From risk to resilience: a multi-layered framework for supplier risk assessment to strengthen supply chain resilience

Global networking and dynamic market developments have made supply chains (SCs) a critical competitive factor in today's volatile environment. Supply disruptions caused by geopolitical crises, pandemic aftershocks, and resource dependencies confront every company. Assessing the robustness of individual suppliers has become decisive in overall supply chain resilience (SCRE), as local failures can propagate across networks and cause system-wide disruptions. The COVID-19 pandemic, the Ukraine war, and the semiconductor crisis exposed structural vulnerabilities and triggered a fundamental rethinking of supplier risk management and evaluation practices.

While supply chain risk management (SCRM) has a long and rich history (Manuj and Mentzer, 2008; Norrman and Jansson, 2004; Wieland and Wallenburg, 2012), its traditional focus on prevention and continuity planning is no longer sufficient. Since 2023, new regulatory and market developments, including the Corporate Sustainability Due Diligence Directive (CSDDD) and the Corporate Sustainability Reporting Directive (CSRD), have intensified expectations regarding supplier oversight. As EU regulations, these directives are particularly relevant to companies operating within the European Union, although their implications extend globally through multi-tier supply networks connected to EU-regulated firms. Emerging Environmental, Social, and Governance (ESG) disclosure requirements likewise compel firms to evaluate suppliers not only for performance but also for resilience and ESG preparedness. At the same time, digital traceability tools, global data indices, and AI-based monitoring have made it possible to observe supplier behavior and vulnerabilities more transparently than ever before (Dubey et al., 2023; Hendriksen, 2023; Kamble et al., 2022). These developments have exposed that traditional supplier evaluations are often inadequate for capturing the adaptive capabilities that determine survival under disruption (Urbaniak et al., 2022; Wiedenmann and Größler, 2021).

This study thus meets an urgent need for an empirically grounded and externally assessable supplier evaluation framework that integrates risk and resilience management. Although prior SCRM and SCRE studies have extensively examined the theoretical linkages between risk, resilience, and network structures (Ivanov and Dolgui, 2021; Pettit et al., 2013), they have not yet translated these insights into a coherent, operational tool applicable at the supplier level. Existing frameworks remain largely conceptual or focus on network-level resilience, neglecting the micro-level where most vulnerabilities originate (Cerè et al., 2017; Patrício et al., 2025; Smith et al., 2011). This means that firms still lack empirically operational supplier-level instruments that translate resilience from an abstract concept into observable and comparable risk indicators.

This study proposes a multi-layered, indicator-based framework for supplier risk assessment that translates resilience-relevant capabilities into externally observable and empirically testable indicators. By integrating insights from 29 studies with expert validation across multiple industries, the framework enables comparable, supplier-level assessment while remaining adaptable to industry-specific contexts. The approach represents a supplier-level advancement in integrating SCRM and resilience by linking individual supplier assessments to network-wide capability building. To clarify the positioning of this study, Table 1 synthesizes the main research streams, contributions made, and the remaining gaps.

Building on these insights, this paper poses two research questions:

This study combines a theory-informed systematic literature review with expert validation to develop a structured framework for supplier risk and resilience assessment.

Continuous globalization and the increasing complexity of supply networks have made companies vulnerable to a wide array of potential disruptions, ranging from geopolitical uncertainties and natural disasters to supplier financial challenges. Efforts to conceptualize how these supplier-level risks translate into network-level outcomes make use of the concept of resilience. Resilience refers to a company's capacity to absorb, adapt, and recover from disruptive events while maintaining or rapidly restoring desired performance levels (Hohenstein et al., 2015; Ponomarov and Holcomb, 2009). Achieving resilience requires systematic risk identification and assessment to enable both preventive and responsive measures. A foundational component of supply-chain resilience (SCRE) is robustness, representing proactive risk mitigation and the basis for anticipatory supplier-level assessment.

