How to Score Component Risk on Your BOM

The Risk Factors: What to Score

A robust BOM risk score considers multiple independent factors. No single factor is sufficient on its own. A component can be in active production from multiple sources and still carry high counterfeit risk. A single-sourced component can have a healthy supply position if its lead time is stable and its lifecycle is early. The score combines factors to produce a composite picture.

Lifecycle status The most direct indicator of supply risk. Lifecycle stages progress from active production through NRND (Not Recommended for New Designs), to last-time-buy/LTB, to EOL/discontinued. An active component with a recent product introduction date carries low lifecycle risk. An NRND component is signalling that the manufacturer is preparing to discontinue it: this is the stage at which migration or lifetime buy planning should begin, not after a PDN arrives.

Score by stage: Active (low), NRND (medium), LTB announced (high), Discontinued (critical).

Number of authorised sources Single-source components create a direct dependency on one manufacturer. If that manufacturer stops production, changes specifications, or suffers a disruption, there is no authorised alternative without re-qualification. Multi-source components, where two or more manufacturers produce a pin-compatible, specification-equivalent device, carry lower supply risk because demand can be redistributed.

Score by source count: Three or more sources (low), two sources (medium), single source (high). Add weight if the single source is concentrated in a specific geography.

Current lead time from authorised distribution Lead time is a real-time signal of supply tightness. A component with a standard lead time of eight to twelve weeks that is suddenly quoting 52 weeks is under demand pressure or has a supply constraint. Monitor lead time trends over time, not just the current snapshot. A lead time that has doubled in six months is a more significant signal than a long but stable lead time.

Score by lead time: Under 12 weeks (low), 12 to 26 weeks (medium), over 26 weeks (high), not available from authorised stock (critical).

Days of supply on hand How long can production continue at current consumption rates on existing inventory? Low days of supply combined with long lead time and elevated lifecycle risk creates the conditions for a production stoppage. This factor connects the risk score to current operational reality.

Score by coverage: Over 180 days (low), 90 to 180 days (medium), under 90 days (high), under 30 days (critical).

Replacement complexity If this component were discontinued tomorrow, how difficult would it be to qualify a replacement? For a standard passives in a common value and package, the answer is relatively straightforward: multiple manufacturers produce equivalent devices, the qualification effort is limited, and the BOM change is low-risk. For a complex SoC, a custom FPGA configuration, or a component tied to a specific software driver or regulatory submission, the replacement complexity is high. This factor captures the engineering and regulatory burden of a forced substitution.

Score by complexity: Drop-in equivalent available (low), electrical equivalent requiring validation (medium), requires firmware or PCB change (high), requires regulatory re-submission (critical).

Counterfeit risk by component type Not all component types carry the same counterfeit risk. High-value ICs (FPGAs, microprocessors, power management devices), branded components with wide specification ranges across grades, and parts with large price differentials between genuine and counterfeit carry the highest risk. Standard passives carry lower counterfeit risk unless they are precision-specified (see passive component obsolescence post). This factor should also reflect whether the part has known counterfeit activity reported in ERAI or other incident databases.

Score by type and history: Standard passives (low), commodity ICs from authorised sources (low-medium), high-value ICs or parts with known counterfeit incidents (high).

Application criticality Where the component sits in the circuit affects the consequence of failure. A component in a non-critical auxiliary function carries different risk than the same component in a safety-critical control path. In regulated products (medical, aerospace, automotive), the consequence of component failure includes not just the functional failure but the regulatory and liability consequences. Weight this factor to reflect the consequence of a failure in the final application, not just the probability of a supply event.

Score by position: Non-critical auxiliary (low), operational but non-safety-critical (medium), safety-critical or regulated application (high).

Weighting the Factors

Not all factors carry equal weight. Lifecycle status and replacement complexity are the two highest-weight factors because they determine the structural severity of the risk: an EOL component with no drop-in alternative is a programme-level problem, not a procurement inconvenience. Lead time and days of supply are operational factors that determine urgency. Counterfeit risk and application criticality determine consequence.

