Supplier business continuity requirements that bite

Nearly every supply agreement in manufacturing contains a business continuity clause. In most cases it requires the supplier to maintain a business continuity and disaster recovery plan and to provide it on request. That sentence has been in templates for two decades. It has also proved, repeatedly, to be close to worthless when a fire, flood, cyber incident or sub-tier failure interrupts supply.

The reason is that the clause creates an obligation to possess a document rather than an obligation to be able to recover. A plan can be generic, years out of date, written for a different site, silent on the buyer's specific parts and never tested, and still satisfy the clause as written. When disruption arrives the buyer discovers this in the same week it discovers it has no alternative source qualified.

The terms that make a difference are not complicated and are not unreasonable to ask for. They concern what the plan must address, how currency is demonstrated, how fast the buyer hears about a problem, what recovery looks like in time and volume, and whether anyone has looked below the first tier. Each can be tracked as an obligation with a date and an owner.

Why continuity clauses underperform

The failure pattern is consistent across industries and sizes of supplier, and it is written into the clause rather than caused by supplier conduct.

• Existence, not content, the obligation is to maintain a plan, with no specification of what it must cover, so a generic corporate document discharges it.
• No currency test, nothing requires the plan to be reviewed, updated or tested, and plans are frequently several years old by the time they are requested.
• Notification left vague, the supplier must notify promptly or without undue delay, which in practice means after internal escalation has concluded and options have narrowed.
• Recovery undefined, no recovery time objective is stated for the buyer's parts, so recovery is whatever the supplier achieves.
• Sub-tier blindness, the clause addresses the supplier's own operations and says nothing about its sources, where single-point concentration usually sits.

The common consequence is that the buyer holds a right to request a document and nothing more. Requests are made after an event, the document arrives, and it describes capabilities that were never verified. Converting these into specific, testable duties is a drafting exercise that takes one negotiation cycle and pays for itself the first time a supplier site goes down.

The five terms worth negotiating

Each term below is specific enough to test and should be held on the supplier contract record as a tracked obligation rather than as clause text nobody revisits.

• Plan scope specific to buyer parts and sites. the plan must identify the buyer's part numbers, the manufacturing sites that produce them, the tooling involved and the recovery approach for each, rather than describing the supplier's general posture.
• Review, test and attestation cadence. annual review and documented testing, with an attestation submitted on a fixed date and the test summary available, so currency is evidenced rather than assumed.
• Notification trigger and period. a defined set of triggering events and a notification period measured in hours, to a named contact, including material changes in sub-tier risk as well as actual disruption.
• Recovery time and volume commitment. a stated recovery time objective per part family and the volume recoverable within it, so partial recovery is understood in advance rather than discovered during an allocation discussion.
• Sub-tier mapping and single-point disclosure. an obligation to identify sub-tier sources for the buyer's parts and to disclose single-source points, with notice of any change to them.

A five-step roadmap to make continuity real

Step 1, Tier suppliers by disruption consequence

Resilience terms cost negotiation capital, so spend it where an interruption stops a line. Tier by consequence rather than by spend: a low-value single-source component with long qualification lead time outranks a high-value commodity with three qualified alternatives. The tiering drives which terms you insist on.

Step 2, Rewrite the clause for the top tier first

Apply the full set of plan scope, testing, notification, recovery and sub-tier terms to the highest-consequence suppliers. For lower tiers, the notification obligation alone delivers most of the value and is usually accepted without negotiation, so it is worth applying broadly, in the way a cost pass-through clause control plan is applied as a standard rather than per deal.

Step 3, Collect attestations on a schedule

Make the annual plan attestation and test summary a dated obligation with an owner, not a request issued when someone remembers. Suppliers who cannot produce an attestation are telling you something useful about the plan behind it, and the absence is itself the finding.

Step 4, Map sub-tier single points

Use the disclosure obligation to build a picture of where your parts actually originate. Concentration at a sub-tier supplier shared across several of your direct suppliers is the exposure that surprises manufacturers most often, because each direct supplier appears diversified, and it is a standing argument for supplier contract automation across the base.

Step 5, Test the notification path

Confirm, outside an incident, that the named contact exists, that the supplier knows what triggers notification and that the path reaches someone in your organization who can act. An untested escalation path tends to fail at the moment it is needed, usually by routing to a mailbox nobody monitors.

What changes when the terms are specific

Specific continuity terms change behaviour before any disruption occurs. A supplier asked to identify the buyer's parts, sites and tooling in its plan generally discovers gaps while writing it. A supplier required to state a recovery time objective per part family has to think about alternative capacity. A supplier obliged to disclose single-source sub-tier points often finds concentration it had not examined. None of that requires the buyer to audit anything. The obligation to be specific does most of the work, and the attestation cycle is what keeps it from decaying back into a generic document.

Clause as written against clause as useful

The table contrasts typical template language with the specific form that creates a testable obligation.

Business continuity clauses are among the clearest examples of contract language that satisfies a checklist without reducing risk. Requiring a plan to exist produces a document; requiring the plan to address your parts, to be tested annually, to trigger notification within a defined number of hours and to state a recovery time objective produces capability. The notification term alone, specified in hours with a named contact and a defined trigger, is worth more than any other resilience provision and is rarely resisted. Tracking attestations, test cycles and sub-tier disclosures as dated obligations is what keeps the whole set from quietly reverting to the template it came from.

For related guidance, see Supplier quality agreement and PPAP commitment tracking, ESG and supply chain due diligence clause tracking and IATF 16949 supplier quality agreements, a control guide.

Aavenir Manufacturing PracticeSupplier contract and obligation guidance for industrial manufacturers from the Aavenir manufacturing practice.