Risks may originate not only from suppliers but also from extended upstream supply chains, logistics routes, and sub-tier dependencies (Kumar et al., 2014). Interconnectedness among these elements across the globe hinders transparency, making it difficult for firms to assess their real exposure (Kinra et al., 2020). Existing approaches often adopt a macro-level perspective, focusing on network resilience as an aggregate property (Adobor and McMullen, 2018; Ahmadian et al., 2020; Han and Um, 2024). However, such approaches frequently overlook the micro-level supplier-specific risk factors that accumulate and propagate through networks.

Drawing on network theory (Burke and Ignizio, 1992; Euler, 1736), this study conceptualizes supply chains as interconnected nodes and edges through which disruptions propagate. Evaluating suppliers as individual nodes provides a granular perspective on network vulnerability and enables a node-based assessment that complements macro-level resilience models (Chowdhury and Quaddus, 2017; Ivanov and Dolgui, 2021). This node-based decomposition enables systematic comparison across supplier tiers and constitutes the structural foundation of the proposed framework.

An important contribution of this study lies in the holistic integration of management (SCRM) and resilience (SCRE). Traditionally, SCRM has emphasized risk prevention and compliance (ISO, 2018), whereas SCRE has focused on adaptability and recovery (Ivanov, 2020). Recent studies highlight the need to merge these perspectives into a unified governance approach (Biedermann and Kotzab, 2021; Han and Um, 2024; Ivanov, 2018). Integrating both concepts creates a continuous resilience cycle that combines anticipation, absorption, and adaptation to align risk management structures with capability development.

Figure 1 depicts our analytical representation of a simplified multi-tier supply network in which risks propagate upstream from lower-tier suppliers to the OEM. Each node represents a supplier or production entity, and the arrows indicate material and information flows that form the analytical foundation for the node-based assessment applied in this study. Building on this network view, Figure 2 summarizes the core assessment logic of this study and illustrates how supplier-level risk evaluations are aggregated into an overall network resilience assessment.

The next section reviews prior supplier risk and resilience research to identify why existing approaches remain insufficient for empirically operationalizing supplier-level assessment. This structured synthesis provides the empirical and theoretical foundation for deriving the core dimensions and indicators that inform subsequent framework development.

To structure the fragmented literature on supplier risk and resilience, this section organizes prior research into five dominant analytical streams: supplier risk assessment frameworks, resilience assessment models, network and propagation studies, quantitative and optimization-based approaches, and digital/ESG-oriented frameworks. Table 1 summarizes these streams, highlights their respective limitations, and positions the contribution of the present study. This structure guides the review and makes explicit the empirical gap addressed in the subsequent methodology section.

Although many studies in supplier risk management and supplier selection address risk mitigation, the literature remains fragmented. Most contributions focus on specific sectors, individual risk dimensions, or sustainability aspects, while only few integrate resilience in a systematic manner. The first stream focuses on structured supplier selection and supplier risk assessment models. Studies such as Rahman et al. (2022) and Torres-Ruiz and Ravindran (2018) apply multi-criteria methods (e.g. SWARA, WASPAS) to prioritize sustainability-related criteria, but their integration of dynamic risk or resilience factors remains limited. Li et al. (2021) develop a multi-criteria model to assess supplier-related risks; it comprises six categories: finance, manufacturing, product quality, delivery, collaboration, and service. Urbaniak et al. (2022) extend this logic using survey data from Polish manufacturing firms; their taxonomy groups supplier-related risks into three meta-dimensions: management system risks, environmental risks, and process risks. Also in pursuit of a risk management metric, Öztek and Kabak (2022) introduce a sustainability risk score incorporating 22 operational, technical, environmental, business, safety, and social indicators. While these frameworks provide valuable taxonomies, they are typically applied as static analytical structures, capturing risk and resilience factors at a given point in time, without modeling their dynamic interaction, temporal evolution, or endogenous adaptation across different industrial contexts.

