortages (DMSMS) management is the planned version of obsolescence response: you watch for parts and materials that are going away and decide on a resolution while options are still cheap. The Defense Standardization Program Office publishes SD-22, DMSMS: A Guidebook of Best Practices and Tools for Implementing a DMSMS Management Program, and states on its DMSMS page that the guidebook was updated in January 2026 and addresses both electrical and mechanical parts obsolescence. The same office lists DoD Instruction 4245.15 as the governing policy and SD-26 as a companion on DMSMS contracting language. Confirm the current edition on the DSPO site before you cite it in a contract.
The guidebook is written for program offices, but the practical loop works at any scale:
- Keep an indentured parts list with manufacturer part numbers, not only your internal numbers, so you can match discontinuance notices to your hardware.
- Monitor. Watch manufacturer product change and end of life notices and GIDEP. Our obsolete parts page explains GIDEP access and screening.
- Assess impact against remaining program quantity and life, including spares.
- Pick a resolution early. Common options are a last time or bridge buy, an approved alternate or substitute, an aftermarket source, emulation or a new build from drawings, and redesign. Each gets more expensive the longer you wait.
Mechanical obsolescence is easy to miss. Material specifications get cancelled or superseded, a forging die wears out, and processes change for environmental reasons, as with cadmium plating and hexavalent chromium chemistry discussed on our plating and cadmium alternatives page. Put those items on the same watch list as the electronics.
A risk register a buyer can actually maintain
A useful supply chain risk register is a short list of specific, owned risks with triggers, not a heat map of generic categories. If a row cannot name the part, the supplier node and the person who acts, delete it or rewrite it.
| Field | What to enter | Example entry |
|---|---|---|
| 1. ID and date opened | Unique number, date | SCR-014, opened at quarterly review |
| 2. Item | Part number and revision, or material spec | Machined fitting, PN and rev from your drawing |
| 3. Supply node | Tier 1 and the sub-tier where the risk sits | Tier 1 machine shop; sub-tier is the only customer-approved anodizer on the program list |
| 4. Risk statement | Cause, event, effect in one sentence | If the anodizer loses its approval or capacity, finished parts stop, and the next assembly misses its build date |
| 5. Likelihood and consequence | Scored against your written criteria | Likelihood 2 of 5, consequence 4 of 5 |
| 6. Trigger or early warning | The observable signal | Accreditation status change, queue time above an agreed number of days, late process certs |
| 7. Mitigation | Action, owner, due date | Request approval of a second processor; build a finished-goods buffer |
| 8. Residual risk and acceptance | Score after mitigation and who accepted it | Accepted by program manager, dated |
| 9. Review date | Next look | Next quarterly review or on trigger |
The fields deliberately mirror what AS9100D asks of an operational risk process, covered below: assigned responsibility, defined criteria for likelihood, consequence and acceptance, identification and communication, mitigation of risks above the acceptance line, and recorded acceptance of what remains. A register built this way doubles as audit evidence.
What a second source really costs: qualification and FAI
A second source costs far more than its piece price. The real cost is the one-time work to get it approved and the recurring work to keep it approved, and both should be estimated before anyone promises a dual-sourced part.
- Data package. The new supplier needs a drawing at a known revision, specifications, and any process or inspection requirements that live outside the drawing. If the design data belongs to the incumbent, you may not have the rights to share it.
- Source approval. Many programs require the design authority or the end customer to approve a new source before its parts can be installed.
- First article. A change of manufacturing source is a standard trigger for a new first article inspection under AS9102 and the customer clauses that invoke it. Expect a full FAI on the first lot from the new source, plus sub-tier FAIs if your clauses require them.
- Special process approvals. If the new shop uses a different heat treater or finisher, those processors may need their own approval.
- Testing. Castings, forgings and some critical parts carry qualification testing that has to be repeated at a new source.
- Your own labor. Supplier audit or survey, FAI review, quality planning, and engineering disposition of any questions.
- Keeping it alive. A source that receives no orders goes cold. Tooling is scrapped, programs are lost, people move on, and many customer clauses treat a lapse in production as a reason for a new FAI.
