A corporate gifting program can appear diversified while still depending on one embroidery line, one approved SKU, one warehouse, one carrier lane, or one person who can release artwork. A useful concentration register makes those hidden single points visible, connects them to real campaigns, and records whether a substitute has actually passed a recovery test. This guide provides that operating method without inventing an industry score or treating a blank field as zero risk.
Download the 2027 concentration-risk register
Use the English XLSX workbook for formulas, linked campaign records, substitute tests, actions, and source evidence. Use the English CSV template when a procurement or analytics system needs a flat dependency import. The workbook is version 2 and the unchanged CSV is version 1; both were verified on October 22, 2026.
The workbook contains six sheets: Read Me, Dependencies, Campaign Links, Substitute Tests, Action Log, and Source Register. Its sample rows are explicitly hypothetical. Replace them with approved quantities, spend, dates, owners, and evidence before using any calculated exposure status. Formulas display “Missing input” when required numeric fields are blank; they do not convert missing evidence into a reassuring zero.
Concentration is a dependency problem, not a supplier-count problem
Counting vendors is an unreliable proxy for resilience. Three distributors may buy the same blank jacket from the same mill, use the same embroidery house, store finished goods in the same building, and tender parcels to the same regional carrier. A supplier list would show three choices. A dependency map would show one production path with three commercial fronts.
Start with the promise the campaign must keep: approved item, brand treatment, recipient group, geography, need-by date, quantity, budget, and minimum acceptable outcome. Then work backward through each condition required to keep that promise. Typical nodes include the contracting supplier, original factory, blank SKU, material or component, decoration process, artwork approver, licensing owner, inventory location, order platform, payment route, carrier service, customs broker, recipient-data source, and the individual authorized to approve an exception.
The register should give every node a stable identifier. Do not type “vendor problem” in a notes field and move on. Link each campaign to the exact node it uses, the units and approved spend affected, and the latest safe decision date. When two campaigns use the same node, that relationship should be visible without merging the campaigns or duplicating the dependency record.
A node is not critical merely because it is expensive. It is critical when its failure can prevent an accepted campaign outcome and no independently usable substitute has been proved in time. A low-cost zipper can stop an entire jacket run. A single artwork approver can hold every vendor. A warehouse may be replaceable in theory but not after branded inventory has arrived. Those distinctions are why the register stores both commercial exposure and operational evidence.
Build the dependency graph from campaign evidence
Procurement owns supplier and contract facts, but it cannot complete the register alone. The campaign owner confirms the business purpose and minimum result. Brand or licensing owners confirm permitted artwork. Operations confirm production and warehouse paths. Logistics confirms service lanes, cutoffs, and exception options. Finance confirms approved spend and reconciliation requirements. Privacy, legal, tax, human resources, or security owners decide only questions within their remit.
Use a structured discovery meeting rather than asking, “Do we have a backup?” For every campaign, ask which legal entity accepts the order, which factory or decorator performs each transformation, where inventory will sit, which system holds the authoritative order, who can release artwork, which route moves the goods, and which evidence proves each answer. A purchase order proves a commercial commitment; it does not necessarily prove factory capacity. A supplier email naming a second facility does not prove that facility has tooling, artwork, material, or a booked production window.
The workbook's Campaign Links sheet is the bridge between planning and concentration. One dependency can serve many campaigns, and one campaign can rely on many dependencies. Record approved units and spend at the link level because a node's impact changes with the campaign mix. If quantities are still unknown, leave them blank and assign an owner to obtain them. Entering zero would assert that the campaign has no exposure, which is materially different from not knowing.
The Dependencies sheet then counts linked campaigns and sums only populated inputs. Those totals support prioritization, not an external benchmark. There is no fabricated threshold saying that a supplier becomes “too concentrated” at a universal percentage. Your organization may set a threshold after considering impact tolerance, lead time, seasonality, geography, regulated recipients, replacement cost, and the quality of tested alternatives.