The second stream of research examines resilience assessment models. Yang et al. (2023) propose a three-phase resilience model at the network level: absorption, adaptation, and recovery. Ambulkar et al. (2015) develop a resilience scale based on capabilities such as flexibility and visibility, while Pettit et al. (2013) combine vulnerability and capability factors into a resilience matrix. Chowdhury and Quaddus (2017) apply dynamic capabilities theory to capture resilience enablers, and Bruckler et al. (2024) propose a harmonized set of 17 metrics to quantify resilience capacities using the resilience curve concept. Although these models advance conceptual understanding, they often remain abstract and lack measurable indicators that can be empirically validated for supplier assessment.

A third, closely related stream focuses on network and propagation studies. Disruptions in supply chains rarely occur in isolation but propagate through inter-organizational dependencies. Dolgui et al. (2018), Ivanov (2018) and Kim et al. (2015) analyze how structural characteristics and network topology affect disruption diffusion and recovery dynamics. Likewise, classical studies such as Wagner and Bode (2008), Tummala and Schoenherr (2011) and Zsidisin (2003) examine sources of disruption, perception of supply risks, and global-sourcing frameworks, but mainly at an aggregated or managerial level. These models, however, address systemic propagation without considering supplier-specific heterogeneity or the role of firm-level vulnerability within the network.

A further research stream adopts quantitative or optimization-based perspectives. Studies such as Sawik (2013) and Fattahi and Govindan (2022) use optimization to select resilient supplier portfolios or to incorporate disruption risk into network design, while Hohenstein et al. (2015) highlight the need for empirical measurement of resilience. Despite methodological rigor, these models often prioritize efficiency and cost minimization, neglecting resilience as a dynamic, resource-based capability.

Building on this conceptual foundation, Wiedenmann and Größler (2021) propose a top-down framework for categorizing supplier-related risks within a single manufacturing context. While their model advances the structuring of risk typologies, it remains abstract and has not been empirically validated. Our study extends this approach by shifting from a top-down, conceptual categorization to a node-based, supplier-level assessment that systematically derives and empirically validates measurable risk indicators across multiple industries. We thus translate conceptual categories into empirically applicable assessments.

Early empirical work by Dubey et al. (2019) links big data analytics capability and organizational flexibility to resilience performance. More recent studies extend this perspective by examining how AI-enabled analytics, digital twins and ESG-oriented transparency shape risk monitoring and adaptive responses (Baryannis et al., 2019; Carnovale et al., 2025; Culot et al., 2024; van Hoek and Wong, 2025). Ivanov (2023) discusses the potential of digital-twin environments for resilience management, and Koberg and Longoni (2018) integrate sustainability and digital transformation perspectives. Although these frameworks emphasize transparency and traceability, they lack a unifying foundation that connects digital visibility to resilience measurement at the supplier level.

Taken together, the reviewed literature offers valuable conceptual insights but remains fragmented, either highly theoretical or limited to narrow contexts. This fragmentation highlights the need for a combined approach that systematically consolidates existing findings and validates them empirically. Because prior work is either conceptual or context-bound, we use an SLR to consolidate constructs and expert workshops to refine observability, feasibility, and prioritization. This mixed design ensures both coverage and practical relevance, bridging the gap between conceptual frameworks and actionable, supplier-level evaluation.

Following established guidance on qualitative multi-method research (Bryman, 2016; Creswell and Plano Clark, 2018), this study combines a theory-informed systematic literature review with a series of qualitative expert workshops for indicator consolidation and validation. The design is qualitative in nature, as no quantitative data analysis was conducted. Its primary purpose is to clarify constructs and operationalize indicators prior to subsequent quantitative testing in future research. The following subsections detail the systematic literature review procedure and the expert workshop design, including database selection, search strategy, screening criteria, and validation logic. The outcome of this process is a four-dimensional, indicator-based framework that distinguishes between upstream and downstream supplier risk signals and links each indicator to available information sources.

This study employed a theory-informed systematic literature review (SLR) consistent with established SCM review standards (Craighead and Ketchen, 2024; Durach et al., 2017; Kembro et al., 2014) and guided by the PRISMA framework (Rethlefsen and Page, 2022; Wortmann, 2023). The review identified supplier-related risk and resilience factors in prior research to provide an empirical foundation for expert validation and framework development.

