A test that returns amber statuses has measured opinion. The output worth having is a duration: how long a named node can be offline before the network misses volume, and how far that sits from a severity somebody has signed. Calibration is the argument that matters, so take the shock from the worst comparable outage on record and add margin, then apply it to the planning model rather than to a supplier list. Single-node tests overstate endurance whenever the alternate shares a sub-tier, a site, a port or a certification body. The Basel Committee put reverse stress testing at the centre of its principles for a reason: starting from the failure and solving for the shock that causes it reaches exposures a scenario list never gets to.
The annual risk review runs for two hours. Fourteen people, a heat map with probability on one axis and impact on the other, and around forty entries positioned by consensus. Two things come out of it. A small number of red entries that were red last year, and a slide recording that the process happened.
Nobody in the room could say how many weeks the business would keep shipping if the coatings supplier's only plant stopped tomorrow. That question has an answer. It is a number, it can be computed from data the business already holds, and getting it does not require anyone to estimate a probability.
That last point is what makes the exercise tractable. Arguing about whether a plant fire is a one-in-forty-year event or a one-in-fifteen-year event consumes the room and changes nothing, because the estimate is unfalsifiable and everyone knows it. The McKinsey Global Institute's 2020 work on global value chains put disruptions lasting a month or more at roughly one every 3.7 years for a typical company, which is often enough that the interesting question is what you survive rather than what you expect. Simchi-Levi and colleagues made the same move in Harvard Business Review in January 2014 by pairing recovery duration against endurance, and a separate post works that pair through in detail, so I will leave it there and concentrate on the part a stress test adds: how severe the shock should be, what happens when two nodes fail for the same reason, and what a pass is supposed to mean.
Calibrating the shock is the whole argument
Bank supervisors solved the political half of this problem by publishing the scenario. The Bank of England has run an annual cyclical scenario since 2014 with the severity fixed centrally, which means the firms being tested argue about their response rather than about the premise. Supply chain stress tests almost never do this, and the result is that every plant manager negotiates the shock down to something their existing plan handles.
Fix the severity first, in writing, before anyone models anything. Four parameters cover most cases.
Duration. How long the node is unavailable. Take the worst comparable event on public record for that failure mode and add margin. Semiconductor and specialty chemical plant fires have historically produced outages measured in months rather than weeks, and the Philips Albuquerque fire of March 2000, documented at length in the trade and academic literature afterwards, is the canonical illustration of a small incident with a long tail. If your assumed duration is shorter than the worst published event in your own category, you are testing a comfortable number.
Magnitude. Whether output goes to zero or to some fraction. Partial capacity loss is more common than total loss and considerably harder to plan, because allocation decisions arrive with it.
Scope. Whether the shock hits one site, one supplier, one region or one commodity. This is the parameter that decides whether the test is worth running, and the next section is entirely about it.
Restart profile. Output rarely resumes at rate on the day the plant reopens. Sheffi and Rice set out the shape in MIT Sloan Management Review in 2005: a disruption profile with a first response, a period of degraded performance and a recovery that is slower than the fall. Assuming a step back to full rate flatters every result.
Somebody senior signs those four numbers. That signature is the governance the exercise needs, because once the severity is fixed the rest is arithmetic and the arithmetic is not negotiable.
Working one node all the way through
Take a specialty coating from a single supplier with one plant. The finished goods it gates consume 12,000 units a week. Cover sits in three places: four weeks at the plant, one and a half weeks in transit, two and a half weeks downstream in finished goods. Eight weeks in total.
There is a qualified alternate. It can supply 40 per cent of the weekly requirement, and its contract gives it three weeks' notice before first shipment. Signed severity for a single-site chemical plant outage is 14 weeks.
Run it. For the first three weeks the alternate is spinning up, so consumption draws on stock at the full rate and three weeks of cover go. From week three the alternate is delivering 40 per cent, so the drawdown slows to 0.6 of a week's requirement per week, and the remaining five weeks of cover last a further 8.3 weeks. Stock runs out at week 11.3. From there to week 14 the business is short 0.6 of a week's requirement every week, which totals 1.6 weeks of requirement, or 19,200 units. At a contribution of 14 per unit that is around 269,000 of contribution, before any customer consequence that outlives the outage.
So the network absorbs 11.3 weeks and the signed shock is 14. The gap is 2.7 weeks, and there are three ways to close it.
Hold more cover. Closing 2.7 weeks at a 0.6 drawdown needs 1.6 weeks of extra requirement in stock, 19,200 units, roughly 115,000 of inventory at a six unit cost, call it 25,000 a year to carry.
Raise the alternate's share. To reach 14 weeks the drawdown after week three has to fall to five weeks of cover spread over eleven weeks, which is 0.45 a week, which means the alternate has to cover 55 per cent rather than 40. That costs whatever the split penalty on fifteen points of volume costs, and a separate post prices that decision properly.