| Dependency node | Evidence to retain | Question before acceptance | Named owner |
| --- | --- | --- | --- |
| Supplier or factory | Legal entity, facility, capacity window, production confirmation | Is the quoted capacity reserved for this campaign? | Procurement |
| SKU or component | Approved specification, stock position, replenishment date | Can an equivalent item meet the approved purpose? | Campaign owner |
| Decoration process | Artwork, sample, machine capability, quality acceptance | Has another line produced an accepted sample? | Brand and operations |
| Warehouse | Inventory ledger, access, transfer time, system connection | Can goods and records move together? | Operations |
| Carrier lane | Origin, destination, cutoff, service rule, exception receipt | Does the alternate route work for this date and parcel? | Logistics |
| Approval owner | Decision right, delegate, response window, audit record | Who decides if the primary owner is unavailable? | Program sponsor |
Separate a named alternative from a proved substitute
A substitute is not proved because it appears in a proposal. It is proved only for a defined use, evidence set, and validity period. The test must reflect the failure it is meant to cover. If the risk is decoration capacity, test a decorated sample and a realistic production quantity. If the risk is a carrier lane, test pickup eligibility, routing, expected delivery, exception handling, and the data needed to create the shipment.
Design the acceptance rule before the test. Quality might require a signed sample against a dated specification. Lead time might require an acknowledged production schedule that fits the latest safe date. Capacity might require a written reservation or a small controlled run. Approval might require brand, licensing, finance, or compliance confirmation. Recovery might require a reconciled order file showing that no recipient was duplicated or omitted.
Keep failed tests. A failed sample is valuable evidence that a listed alternative is not currently usable. Record the failure, cause, responsible owner, corrective action, and retest condition. Do not delete the row or relabel it “backup available.” If the alternative shares the failed upstream node, mark that common dependency explicitly.
What if a supplier will not disclose its factory or upstream dependency?
Record the requested evidence, the supplier's response, the decision owner, and the operational consequence. Nondisclosure does not prove concentration, but it leaves independence unverified. The owner can require stronger contractual evidence, reduce the committed volume, hold more time or inventory, test a genuinely separate path, accept the documented uncertainty, or choose another supplier. Do not fill the gap with an assumption.
A substitute's validity can expire. A sample from last year does not prove today's material, machine, capacity window, shipping route, or approval. Set a review date tied to the nature of the dependency: before a peak season, after a specification change, when a facility changes, when a contract renews, or before a campaign exceeds the volume that was tested.
Use risk framing carefully and disclose its limits
NIST Special Publication 800-161 Revision 1 Update 1 describes supply-chain risk management as a lifecycle activity and emphasizes plans, roles, evidence, and ongoing monitoring. It is written for information and communications technology systems. This guide adapts that governance pattern—identify dependencies, assign owners, verify controls, monitor change—but does not present NIST as a promotional-products standard or a source of merchandise concentration thresholds.
The Cybersecurity and Infrastructure Security Agency's supply-chain resources similarly support disciplined questions about upstream dependence and resilience. Their cybersecurity scope matters. They can improve how a team asks for evidence, but they do not certify a decorator, carrier, warehouse, product, or gifting platform for a particular campaign.
The Promotional Products Association International publishes a listing for its 2025 global branded-merchandise report. The public listing alone does not provide enough accessible methodology for this article to reproduce a market statistic. The register therefore uses no PPAI-derived volume, growth, or concentration figure. It cites the listing only as an industry research destination to be evaluated under the user's own access and methodology review.
Last verified: October 22, 2026. Geography: the operating campaign's actual origins, destinations, suppliers, and approval jurisdictions. Method: primary-source review plus a live Giftpack article-inventory check. Gaps: no universal merchandise concentration benchmark, no independently verified capacity for the user's suppliers, and no claim that cyber or financial-sector guidance governs gifting operations.
Hypothetical case A: 800 jackets and one embroidery house
This case is illustrative, not customer evidence. A company plans 800 customized jackets for a March leadership event. Procurement has two distributors and two blank-jacket choices, so the sourcing summary appears diversified. Mapping reveals that every approved option is scheduled through one embroidery house because it alone holds the accepted thread colors, stitch file, and licensing sign-off.
The campaign owner records the minimum result: an approved jacket in the chosen color family, branded within the licensing rule, available for attendee distribution by the event setup date. The dependency register links both distributors and all approved SKUs to the same decoration node. It records 800 campaign units, the approved spend, the embroidery lead time, the final artwork-release date, and the owner who can approve a substitute.
Procurement identifies a second decorator, but the team does not mark it verified. Brand supplies the controlled artwork and specification. Operations requests one stitched sample and a documented path for the full quantity. Procurement requests capacity confirmation for the required window. The team also checks whether both decorators rely on the same digitizing subcontractor, thread distributor, or blank-goods inventory.
