You can run a tight business with good people and a proper system, and still hand your quality ceiling to whoever supplies you. Nothing you do downstream lifts a component that arrived out of tolerance, uncertified, or coated with something nobody specified.
That is what makes an unqualified supplier different from an expensive mistake. The saving shows up once, on one invoice. The consequence shows up on every job they touch after that.
It is worth being honest about how these relationships start. Almost nobody chooses a risky supplier deliberately. They get chosen because they answered the phone, they were quick, they were cheap, and the job needed to move.
People hear 'unqualified' and think licences. Licences matter, but they are the easy bit — you can check a licence in two minutes and it tells you almost nothing about how the next job will run.
The harder question is whether the supplier has a system. Is there a written process? Does someone other than the owner check the work? Is there a record you could hand an auditor or a client? Can they tell you what changed between the batch that was fine and the batch that wasn't?
A supplier with real skill and no system is not dishonest. They are just fragile. Their good result depends on the right person having a good day, and you have no way to know in advance which day you are getting.
This is the part that surprises people when they score their suppliers properly. A supplier who has never missed a delivery, never sent a defect, and always answers the phone can still come out as High risk — because performance and exposure are different things.
If they supply a critical structural or safety component, and there is no second source you can move to, then their bad month is your bad quarter. Businesses close, get bought, lose a key person, or land a bigger client and quietly deprioritise you. None of those events show up in their past performance.
That is why our free assessment will not print a low band for a sole-source, critical-component supplier no matter how well they score on the day. The score tells you how they perform. The flags tell you what happens if they stop.
A named backup supplier, not a vague sense that 'someone else could probably do it'. Write the name down. If you cannot write a name down, that is the finding.
A real relationship with that backup. Give them a small job so pricing, lead time and quality are known quantities before you need them under pressure. A backup you have never used is a phone number, not a plan.
Specifications that are not welded to one product range. If your documents name a single proprietary system with no performance-based equivalent, you have designed the lock-in yourself. This is the same discipline we apply in height safety design — spec the outcome and the performance requirement, then let more than one product meet it.
Your own records. Certificates, test reports, batch details and correspondence held on your side. If the supplier disappears, the evidence trail should not disappear with them.
List your suppliers. All of them, including the small ones — the fabricator, the powder coater, the certifier, the labour hire, the software you cannot operate without.
Mark the ones you could not replace inside a month. That short list is your actual continuity risk, and it is usually shorter and more alarming than people expect.
Score the top five properly — quality, delivery, technical, commercial and continuity — and write down why, not just the number. A rating with no reason behind it is unusable six months later when someone asks how the decision was made.
Then do something with the worst one. Qualify a second source, ask for the records you have never asked for, or put a review date in the calendar. A supplier register that nobody acts on is just a nicer way of carrying the same risk.