Component Supply Risk Matrix for OEM Projects

One line on the BOM can stop the whole build

A bill of materials has a hundred lines and they are not equal. Ninety of them you can buy anywhere, next week, from three people. A few of them decide whether you ship. On a spreadsheet they all look the same: part number, description, quantity, supplier. Nothing there tells you which line will hold up a production run.

So before a project goes to mass production we sit down with the BOM and grade it. Red, yellow, green. Same colours as our DFX review, and for the same reason: a grade forces a decision, and a written decision gets followed up.

The four questions behind each grade

We ask the same four things about every line, and the answers set the colour.

Is there a second source? Not in theory. Has anyone actually built and tested with parts from another supplier. A qualified alternate and a name on a list are different things.

How long is the lead time? A two week part leaves you room to react. A part quoted at eight to twelve weeks means reacting three months before you need it, usually before the forecast is firm.

Standard part or special? Catalogue parts have a market behind them. Specials have one production line, and that line has other customers.

Does changing it touch certification? The one people underestimate. If swapping a component means re-running EMC, safety or biocompatibility testing, the lab queue becomes your real lead time, and lab queues do not care about your ship date.

The matrix from a UV-C project

Here is how it came out on a portable product with a UV-C disinfection function. Suppliers are described by category, not named.

Component	Grade	Where the risk comes from	Action taken
275nm UV-C LED	Red	Special part, eight to twelve week lead time, one qualified source	Qualify a second supplier immediately; design the package footprint so an alternate can drop in
UV-resistant reflective fabric	Yellow	Material with limited supply base, sensitive to run scheduling	Blanket order placed early to lock capacity; two mills kept qualified
Fan	Yellow	Standard part, but capacity moves with the season	Blanket order plus a backup source held in reserve
Waterproof zipper	Green (still managed)	Single brand, exclusive spec, but supply record is stable	Order six weeks ahead; keep the end-of-life notification clause live
PCBA and MCU	Green	High substitutability, multiple qualified sources	Dual supplier as standard; firmware written to run on two controller platforms

The LED was the one that mattered. A specialised wavelength, a long lead time and a single qualified source on the same line is about as concentrated as component risk gets. And on the day we graded it, nothing was wrong. That is why the grading happens before mass production rather than during it. By the time single sourcing becomes visible as a problem, the line has stopped.

Two things came out of that red grade. One was commercial: start the second-source qualification immediately, in parallel. The other was a design decision that cost nothing at that stage. We kept the package footprint compatible so an alternate LED could drop in without a board respin. Once tooling and boards are frozen, that option is gone.

Green does not mean you can stop looking

The zipper is the line people argue about. Single brand, exclusive spec, no alternate. On the second-source test alone it should be red. But the supply record is steady, the lead time short, the part not exotic. Grading it red would have burned engineering time on a problem that was not there.

So we manage it as green with a standing rule: order six weeks ahead, every time. Single source but stable, and multi source but all of them shaky, are two different risks. The first you handle with order timing and an end-of-life warning. The second you handle by fixing the supply base, and early ordering will not save you.

Turning the grades into something operational

A colour on a spreadsheet is worth nothing by itself. Four things make it real.

Forecast accuracy drives the long lead time parts. On an eight to twelve week component you commit to a number months before demand is confirmed. If the forecast is soft, say so, and let the buying decision carry that openly.

Blanket orders versus safety stock. A blanket order locks supplier capacity without taking all the inventory at once, which suits yellow parts where capacity is the constraint. Safety stock costs money and space but covers a supply interruption. Most projects use both, on different lines.

End-of-life notification. Ask in writing how much notice you get before a part is discontinued. An EOL notice with six months on it is a manageable engineering task. An EOL you find out about from a rejected purchase order is not.

Second source qualification is a build, not a phone call. Order samples, build them, test them, record the result. Under ISO 13485 supplier control and change control sit in the quality system anyway, so the qualification leaves a record you can point to when someone asks why the change was safe.

Where this sits in our process

Gooten has been building electronics in Daya, Taichung since 1996, with R&D, production and quality assurance on one site, certified to ISO 13485:2016 and ISO 9001:2015. The BOM risk review sits in the tooling and cost phase of our five-phase process, next to the tooling and MOQ decisions, since both commit money against a volume plan and both get expensive to revisit.

If you have a BOM and you are not sure which lines are the dangerous ones, send us an inquiry with the part list and your target volumes. Our engineers will come back with an initial view within two business days, under NDA.

FAQ

What actually makes a component high risk?

Four things together: no qualified alternate, a long lead time, a special rather than a catalogue part, and a change that would trigger safety or certification retesting. Any one alone is manageable. Two or more on the same line is where projects get hurt.

When should the BOM risk review happen?

Before mass production, in the phase where tooling and cost get locked. Early enough that a red grade can still change the design, since keeping a footprint compatible costs nothing while the board is open.

Is a single-source component always a problem?

No. A single source with a stable record and a short lead time is manageable with order timing and an end-of-life agreement. What makes single sourcing dangerous is pairing it with long lead times, special specifications, or a certification retest hanging off any change.