The first sample fails because the small lettering is not legible. That result remains in Substitute Tests as a failed test. Brand documents the defect and an adjusted stitch method; procurement keeps the alternative unverified. After a corrected sample passes, the decorator confirms a realistic schedule for 800 units, artwork rights are documented, and finance accepts the revised cost, the team records a conditional pass with a review date.
Acceptance is not “another decorator exists.” Acceptance is a signed sample, current capacity evidence, confirmed lead time, permitted artwork use, a named activation owner, and an order path that can be reconciled. If any required approval remains open by the latest safe date, the campaign owner chooses among the approved unbranded jacket, a different gift, deferred delivery, or no send. The decorator must not improvise around licensing or approval controls.
Hypothetical case B: a carrier lane fails five days before an event
This case is also illustrative. Finished event kits are in one regional warehouse. Five days before a client event, the booked carrier lane becomes unavailable. The inventory exists, but the promise is still exposed because the route, pickup cutoff, labels, tracking events, and exception process depend on one service.
Logistics opens the register and identifies every campaign linked to the lane. It confirms parcel count, destinations, final acceptable arrival time, warehouse release status, and which orders already have a carrier event. New duplicate labels are paused until the authoritative state is known. Finance records the original and alternate cost exposure, while the campaign owner confirms whether arrival after the event would still serve any purpose.
The team evaluates three preapproved options: an alternate carrier from the same warehouse, a local-stock replacement near the event, and deferred delivery with a recipient notice. A carrier logo in a rate table is not enough. Logistics obtains a valid pickup commitment, service rule, cutoff, route eligibility, label process, and exception contact. Operations produces a controlled order file. The campaign owner approves the recipient message and revised promise.
The alternate route is one day slower but still meets setup. A small batch is manifested first. The team verifies pickup scan, tracking visibility, duplicate controls, and warehouse reconciliation before releasing the remainder. Acceptance requires the rehearsal result, the recipient communication decision, revised delivery commitment, cost approval, and a final comparison of approved orders, shipped parcels, deliveries, cancellations, and exceptions.
If the test fails, the register does not hide the result. The owner can use local stock, defer delivery, convert to an approved digital or experience alternative, or cancel. A digital option is only independent if it does not rely on the same failed identity, data, payment, or campaign system. The related business-continuity guide covers activation, controlled recovery, and reconciliation in greater depth.
Turn the register into a decision cadence
The register should change a meeting, not merely document one. Before a campaign is approved, the owner reviews unresolved critical nodes, latest safe dates, and substitute-test status. Before a purchase order is released, procurement confirms that the quoted facility, quantity, specification, and capacity window match the evidence. Before production, brand and operations confirm artwork and sample acceptance. Before shipping, logistics confirms inventory, route, labels, and exception ownership.
Use four outcome states that describe evidence rather than confidence: verified for the defined scope; conditional where a named limit remains; failed where the test did not meet acceptance; and unverified where evidence is missing or stale. Add a next review date and owner to every conditional or unverified record. A due date without a named owner is not a control.
The Action Log converts a finding into work. Each row states the dependency, corrective action, accountable owner, deadline, status, and acceptance evidence. “Contact vendor” is too vague. “Obtain written capacity confirmation for 800 units in the March production window and attach the dated response” is testable. Close the action only when the stated evidence exists and the affected dependency row points to it.
| Review moment | Required decision | Failure signal | Recovery evidence |
| --- | --- | --- | --- |
| Campaign intake | Define minimum acceptable outcome | Purpose, quantity, date, or owner missing | Approved campaign brief |
| Supplier selection | Confirm node independence | Alternatives share factory, line, stock, or lane | Dependency map and disclosures |
| Substitute test | Accept, condition, or fail | Sample, capacity, approval, or route is unproved | Dated test and acceptance record |
| Pre-release | Activate primary or alternate path | Latest safe date passed | Named decision and controlled order file |
| Closeout | Reconcile every outcome | Approved order lacks a final state | Order, delivery, cancellation, and cost reconciliation |
Compare suppliers fairly without manufacturing a ranking
The concentration register complements an RFP; it does not replace one. Use the corporate gifting vendor RFP and weighted scorecard guide to define mandatory requirements and comparable evidence before scoring proposals. Then use the register to reveal whether apparently different bids share an operational node.
Apply the same questions to every candidate: legal contracting entity; production and decoration location; upstream material or component source; inventory ownership; capacity evidence; lead-time assumptions; data and order export; warehouse and carrier options; incident notification; substitute process; and current test evidence. “Global coverage,” “enterprise ready,” and “redundant network” are claims to investigate, not scored facts.