We were guided by established practices for systematic literature reviews in supply chain management and adopted the Resource-Based View (RBV) (Barney, 1991) as the analytical lens (Barney, 1991). From an RBV perspective, supplier resilience is shaped by firm-specific resources and capabilities that influence vulnerability, robustness, and adaptive capacity under disruption. This lens informed both the coding of the literature and the clustering logic applied in the subsequent expert workshops. Searches were conducted in the Web of Science Core Collection and Scopus databases using the following Boolean query:

(“supply chain” OR “supplier”) AND (“risk” OR “resilience”) AND (“assessment” OR “evaluation” OR “framework”).

The review covered the period from 2010 to 2025 to capture recent advances in supplier risk and resilience research. Duplicate records were removed, and only peer-reviewed English-language journal articles were retained. Grey literature, purely technical optimization studies without explicit theoretical grounding, and studies outside the supply chain management domain were excluded.

Screening and inclusion followed predefined criteria to ensure relevance and methodological transparency. Titles and abstracts were screened to identify studies addressing supplier- or supply-chain-level risk or resilience and providing conceptual or empirical insights into risk identification, assessment, or mitigation. Full-text screening was conducted independently by two researchers, with disagreements resolved through discussion or senior review. Figure 3 summarizes the multi-stage screening process, which reduced 341 initial records to 29 core studies.

The coding and synthesis procedure was guided by the RBV as conceptualized by Barney (1991). In the context of supplier risk and resilience assessment, the RBV provides a structured basis for classifying risk factors according to underlying organizational resources, processes, and capabilities that shape vulnerability, robustness, and adaptive capacity. The coding process combined deductive and inductive reasoning (Kembro et al., 2014). Deductive codes were derived from established constructs in supply chain risk and resilience research, such as financial stability, process quality, and governance robustness, while inductive codes captured emerging factors and context-specific nuances identified in the reviewed studies. This iterative synthesis resulted in an initial set of 60 risk dimensions, which were subsequently aggregated into 33 sub-dimensions and ultimately condensed into four overarching categories: organizational, location-based, operational, and strategic/corporate. These categories reflect distinct layers of supplier-related resource dependencies and capabilities and form the structural basis for the subsequent expert validation.

Quality appraisal and bias mitigation were addressed through systematic evaluation and triangulation. Each article was assessed against criteria of methodological rigor, theoretical contribution, and managerial relevance (Durach et al., 2017), with studies meeting at least two criteria retained. To enhance transparency and reduce subjectivity, dual independent coding with reconciliation was applied, yielding strong intercoder reliability (Cohen's κ = 0.82). In addition, triangulation through three expert workshops provided external validation by comparing literature-derived findings with practitioner perspectives (see Section 4.2).

Indicator selection and robustness were ensured through explicit retention thresholds and sensitivity analysis. Indicators were retained only if they demonstrated sufficient literature support (frequency ≥3) and high practical relevance, reflected by an average expert rating of seven or higher. These thresholds balance theoretical saturation and practical relevance in line with the RBV's focus on empirically observable resource-related factors. Sensitivity analyses that varied thresholds by ± 1 altered the retained indicator set by less than 10%, confirming robustness. The final output is a consolidated, theoretically anchored indicator set integrating insights from 29 core studies and structuring four risk dimensions with their subordinate factors. This set served as the empirical basis for expert validation and framework refinement.

Figure 3 illustrates the multi-stage review and consolidation process, including the database query, filtering steps, and progressive reduction of studies, dimensions, and indicators that informed the development of our framework. Tables 5 and 6 in the Appendix I and II present the risk dimensions and factors derived from the literature review and constitute the basis for subsequent framework development. The resulting compilation, summarized in Table 2, served as the starting point for validation and refinement during the first expert workshop.

The expert workshops were used to validate and refine the literature-derived framework with respect to conceptual clarity, empirical observability, and operational feasibility. Table 2 presents the initial consolidated structure derived from the systematic literature review, which served as the starting point for expert validation and subsequent refinement into the final framework.