A practical weighting approach:

Lifecycle status: 25% Replacement complexity: 20% Number of authorised sources: 20% Lead time: 15% Days of supply: 10% Counterfeit risk: 5% Application criticality: 5%

These weights are a starting point, not a fixed formula. Regulated industries should increase the weight of application criticality and replacement complexity. High-volume consumer products might weight lead time and days of supply more heavily.

Building the Score: A Practical Approach

Assign each factor a numerical score on a consistent scale, for example 1 (low risk) to 4 (critical). Multiply each factor score by its weight. Sum the weighted scores to produce a composite risk score between 1 and 4 for each component.

For a BOM with hundreds of components, this calculation should be done programmatically. Export the BOM to a spreadsheet, populate the factor columns using a combination of lifecycle database data (Z2Data, Accuris/SiliconExpert, or similar), distributor API data for real-time lead times and stock, and internal engineering data for replacement complexity and application criticality. The composite score can be auto-calculated once the input columns are populated.

The practical bottleneck is not the arithmetic. It is the data gathering. Lifecycle status, lead times, and stock levels can be pulled from third-party tools. Replacement complexity and application criticality require engineering input and cannot be automated. Plan for a structured engineering review session to populate those two columns for the highest-complexity components on the BOM.

Tiering the BOM

Once scores are calculated, tier the BOM into three action categories.

Tier 1: Immediate action required Components with composite scores above a defined threshold (for example, 3.0 or above on a 4.0 scale). These require a documented response plan with an owner and a deadline: either a last-time-buy decision, a re-qualification to an alternative, or a design change. These should be reviewed in the next planning cycle, not the next annual review.

Tier 2: Active monitoring Components with scores in the medium range (for example, 2.0 to 3.0). These do not require immediate action but should be monitored on a defined cadence, typically monthly, for changes in lifecycle status or lead time that would move them to Tier 1.

Tier 3: Standard management Components with scores below the medium threshold. These are managed through the standard procurement process. They should still be included in the periodic BOM review cycle.

What to Do With the Score

A risk score is only useful if it drives action. For each Tier 1 component, the response plan should specify: the nature of the risk (lifecycle, supply, or replacement), the preferred resolution (LTB, alternative qualification, redesign), the owner in engineering and procurement, the target completion date, and any dependencies (regulatory submission, PCB re-spin, software update).

For Tier 2 components, the monitoring plan should define: the data source for lifecycle and lead time updates, the trigger conditions that would move the component to Tier 1, and the review frequency.

The risk score should feed into new product introduction (NPI) design reviews so that component risk is considered at the design stage, when substitution is cheapest, rather than in production, when it is most expensive.

Keeping the Score Current

Component lifecycle status changes continuously. A component that scored low today may move to NRND in the next manufacturer update cycle. Lead times fluctuate with demand. New counterfeit incidents are reported monthly.

The BOM risk score should be recalculated on a defined cadence, typically quarterly for the full BOM and monthly for Tier 1 and Tier 2 components. Set up automated alerts from your lifecycle intelligence tool for PDN and PCN notifications on the components in your BOM. The alert should trigger a re-score of the affected component and, if the new score crosses a tier boundary, an immediate escalation.

The most common failure mode in BOM risk management is treating the initial scoring exercise as a project with a completion date. It is not. It is an ongoing operational process.

How Maketronics Supports BOM Risk Response

When a BOM risk scoring exercise surfaces a component with constrained authorised supply, Maketronics can advise on secondary market availability, help assess what verified stock exists, and structure a sourcing approach proportionate to the risk.

For Tier 1 components where the LTB window is closing or has closed, rapid assessment of the secondary market supply position gives procurement teams the information they need to make the LTB vs redesign decision before the window closes.

Running a BOM risk review and finding supply gaps on Tier 1 components? Talk to the Maketronics team and we will tell you what the verified supply picture looks like for your highest-risk parts.