Supply Chain Concentration Risk Disclosure: SEC Guide

Supply Chain Concentration Risk Disclosure: What the SEC Actually Requires in 2026

If your 10-K says "we depend on a limited number of suppliers" and nothing more, expect a comment letter. The SEC's staff has made supply chain concentration risk one of its top-10 comment targets, with a 34% increase in supply chain-related comments between 2021 and 2023. Yet fewer than 30% of Fortune 500 companies quantify supplier concentration percentages in their annual reports, according to EY's 2024 survey. This guide is for CFOs, controllers, and SEC reporting teams who need to close that gap before the next filing.

Key takeaway: Supply chain concentration risk sits across four overlapping disclosure frameworks. Most companies address one or two. The SEC expects all four to tell a consistent, quantified story.

The Four Frameworks You Must Map Together

Most companies treat supply chain concentration as a single disclosure problem. It is four. Each framework has a different trigger, a different location in the filing, and a different standard of specificity. Treating them in isolation is the most common mistake that draws SEC comment letters.

These four must be internally consistent. If your ASC 275 note discloses a 40% purchase concentration with a single supplier, your risk factor and MD&A cannot be silent on what happens if that supplier fails. The SEC will notice the gap.

What ASC 275 Actually Requires (and What It Doesn't Say)

ASC 275 requires disclosure when three conditions are all met: the concentration exists at the balance sheet date, it makes the entity vulnerable to a reasonably possible near-term severe impact, and it is at least reasonably possible that the events causing the loss will occur in the near term.

The standard covers concentrations in customers, suppliers, geographic areas, lenders, grantors, and markets. ASC 275-10-50-16 through 50-20 specifically address supplier concentrations, not just customer concentrations, a point preparers frequently overlook.

Three things ASC 275 does not specify:

• No bright-line percentage threshold. There is no rule that says "20% of purchases from one supplier triggers disclosure." Judgment governs. In practice, concentrations above 10% of total purchases from a single source are routinely disclosed; concentrations above 25% almost always are.
• No requirement to name the supplier. The SEC's actual position, reflected in comment letter responses, is that you must describe the nature of the concentration and quantify it, but you are not required to name the specific supplier if doing so would reveal competitively sensitive sourcing relationships. You cannot, however, use competitive sensitivity as a reason to omit quantification entirely.
• No requirement to disclose mitigation plans under ASC 275 alone, though the SEC will ask about them in comment letters.

The "Near Term" Trap

This is the gap almost no ranking content addresses. Deloitte's guidance on ASC 275 confirms that "near term" means a period not to exceed one year from the date of the financial statements. A supplier concentration that could materialise into a disruption in 18 months falls outside ASC 275's mandatory disclosure trigger.

But it does not fall outside Item 303 MD&A. The SEC's Financial Reporting Manual requires MD&A to discuss known trends, demands, commitments, events, or uncertainties reasonably likely to have a material effect on financial condition. A known concentration risk with an 18-month horizon almost certainly meets that standard, even if it misses ASC 275's one-year window.

The practical implication: run your concentration assessment twice. First against the ASC 275 "near term" gate. Then separately against the MD&A "reasonably likely" standard. Many concentrations that clear the first gate still require MD&A discussion.

Step-by-Step: How to Build a Defensible Disclosure

Step 1: Inventory Your Concentrations

Start with procurement data, not accounting data. Pull the prior 12 months of purchase spend by supplier, by geography, and by product category. Flag any single supplier representing more than 10% of total purchases in a category, any single geography representing more than 25% of sourcing for a critical input, and any sole-source arrangements regardless of spend percentage.

Do the same for customers: any customer representing more than 10% of consolidated revenue should be assessed under ASC 275-10-50-16.

Step 2: Apply the ASC 275 Three-Part Test

For each flagged concentration, work through:

1. Does the concentration exist at the balance sheet date? If the supplier relationship ended before year-end, it may not require disclosure (though it may require MD&A discussion if it affected the period).
2. Is a near-term severe impact at least reasonably possible? "Reasonably possible" under ASC 450 means more than remote but less than probable. Geopolitical instability, a supplier's financial distress, or a single-geography sourcing arrangement in a climate-vulnerable region can all push a concentration into "reasonably possible" territory.
3. Would the loss of this relationship have a severe impact? Severe means significant disruption to operations, not merely inconvenient. A supplier that provides a commodity easily sourced elsewhere is different from a sole-source manufacturer of a proprietary component.

If all three conditions are met, disclosure in the financial statement notes is mandatory, not discretionary.

Step 3: Quantify, Don't Just Describe

The SEC's comment letters consistently ask for numbers. Generic language like "we rely on a limited number of suppliers" draws the question: how many, and what percentage of purchases do they represent?

A defensible ASC 275 note looks like this:

The Company sourced approximately 43% of its active pharmaceutical ingredients from a single contract manufacturer located in India during the year ended December 31, 2025. The loss of this supplier relationship, or a significant disruption to the supplier's operations, could have a material adverse effect on the Company's ability to manufacture and deliver its products. The Company is in the process of qualifying an alternative supplier, which it expects to complete by mid-2026.