Dual sourcing pays when the consequence of a stoppage is high and the second source can be kept warm with real volume. It rarely pays on a low-volume part with a stable sole source and a buffer you can afford. For those, a documented recovery plan (data package ready, candidate shops identified, buffer stock sized to cover qualification time) often gives most of the protection for a fraction of the cost.
Safety stock and pre-buying long-lead material
Buffers buy time, and the right buffer depends on which part of the chain is slow. If the bottleneck is raw material or a forging, buffer the material. If the bottleneck is the whole route, buffer finished parts.
| Buffer | Protects against | Watch for |
|---|---|---|
| Finished-goods safety stock | Any interruption in the route | Revision changes that strand stock; storage and preservation; inventory carrying cost |
| Raw material pre-buy held at the supplier | Mill and forging lead times | Ownership and identification of your material, cert retention, specialty metals compliance, protection from use on other orders |
| Long-lead material authorization | Waiting for the full order before material is bought | Clear limits on what is authorized and what happens if the order changes |
| Last time buy | A part or material that is ending production | Quantity for remaining life and spares, storage conditions, date codes, shelf life |
Size a buffer to cover the time it would take to recover, not to an arbitrary number of weeks. For a sole-sourced part, that is roughly the time to qualify a new source and deliver its first conforming lot. For limited-life items such as elastomers, adhesives and sealants, a buffer can expire on the shelf, so check the rules on our shelf life control page before you stock up. Defense rated orders under the Defense Priorities and Allocations System can also change a supplier's queue; the lead times page explains DO and DX ratings.
What AS9100 says about risk
AS9100D, the 2016 revision, has two risk clauses that matter to a buyer, and the rest of the standard refers back to them. Confirm the current revision on SAE before quoting clause numbers in a contract.
- Clause 6.1, actions to address risks and opportunities. When planning its quality system, the organization determines its risks and opportunities, plans actions to address them, and evaluates whether those actions worked. Actions must be proportionate to the potential impact on product conformity.
- Clause 8.1.1, operational risk management. The organization plans, implements and controls a process for operational risks that covers assigned responsibilities, risk assessment criteria such as likelihood, consequence and acceptance, identification and communication of risks, mitigation of risks above the acceptance criteria, and acceptance of the residual risk. A note in the clause limits its scope to risks in the operational processes of clause 8.
A September 2023 Quality Progress article hosted by the International Aerospace Quality Group explains how this plays out by function, with procurement controlling external provider risks under clause 8.4, including verification activities, counterfeit parts and raw material testing. The same article notes that clause 10.2.1 requires risks and opportunities to be updated when a corrective action is raised, which means a supplier escape should change your register.
What this means for buyers: an AS9100 supplier should be able to show you its own operational risk process and how it covers its sub-tiers. Ask to see it. The standard does not say how deep a supplier must map, so your quality clauses decide that. Our supplier quality clauses page covers how primes write sub-tier flow-down and notification requirements.
Questions to ask a supplier about its own sub-tiers
Ask these during supplier selection and again at annual review. Good suppliers answer them quickly because they already track the information.
- Which of our part numbers depend on a sub-tier that is the only approved source for that material, forging, casting or process?
- For each special process on our parts, which facility performs it, what is its accreditation or customer approval scope, and do you have a second approved processor?
- Where is our raw material melted and bought, and do you buy from stock or from a mill allocation?
- Who owns the forging dies, casting patterns and fixtures for our parts, and where are they physically kept?
- How do you notify us before changing a sub-tier, a process or a manufacturing location, and how much notice do you give?
- How do you flow our quality clauses, counterfeit prevention requirements and export control requirements to your sub-tiers?
- How do you monitor end of life notices for purchased parts in our assemblies?
- What is in your operational risk register that touches our parts?
- What capacity constraints, such as a single machine, a single certified welder or a single inspector, would stop our parts?
- What would it take to hold raw material or finished parts for us, and how would they be identified and protected?
Record the answers in your sub-tier map with the date. An answer that changes between reviews is itself a risk signal.
What to put on the PO or RFQ
Risk controls only work if they are contractual. Add these to the RFQ so they are priced in, and to the purchase order so they are enforceable:
- A requirement to identify sub-tier sources for material, forgings, castings and special processes on the quote or with the first article.
- Notification before any change of sub-tier, process, manufacturing location or tooling, tied to a new or partial FAI where the change affects the part.