Remove the notice period. Pre-authorise the call-off so the alternate starts at week zero rather than week three. The drawdown is then 0.6 from the beginning, eight weeks of cover last 13.3 weeks, and the endurance improves by exactly two weeks. Three weeks of notice were costing two weeks of endurance, and the fix is a clause in a contract you are already paying for.
That third option is the one the heat map could never have produced, and it is the reason to run the arithmetic on a specific node rather than to score the supplier as amber.
Correlated shocks are where single-node tests stop being useful
Every result above assumes the alternate is available when the primary fails. Test that assumption directly, because it is the one that quietly makes a network look twice as strong as it is.
The common modes worth checking are specific and findable. Two suppliers buying the same input from the same tier-three producer, which a separate post covers as its own subject. Two plants inside the same industrial park sharing a utility feed or an effluent treatment permit. Two sources routing through the same port pair, or the same air freight lane, or the same customs broker. Two facilities audited by the same notified body, where a suspension of that body suspends both certificates at once. Two suppliers drawing labour from the same town.
The test is mechanical. For each pair of primary and alternate, ask what single event would take both out, and if you can name one, model it as a scenario in its own right at the signed severity. In most portfolios this exercise finds between two and six pairs that were counted as dual sourced and behave as single sourced under the shocks that actually matter.
Geographic correlation deserves its own pass, since a regional shock hits the ports, the labour pool, the grid and the sub-tier at the same time, and modelling those as independent events understates the joint loss substantially. Snyder and colleagues reviewed the disruption modelling literature in IIE Transactions in 2016 and the correlated case is where the analytical results thin out fastest, which is a reason to simulate rather than to look for a formula.
Running the test backwards
Forward tests answer questions you thought to ask. The failures that hurt come from combinations nobody listed, which is why the Basel Committee's stress testing principles, published in 2009 and revised in 2018, put reverse stress testing alongside the scenario suite: start from the outcome that would be unacceptable and solve for the conditions that produce it.
The supply chain version is direct. Declare the outcome, for example a quarter in which on-time-in-full falls below 90 per cent, or a month in which more than 15 per cent of revenue cannot be served. Then search the network for the smallest shock that gets you there.
Smallest matters. Any large enough event breaks anything, and that finding is not useful. What you want is the minimum event, and it is frequently unglamorous: a single sub-tier plant, a testing laboratory, one qualified operator on one process, a customs classification, a piece of tooling that exists once. Sorting candidate shocks by severity required to breach the threshold gives you a ranking with no probability estimates in it at all, and the entries at the top of that list are where the money goes.
Declaring what a pass means, before the run
A stress test with no pass criterion becomes a report, and reports get filed. Write the criterion down first, and give it three parts: a metric, a threshold and a horizon. Something of the shape that no single-node shock at signed severity may cost more than 500,000 of contribution or hold on-time-in-full below 95 per cent for more than four consecutive weeks.
Then every failing node produces the same three outputs: the gap in weeks, the cheapest way to close it, and the annual cost of closing it. That table is a capital request with the analysis already attached, and it is the artefact the exercise exists to produce.
Cadence is annual for the full suite, plus an event trigger on the changes that create exposure without anyone deciding to: a supplier consolidating two plants into one, a rationalisation programme retiring a second source, a supplier moving production to a new country, a sub-tier being acquired by a competitor's owner.
Where this stops
A stress test inherits the fidelity of the model underneath it. If the bill of materials is only accurate to tier one, if alternate lead times are the ones in the contract rather than the ones observed, or if the master data has sites recorded as suppliers, the test returns confident answers about a network that does not exist. Sampling fifty item-supplier records by hand before the first run is time well spent.
The deeper limit is behavioural. Every model above treats the alternate's 40 per cent as available on demand, when in a regional shock that alternate is fielding calls from every other buyer at once, and allocation runs on relationship, contract structure and who called first. Capacity without a committed volume and a stated response time in a contract remains an assumption about how someone else will behave under pressure. Testing whether it is real means asking the alternate to quote a firm ramp against a specific week, which is an uncomfortable conversation and the only one that settles it.
And the numbers are ordinal rather than precise. An endurance of 11.3 weeks is really somewhere between nine and thirteen, and the value of computing it lies in sorting nodes and sizing gaps rather than in predicting a date. Where a stress test earns its cost is in ranking exposures by what it takes to break them and pricing the fixes, which is a different claim from forecasting the next disruption.
Pick the one component with the highest revenue behind it, get the four severity parameters signed for its failure mode, and work the endurance arithmetic on it this week. If the answer surprises the person who signed the severity, you have found the argument the heat map was hiding.
More on this in resilience on the DemandLabs platform.
