A BOM supply-risk review in six steps

Sorting a bill of materials by spend tells a buyer where the money goes. It does much less to explain which missing component would stop a product shipping, especially if the troublesome part is inexpensive, specialised or shared across several assemblies. For supply planning, the time needed to recover from its loss can matter far more than its price.

That is the purpose of a BOM risk review: to identify where the current supply position leaves too little room to respond. It need not become a complicated scoring exercise, and a smaller manufacturer can do useful work with a spreadsheet, provided the data is credible and somebody is responsible for acting on it.

The six steps below focus on producing decisions rather than a particularly colourful report. The worked examples are fictional and the calculations are planning illustrations, not a prescribed risk standard.

1. Agree which product and revision are being reviewed

Start with the released assembly data and reconcile it with what the manufacturing partner actually builds. An old design export may omit an approved substitution, include a component that is no longer fitted or represent a different product option. Those discrepancies are worth resolving before anyone pays for a lifecycle analysis of the wrong parts.

Each purchased line needs a manufacturer and a complete manufacturer part number, with quantity and fitted options recorded. Distributor stock codes can be useful supplementary identifiers, but should not be the only way to establish which device and grade are required. The DLA's supply-chain risk BOM description explicitly connects identifiable BOM data with obsolescence management; although written for a defence context, it illustrates the practical importance of knowing exactly what is in the assembly. [1]

Scope is another early decision. Reviewing one urgent product can be entirely reasonable, but it will not necessarily expose common dependencies across the range. Where a controller or connector serves several products, the wider demand will eventually need to be reconciled against the same supply.

2. Establish which alternatives are actually approved

There is a world of difference between a second source in the released build data and a candidate mentioned in a notes column. The latter may still require testing, a software change or customer agreement before it can be used, so it cannot be counted as an immediate recovery route.

For each alternative, establish which assemblies it covers and what remains to be done. That gives the review a realistic estimate of flexibility, while also revealing relatively modest jobs that could remove a dependency before it becomes urgent. Engineering may already have most of the evidence required; the outstanding work might be completing the release and updating the manufacturing records.

Count sellers separately from manufacturers. Several distributors offering the same device can improve access to stock, but they do not create several independent manufacturing sources. Where alternatives do exist, record any known common dependencies and leave unknowns visible rather than claiming independence that has not been established.

3. Calculate when the current supply runs out

At a steady usage of 200 devices a week, 1,600 usable, uncommitted devices provide eight weeks of cover: 1,600 ÷ 200 = 8. That is a useful first estimate, although it becomes misleading if a large build consumes most of the stock next week or another assembly is drawing from the same inventory.

A time-phased demand view is preferable when production is uneven. Include service commitments, reconcile allocations and establish which stock can actually be issued. Material awaiting a quality decision should remain separate until it is released, and stock reported by a contract manufacturer should be checked for ownership and existing commitments before being added to the available total.

Incoming orders belong in the same dated view. An open order does not necessarily mean the supplier has confirmed the delivery needed for the build. Keep the promised date, quantity and latest confirmation together so that a purchasing assumption is not mistaken for a firm supply commitment.

4. Compare that date with a credible recovery plan

The next question is how long it would take to restore usable supply if the expected delivery failed. Depending on the part, that might mean replenishment through another authorised route, qualification of an alternative or a board revision followed by production and customer approval.

Suppose the controller has the eight weeks of stock cover calculated above, but qualifying an alternative is estimated to take 20 weeks. The resulting 12-week gap is a reason to act while stock remains, even if the original device is still classed as active. It is an estimate of exposure, not a prediction that the manufacturer will stop supplying it.

Lifecycle status helps inform this judgement but cannot answer the delivery question on its own. Longevity commitments also need reading against their remaining period and conditions, rather than being treated as an assurance that a particular order will arrive on time. NXP's programme requirements, for example, allow specified changes and measure availability from product launch. [2]

The recovery estimate should include the activities needed to release production, not just the wait for samples. An alternative that arrives in two weeks but requires several months of approval does not close an eight-week supply gap.

5. Give the awkward lines a practical next action

Four fictional lines show why a single risk score is a poor substitute for an explanation.

The connector deserves attention despite its apparently comfortable stockholding, because the business has not established how long that stock must last or how it would obtain more. The resistor's shorter cover may be manageable if its alternatives and delivery evidence hold up. Neither conclusion is visible from stock quantity or spend alone.

For each line requiring work, name the person responsible and the date of the next decision. Buying more stock may be appropriate, but so might releasing an alternative, negotiating a production change or accepting that a product should be withdrawn. The review should expose those choices rather than silently assuming that extra inventory is always the preferred answer.

6. Revisit the assumptions when something changes

A review becomes expensive busywork if every line is refreshed constantly without regard to exposure. Set a frequency that suits the product and give material changes their own trigger: a slipped delivery, a significant order, a design revision or a manufacturer notification affecting a critical part.

Those notifications need an owner. TI's published change process describes information such as affected products, qualification evidence and implementation timing, which can help a team assess whether its existing assumptions still hold. [3] Subscribing to the emails is only useful if relevant notices reach someone able to connect them with the product data.

Sales and service assumptions belong in the review too. A new customer order can change stock cover overnight, while an extended support commitment may alter what looked like a sensible last-time buy. Purchasing cannot discover either development by studying a distributor's inventory feed.

When an action closes, record what changed and the evidence behind it. That makes the next review quicker and prevents an unresolved suggestion from being remembered as an approved solution. The resulting document may be fairly plain, but it should leave the team knowing which parts need attention, why they matter and what will happen next.

Sources

[1] DLA ASSIST, DI-PSSS-81656, Bill of Materials for Logistics and Supply Chain Risk Management. Referenced for the role of BOM data, not as a universal UK requirement.

[2] NXP, Product Longevity programme requirements.

[3] Texas Instruments, Product change notification.

The review method, fictional scenarios and planning calculations are original editorial guidance from The Electronics Brief, not a prescribed risk-scoring standard.