- Customer-approved or accredited processor requirements by name or list, so the supplier cannot swap processors without approval.
- Ownership, identification and storage terms for any material or tooling you fund, including pre-bought material held at the supplier.
- Flow-down of counterfeit prevention, DFARS specialty metals and export control clauses to all tiers where they apply. See DFARS specialty metals and counterfeit parts avoidance.
- For electronic and other purchased parts, lifecycle status and an obligation to pass on end of life notices.
- Quantity and schedule visibility: a forecast or blanket order that lets the supplier commit long-lead material.
Our RFQ builder and need date planner help assemble these requirements and back-schedule long-lead material.
Get a second source or a sub-tier map started
If you need a second source qualified for a part, a long-lead item pre-bought, or a mixed BOM placed with requirements flowed down to every tier, send us the part list and the risk you are trying to cover. We source from qualified suppliers, flow down your sub-tier, notification and approval requirements, check the paperwork before parts ship, and a person replies within one business day. We sign a mutual NDA before files, and controlled drawings follow the process on controlled programs. For the cost side of the same decision, read should-cost and total cost of ownership.
Send the job. A person replies within 1 business day.
Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.
We have it.
Reference . A person replies within 1 business day. Watch for our email from [email protected].
Questions
What is the difference between sole source and single source?
A sole source is the only supplier that can deliver a conforming item, usually because of proprietary data, unique tooling or a qualification. A single source is a choice: other suppliers could make the part, but only one is set up and approved. Sole sources call for protection and long-range plans, while single sources call for a decision on whether a second source is worth its qualification cost.
Does a new supplier need a full first article inspection?
Usually yes. A change of manufacturing source is a standard trigger for a new FAI under AS9102 and the customer quality clauses that invoke it, and the first lot from a new source normally gets a full FAI rather than a partial one. Check your own clauses, because some programs also require design authority approval of the new source before any parts are installed.
What is SD-22?
SD-22 is the Defense Standardization Program Office guidebook of best practices and tools for implementing a DMSMS management program. DSPO states it was updated in January 2026 and covers both electrical and mechanical parts obsolescence. It sits under DoD Instruction 4245.15, the DMSMS policy, with SD-26 as a companion on contract language. Confirm the current edition on the DSPO site.
Does AS9100 require supply chain risk management?
AS9100D requires a process for managing operational risks under clause 8.1.1, with assigned responsibility, criteria, identification, mitigation and acceptance of residual risk, and clause 6.1 covers risks and opportunities in planning. External provider risk falls within purchasing controls. The standard does not set how deep a supplier must map its sub-tiers, so your quality clauses should say what you expect.
How much safety stock should I hold for a sole-sourced part?
Size the buffer to cover recovery time, not a fixed number of weeks. For a sole-sourced part, recovery time is roughly how long it would take to qualify another source and receive its first conforming lot, including FAI and any special process approvals. Check shelf life and revision stability before buying ahead, since expired or obsolete stock is lost money.
How do I find hidden single points of failure in my supply chain?
List the sub-tiers for your most important parts from AS9102 Form 2, material certs and process certs, then sort all suppliers by sub-tier name. Wherever two tier 1 suppliers share a mill, forge, foundry or special process house, you have a hidden single point. Ask each supplier to notify you before changing any of those sub-tiers.
Related
Sources
- FAR 2.101 Definitions, sole source acquisition (acquisition.gov)
- Defense Standardization Program Office, DMSMS program page (SD-22, SD-26, DoDI 4245.15)
- SD-22, DMSMS guidebook, earlier September 2010 edition listing (EverySpec)
- DoD Instruction 4245.15, Diminishing Manufacturing Sources and Material Shortages Management (November 5, 2020)
- Quality Progress, September 2023, Making sense of AS9100D risk requirements (IAQG hosted), with clause 6.1 and 8.1.1 text
- SAE AS9100D, Quality Management Systems, Requirements for Aviation, Space and Defense Organizations
- SAE AS9102C, Aerospace First Article Inspection Requirement
- U.S. Department of Defense, Securing Defense-Critical Supply Chains (February 2022, EO 14017 report)
Ready to
source it?
A person replies within 1 business day. NDA first.
Request a quote