Three qualitative expert workshops were conducted with 12 purchasing and supply chain management professionals from four German industrial companies operating in globally distributed supply networks, including the automotive and mechatronics, pharmaceutical and laboratory equipment, investment casting, and mechanical engineering sectors. Participants represented strategic purchasing, operational purchasing, and ESG-related functions. To reduce groupthink, the workshops combined individual reflection, company-specific working groups, and moderated plenary discussions. Details on workshop design, including the agendas and guiding questions for each workshop, are provided in Appendix III (Tables 7–10).

Across the three workshops, the initial literature-derived factor set (Table 2) was consolidated into four analytical dimensions, refined into upstream vs. downstream indicators, linked to feasible information sources, and prioritized via expert weighting, resulting in the final framework presented in Table 3. The triangulation of literature-based insights and expert-derived feedback resulted in a framework that is theoretically grounded, empirically informed, and adaptable across industries.

Experts confirmed the overall structure of the initial framework but emphasized the need for simplification and prioritization to support practical application. Importantly, they clarified that the four overarching risk dimensions do not represent mutually exclusive categories. Rather, these dimensions function as higher-order analytical lenses for interpreting supplier-related risk and resilience factors. As reflected in the consolidated framework (Table 3), individual indicators may relate to multiple dimensions simultaneously, capturing overlapping aspects of supplier vulnerability and capability rather than being assigned to rigid “buckets.”

To enhance operational usability, experts recommended distinguishing indicators according to their functional role in risk and resilience management. This resulted in two structural refinements incorporated into the final framework: a differentiation between anticipatory and responsive indicators to separate preparedness from recovery capacity, and an upstream-downstream perspective to reflect how early warning signals and observable consequences emerge and propagate across supplier nodes within a supply network.

Expert discussions further highlighted that supplier vulnerability and robustness vary by supplier type and network position. This insight motivated the introduction of weighting and prioritization mechanisms to reflect relative importance at the individual supplier level. In a network representation, each supplier can be modeled as a node characterized by a vector of observable indicators, enabling supplier-specific assessment and aggregation across the network without assuming a strictly hierarchical chain structure or a specific technical implementation.

Finally, experts identified data availability and integration as the primary implementation challenge. Although much of the required information is already available from internal systems or external sources, it is often fragmented across databases and formats. Consequently, indicators in the final framework are explicitly linked to feasible information sources, supporting empirical assessment and enabling future data-driven or object-oriented implementations.

The systematic literature review yielded 60 distinct risk dimensions across 29 studies. These were iteratively consolidated through thematic coding into 33 sub-dimensions and four overarching categories: organizational, location-based, operational, and strategic/corporate. The four categories reflect complementary perspectives on supplier risk: organizational (internal processes, quality management, social and ecological standards), location-based (external political, infrastructural, and environmental risks), operational (procurement, production, and logistics factors), and strategic/corporate (long-term governance and financial stability). This hierarchical aggregation provides a clear structure that captures both internal and external risk layers, forming the conceptual foundation for the expert-based validation and weighting presented in Section 4.2.

Table 3 summarizes the validated framework by linking each risk dimension and factor to upstream and downstream indicators and their corresponding information sources. The distinction between upstream (preventive) and downstream (reactive) indicators reflects anticipatory versus responsive resilience capabilities.

The framework's grouping is aligned with the four resilience dimensions of robustness, redundancy, resourcefulness, and rapidity (Bruneau et al., 2003; Cimellaro et al., 2009). The framework incorporates visibility by explicitly linking each indicator to feasible information sources, enabling systematic observation and empirical measurement. The distinction between upstream and downstream indicators enhances risk awareness by differentiating between early warning signals and observable consequences of supplier-related risks, reflecting how disruption signals and impacts emerge over time and propagate across supplier tiers. This distinction supports a more targeted assessment and provides a logical foundation for categorizing resilience measures into short-term reactive responses and long-term structural improvements. Together, these design choices translate literature-derived and expert-validated indicators into an operational assessment structure that supports both empirical testing and managerial application.