That note does four things: it quantifies (43%), it identifies the nature of the concentration (single contract manufacturer, specific geography), it states the potential impact (material adverse effect on manufacturing and delivery), and it describes the mitigation status. Compare that to the boilerplate that draws comment letters.

Step 4: Draft the Item 101(c) Business Description

This is the most frequently overlooked of the four frameworks. S-K Item 101(c) requires companies to describe their sources and availability of raw materials, including any dependence on a single supplier or a limited number of suppliers. The 2020 S-K amendments (effective February 10, 2021) added Item 101(c)(1)(vii) specifically to capture supply chain dependencies that could affect a company's ability to operate.

This disclosure belongs in the Business section, not just the notes. It should name the general category of input, describe the sourcing geography, and flag any single-source dependencies. It does not need to repeat the ASC 275 quantification verbatim, but it must be consistent with it.

Step 5: Write the Item 105 Risk Factor

The SEC's 2020 amendments to Item 105 were explicit: risk factors must be "tailored to the company's particular circumstances" and must not be generic language "that could apply to any registrant." The SEC's own adopting release stated that "the amendments are intended to improve the quality of risk factor disclosures by requiring registrants to provide more specific and tailored risk factors rather than generic risk factors."

A supply chain concentration risk factor that will survive SEC review:

• Names the specific category of input or component (not just "raw materials")
• Quantifies the concentration (percentage of purchases or revenue at risk)
• Identifies the geography or specific dependency (e.g., Taiwanese foundry capacity, Indian API manufacturing, DRC cobalt)
• Describes what happens operationally if the concentration fails
• Notes what mitigation exists and its current status
• Does not promise that mitigation will succeed

For semiconductor companies, the SEC has specifically asked companies to address their dependence on TSMC and other Taiwanese foundries given geopolitical risk, as reflected in SEC comment letters on EDGAR. If your company uses Taiwanese foundry capacity and your risk factor does not mention Taiwan, expect a comment.

Step 6: Write the MD&A Discussion

MD&A is where the forward-looking analysis lives. The SEC's Financial Reporting Manual requires discussion of known trends and uncertainties reasonably likely to have a material effect. If a supply chain concentration has already caused disruption during the period, a force majeure event, a supplier quality failure, or a geopolitical shock, MD&A discussion is almost certainly required even if the ASC 275 "near term" test is not met.

MD&A should address:

• Whether the concentration affected results in the current period (quantify the impact)
• Whether management expects the concentration to affect future periods
• What steps are underway to reduce the concentration and the expected timeline
• The financial exposure if the concentration fails (even a range estimate is more defensible than silence)

For guidance on how to allocate disclosures between risk factors and MD&A without creating redundancy, see Finrep's risk factor vs. MD&A decision framework.

Step 7: Check Consistency Across All Four Sections

Before filing, lay the four disclosures side by side. The percentage in the ASC 275 note should match the percentage in the risk factor. The geographic concentration in Item 101(c) should be consistent with the geopolitical risk factor. The mitigation timeline in the notes should match what MD&A says about future periods.

Inconsistency across sections is itself a comment letter trigger. SEC staff read filings holistically, and a risk factor that says "we are highly dependent on a single supplier" paired with an MD&A that says nothing about supply chain risk creates an obvious question.

Interim Reporting: The Quarterly Obligation Most Teams Miss

KPMG's financial reporting guidance confirms that ASC 275 disclosures are required in interim financial statements as well as annual reports. This is a common preparers' mistake.

If a key supplier enters bankruptcy proceedings in Q2, that event must be assessed for ASC 275 disclosure in the Q2 10-Q. Waiting until the annual 10-K is not an option. The same applies to a geopolitical event that suddenly makes a previously acceptable geographic concentration into a "reasonably possible near-term severe impact."

Build a quarterly concentration review into your close calendar. It does not need to be a full procurement audit, but someone should be asking: has anything changed since last quarter that affects our concentration disclosures?

The Competitive Sensitivity Tension

The most common objection from business teams: "We can't name our key supplier. It reveals our sourcing strategy to competitors."

The SEC's actual position is more nuanced than a flat prohibition. You can describe the nature and magnitude of the concentration without naming the specific supplier. But you cannot use competitive sensitivity as a reason to omit quantification. The SEC has accepted language like "a single contract manufacturer in Southeast Asia" or "one of three qualified foundries capable of producing our advanced node chips" without requiring the supplier's name. What it will not accept is "we rely on a limited number of suppliers" with no further detail.

If you believe naming a supplier would cause competitive harm, document that judgment and retain it. If the SEC asks, you will need to explain why the omission is justified. For more on the SEC's materiality framework for these judgment calls, see the SEC materiality standard guide.

The Sustainability Overlay: IFRS S1/S2 and CSRD

For US-listed companies with significant EU operations, supply chain concentration risk now carries a dual reporting burden. This is entirely absent from most guidance on the topic.