Do not force Giftpack or any other provider into first place. A direct manufacturer may fit a single high-volume, stable SKU. A local distributor may fit a licensed event with hands-on sampling. A multi-market execution platform may fit campaigns needing recipient choice, multiple regions, operational orchestration, and centralized evidence. The correct result depends on the approved purpose, countries, recipient experience, controls, and demonstrated execution path.
When evidence is unavailable, mark it unknown. Do not award a midpoint as if unknown meant average. When a requirement is disqualifying, evaluate it before weighted preferences. When two suppliers share a factory, score their commercial proposals separately but retain the common factory node in the concentration view. That separation keeps the comparison fair while preserving the risk the scorecard would otherwise conceal.
Recovery testing, change control, and audit evidence
Run at least one tabletop exercise before a high-impact or time-critical campaign. Pick a credible failure: the decorator rejects the artwork, a component is unavailable, a warehouse cannot release stock, an approver is absent, or a carrier lane closes. Give participants only the evidence they would actually have. Record who decides, what is paused, which alternative activates, how recipients are protected, and how orders and money are reconciled.
A tabletop exercise can expose missing ownership, but it cannot prove physical quality or production capacity. Pair it with a bounded operational test when the dependency is physical. A sample can prove appearance but not a full production window. A capacity letter can support planning but not prove delivery. A small shipment can test labels and scans but not peak-volume throughput. The register should state exactly what each test proves and what remains unknown.
Version changes matter. When the specification, factory, decorator, warehouse, carrier service, data path, contract, or approver changes, identify the affected nodes and invalidate only the evidence that no longer applies. Preserve the old test and its scope. Create a new version or a new test row; do not edit history until it appears that the current path was always verified.
Quarterly review is a useful default cadence for the template, but event and change triggers are more important. Recheck before peak season, before a materially larger volume, after a missed service commitment, after an ownership change, and after any substitute activation. Evidence that has not changed can be carried forward with its original date and scope. Evidence that has changed must be retested.
Retain enough for an independent reviewer to reproduce the decision: source document, date, geography, version, responsible owner, affected campaigns, test method, result, failure reason, exception approval, and next review. Avoid storing unnecessary recipient personal data in the risk register. Link to the authoritative controlled record instead of copying sensitive data into a planning sheet.
A practical acceptance checklist
Before calling a concentration risk controlled, confirm all of the following:
-
The dependency has a stable identifier and named owner.
-
Every in-scope campaign links to the dependency with approved units or an explicit missing-input owner.
-
The latest safe decision date is earlier than the need-by date by a realistic recovery margin.
-
The substitute is operationally independent for the failure being tested.
-
Quality, lead time, capacity, commercial terms, artwork or licensing, and route requirements are either accepted or clearly not applicable.
-
The test result and evidence are dated, scoped, and retained.
-
A failed or conditional result remains visible with a corrective action.
-
The activation decision, recipient communication, and order-control process have named owners.
-
Reconciliation can distinguish approved, produced, shipped, delivered, cancelled, refunded, and unresolved outcomes.
-
The next review trigger is tied to time, campaign scale, or a real dependency change.
Do not claim control merely because every cell is filled. A row can be complete and still rest on weak evidence. The acceptance decision should state what failure was tested, what outcome was observed, what limit remains, and who accepted that limit. If the team cannot make that statement, the dependency remains unverified or conditional.
Make concentration visible before it becomes an emergency
Supplier concentration is manageable when it is expressed as a set of campaign-linked dependencies, not a vague concern about vendor count. Map the nodes that can break the promise, preserve missing data as missing, test substitutes against written acceptance rules, and keep failed evidence. That discipline gives procurement, operations, logistics, finance, and campaign owners a shared decision record before time pressure removes their good options.
The workbook is deliberately conservative: it provides structure, formulas, and evidence fields, but no invented market threshold. Its value comes from verified local inputs and rehearsed decisions. Start with one important campaign, map the complete path, test the highest-impact single point, and use what fails to improve the next version.
When the approved operating model calls for global catalog choice, merchandise, rewards, recipient selection, or multi-region fulfillment, Giftpack can be evaluated as one execution option alongside direct manufacturers, distributors, and local providers. The register should still preserve your organization's decision rights, evidence, supplier comparisons, and recovery responsibilities; a platform does not replace legal, tax, privacy, payroll, compliance, or employer judgment.