Application of the framework begins with the identification of relevant risk dimensions organizational, location-based, strategic, and operational linked to underlying risk factors. The assessment is then conducted using both upstream and downstream indicators, allowing early warning signals and realized impacts to be considered jointly. Although this structured mapping facilitates future automation or digital integration, it is equally applicable to manual decision-making contexts. To ensure a robust evaluation of supplier risk and to avoid reliance on a single perspective, the framework recommends combining internal and external information sources.

The methodology allows for a granular analysis of supplier-specific risks that may have direct and immediate effects on the buying organization. This forward-looking and differentiated approach empowers supply chain managers to anticipate critical risk exposures early and to make more informed decisions, including whether a supplier's risk profile is acceptable under specific contingencies or whether the anticipated consequences justify switching to alternative sources.

In summary, the proposed framework provides a structured yet flexible basis for risk-aware supplier evaluation and proactive resilience management across global supply chains. This framework goes beyond risk to include resilience.

While supply chain resilience has become a widely acknowledged strategic objective, prior research has remained largely conceptual or concentrated on firm-level outcomes. There is limited guidance on how resilience can be operationalized at the supplier level, where many risks originate and propagate through different positions in the supply network. The framework developed in this study addresses this limitation by operationalizing supplier-level resilience through observable indicators, enabling assessment beyond firm- or network-level proxies. In doing so, the study responds to recent calls for more rigorous, multi-dimensional resilience measurement in complex, multi-tier supply networks (Yang et al., 2023).

The framework conceptualizes resilience as a configuration of interdependent supplier capabilities, rather than as isolated practices or static attributes. By distinguishing between anticipatory and responsive indicators across upstream and downstream interfaces, it enables an ex ante assessment of supplier preparedness and recovery capacity, rather than inferring resilience solely from ex post disruption outcomes. This aligns with recent research emphasizing adaptive, reconfigurable, and proactive supplier capabilities as critical drivers of resilience in multi-tier supply networks (Carnovale et al., 2025; Guntuka et al., 2024; Hajarath and Vummadi, 2024). It also resonates with emerging perspectives that conceptualize digital, analytics, and sensing capabilities as foundational for resilience at both firm- and network-levels (Dubey et al., 2023).

In contrast to earlier frameworks that rely on static or industry-specific taxonomies (Pettit et al., 2013; Wiedenmann and Größler, 2021), the framework uses indicators that can be compared across industries while still adjusted to specific contexts. This design directly addresses challenges in assessing suppliers' governance-related attributes that arise from differences in regulatory regimes, sustainability requirements, and levels of digital maturity across supply networks. By specifying publicly available indicators and associated information sources, the framework supports both traditional survey-based research and data-driven approaches that leverage digital traces, disclosures, and monitoring systems.

Notwithstanding, the framework represents an initial measurement layer and is intentionally specified as a largely static indicator set at a given point in time. While the upstream–downstream distinction captures leading versus lagging signals, it does not yet account for capability development trajectories or the evolution of supplier competencies. Building on competence-based perspectives, a natural next step is to extend the framework to a dual competence assessment that distinguishes between current capability levels and capability development potential. Such an extension would require longitudinal indicators and data sources and, where appropriate, adaptive indicator weighting to reflect changing supplier conditions and network contexts over time.

The framework contributes by making supplier-level resilience empirically testable through observable indicators. From a theoretical perspective, it integrates capability- and network-based views of resilience while enabling empirical tests that are difficult to conduct using aggregated firm- or network-level measures alone. Established perspectives such as the Resource-Based View provide a baseline for understanding supplier vulnerability, while more recent work emphasizes dynamic capabilities, network embeddedness, and temporal adaptation as key mechanisms shaping disruption outcomes (Carnovale et al., 2025; Guntuka et al., 2024; van Hoek and Wong, 2025). Network-analytic studies further demonstrate that structural characteristics such as centrality, connectivity, and path length influence disruption propagation and recovery, yet these studies typically rely on stylized firm representations and ex post outcome-based resilience metrics (Ivanov, 2025; Li and Zobel, 2020). The framework responds by closing a persistent measurement gap: most empirical studies rely on ex post outcomes, such as recovery time or performance loss, with limited observable inputs at the supplier level. By providing assessable indicators of supplier preparedness and response capacity, the framework allows researchers to model resilience as a function of capability configurations and their interaction with network structure and digital infrastructures, rather than inferred retrospectively from disruption outcomes.