IFRS S1, effective for annual periods beginning on or after January 1, 2024, requires disclosure of sustainability-related risks that could reasonably affect cash flows, access to finance, or cost of capital. Single-source supplier dependencies in climate-vulnerable geographies fall squarely within scope. The first wave of ISSB-compliant disclosures appeared in 2025 annual reports.

IFRS S2 goes further: paragraph 13 requires entities to consider physical risks (a key supplier's facility in a flood zone) and transition risks (a supplier's carbon intensity affecting future costs) as part of climate risk disclosure. A company that sources from a single coastal manufacturing facility in a region with rising sea-level risk has both a financial concentration risk (ASC 275) and a climate risk (IFRS S2) that require coordinated disclosure.

The EU's CSRD and ESRS add ESRS S2 (workers in the value chain) and ESRS E1 (climate) dimensions, covering approximately 50,000 companies across the EU, phased in from 2025 through 2029. ESRS S2 specifically addresses upstream supply chain labour and human rights risks, which often correlate with geographic concentration in single-country sourcing.

The practical implication for a US GAAP filer with EU operations: the ASC 275 note and the CSRD/ESRS supply chain disclosure need to be drafted in coordination, not in separate silos. The concentration percentages, geographies, and risk descriptions must be consistent across both.

For the intersection of supply chain risk and climate disclosure in SEC filings specifically, see Finrep's climate risk disclosure walkthrough and the SEC climate rescission and SAB 74 guide.

Pre-Filing Checklist: Supply Chain Concentration Disclosure

Use this before every 10-K and 10-Q filing:

ASC 275 Note

• Procurement data reviewed for concentrations above 10% of purchases by supplier
• Three-part ASC 275 test applied to each flagged concentration
• "Near term" (one year) assessed separately from MD&A "reasonably likely" standard
• Quantification included (percentage of purchases or revenue)
• Nature of concentration described (geography, input type, sole-source vs. limited-source)
• Mitigation status disclosed

Item 101(c) Business Description

• Raw material sourcing described, including geography
• Single-source or limited-source dependencies identified
• Consistent with ASC 275 note quantification

Item 105 Risk Factors

• Risk factor is entity-specific, not generic boilerplate
• Concentration percentage stated
• Operational impact of failure described
• Mitigation noted without guaranteeing success
• Sector-specific dependencies addressed (TSMC for semis, API manufacturers for pharma, DRC for critical minerals)

Item 303 MD&A

• Any in-period disruption from concentration quantified
• Forward-looking impact assessed under "reasonably likely" standard
• Mitigation timeline and cost disclosed where known

Cross-Section Consistency

• Percentages consistent across all four sections
• No section contradicts another on severity or mitigation status
• Interim filings updated if a material concentration event occurred mid-quarter

For Multinationals

• IFRS S1/S2 supply chain risk disclosure coordinated with ASC 275 note
• CSRD/ESRS S2 upstream supply chain disclosure consistent with SEC filing language

FAQ

What percentage of purchases from a single supplier triggers ASC 275 disclosure? There is no bright-line threshold. ASC 275 requires judgment: if the concentration exists at the balance sheet date, a near-term severe impact is reasonably possible, and it is at least reasonably possible that the triggering events will occur, disclosure is required. In practice, concentrations above 10% of category purchases are routinely assessed; those above 25% are almost always disclosed.

Do we have to name the specific supplier in our SEC filing? No. The SEC accepts descriptions of the nature and magnitude of the concentration without naming the specific supplier, provided the description gives investors enough information to assess the risk. You cannot, however, use competitive sensitivity to avoid quantification entirely.

What is the difference between ASC 275 and Item 105 for supply chain risk? ASC 275 is a GAAP standard that governs the financial statement note. Item 105 is an SEC Regulation S-K requirement that governs the risk factors section. Both can require disclosure of the same underlying concentration, but they have different triggers, different locations, and different levels of forward-looking analysis required. Both must be consistent with each other.

Does ASC 275 apply to quarterly filings? Yes. ASC 275 disclosures are required in interim financial statements as well as annual reports. If a new concentration risk emerges mid-year, such as a key supplier entering bankruptcy, it must be assessed for ASC 275 disclosure in the next 10-Q.

What does the SEC look for in a supply chain concentration comment letter? SEC staff typically ask: (1) what percentage of revenue or purchases is attributable to the concentration; (2) what contingency plans exist if the relationship is lost; (3) why generic language was used instead of entity-specific disclosure; and (4) for sector-specific dependencies (TSMC, DRC cobalt, Indian API manufacturers), whether the specific geography or counterparty was addressed.

How does CSRD change what we need to disclose about supply chain concentration? CSRD's ESRS S2 requires disclosure of upstream supply chain labour and human rights risks, which often correlate with geographic concentration. For US-listed companies with EU operations subject to CSRD, the supply chain concentration disclosures in the SEC filing and the CSRD report must be consistent. ESRS E1 adds a climate dimension, requiring disclosure of supply chain concentration in climate-vulnerable regions.