Building on this foundation, Table 4 outlines three focused research streams. Because the current indicator set is derived from literature synthesis and qualitative expert validation, its statistical structure, construct validity, and predictive power remain to be established through large-scale empirical testing and subsequent scale refinement.

The validation stream leverages the indicator structure to test how configurations of anticipatory (e.g. preparedness, redundancy, visibility, digital sensing) and responsive (e.g. recovery speed, reconfiguration capacity, substitution flexibility) supplier capabilities predict resilience outcomes such as time-to-recover, time-to-survive, performance persistence, and risk-exposure, beyond traditional cost, risk, and network measures. This enables systematic differentiation of preparedness from recovery effects and provides empirical grounding for concepts such as network plasticity and digitally enabled resilience.

The evaluation stream addresses decision-relevant trade-offs associated with resilience investments. While prior research acknowledges efficiency–resilience trade-offs, empirical evidence on the relative value of specific resilience measures remains limited, as such actions are often treated as undifferentiated bundles (van Hoek and Wong, 2025; Lücker et al., 2024). By integrating supplier-level indicators into optimization models, scenario analyses, and sensitivity experiments, future research can not only evaluate when investments in anticipation (e.g. redundancy, monitoring, predictive analytics) outperform investments in response (e.g. accelerated recovery, network reconfiguration, emergency sourcing), but also examine how these trade-offs vary across industries, regulatory contexts, and network positions.

The extension stream positions the framework as a foundational measurement layer for dynamic and digitally enabled resilience research. While emerging research conceptualizes resilience as a network-level capability characterized by plasticity, reconfiguration, and digital adaptation (Guntuka et al., 2024; van Hoek and Wong, 2025; Ivanov, 2025), empirical progress remains constrained by the lack of supplier-level inputs suitable for integration into digital twins, simulation models, and hybrid analytics environments. Embedding the proposed indicators into such architectures would enable systematic testing of how capability configurations, governance strategies, and information-processing structures influence disruption propagation and recovery over time.

Taken together, these streams position supplier-level capability indicators as empirically tractable micro-foundations for analyzing how resilience emerges from the interaction of preparedness, recovery capacity, and network structure. By enabling empirical differentiation between anticipation and response, linking supplier capabilities to network-level dynamics, and supporting digitally enabled experimentation such as simulation-based stress testing, supplier portfolio optimization, and network reconfiguration analysis, the framework serves as an operational starting point for scale validation, indicator refinement, and dynamic extensions toward capability trajectories and development potential.

This study advances supplier risk and resilience research by developing a structured, indicator-based framework for supplier-level assessment. By integrating a systematic literature review with expert validation, the framework translates abstract resilience concepts into observable and assessable indicators, addressing a long-standing gap in empirical resilience research: the absence of measurable inputs at the supplier level, where many risks originate and propagate through supply networks.

The framework moves supplier evaluation beyond static, cost- or compliance-oriented assessments toward a resilience-informed, capability-based perspective. By distinguishing between anticipatory and responsive indicators, it enables separate assessment of supplier preparedness and recovery capacity and provides a micro-foundational link between supplier-level capabilities and system-level resilience dynamics. As such, the study contributes an empirically tractable and decision-relevant measurement structure that supports both academic analysis and managerial supplier assessment in increasingly volatile and interconnected supply networks.

The work leading to this manuscript was conducted in the course of the project “Resilience through agile value networks and AI-based optimization (Re_KI_lienz)” (Nr. 02J21C025) funded by the German Federal Ministry of Education and Research (BMBF), which is gratefully acknowledged.

The supplementary material for this article can be found online.