April 6, 2026
Managing Partner
The companies that suffered most were not just disrupted. They were still treating strategically critical dependencies as routine procurement rather than as board-level continuity risks. This was true across foodservice, semiconductors, and consumer goods.
Three unrelated disruptions in the past twelve months, the Sysco–Restaurant Depot consolidation in foodservice, the Ras Laffan helium shutdown in semiconductors, and the private-label and AI-mediated channel shift in consumer goods, caused wildly different degrees of damage to different operators. The conventional explanation is that some companies were unlucky or under-resourced. The better explanation is simpler and more fixable: the companies that got hurt were governing critical dependencies too low in the organization.
The pattern across all three cases is the same. A dependency that is functionally essential for food procurement for an independent restaurant, helium for a chipmaker, and retail shelf access for a consumer brand sits in the procurement function, reviewed quarterly against a cost benchmark. It is classified, in effect, as a commodity. When the disruption arrives, procurement does what procurement does: it looks for a cheaper alternative, pays a premium for the existing one, or waits for normalization. In all three cases, that response was inadequate because the dependency was not a commodity. It was a structural requirement with concentrated supply, no practical substitute, and no inventory buffer, and it needed to be governed as one.
The companies that absorbed these shocks had made a different classification decision, usually years earlier. They had moved the dependency up from procurement to the risk committee, from a cost line to a continuity requirement. That elevation changed everything downstream: sourcing got diversified, contracts got restructured around allocation rather than price, and buffer investments that looked expensive against a cost benchmark looked cheap against a disruption scenario.
This is an observation that most boards have not acted on, and the three cases make the cost of inaction concrete enough to change that.
In foodservice, Sysco’s $29.1 billion acquisition of Restaurant Depot will roughly double its share of a typical independent restaurant’s total food procurement, from the high teens to approximately 30 percent. Independent full-service restaurants, operating on 3-to-5-percent net margins per James Beard Foundation and Deloitte data, have no corporate procurement function, no group purchasing organization, and, after US Foods exits the cash-and-carry channel, no scaled alternative supplier. Their food costs are set by the owner, often weekly, based on whatever prices are available. A 3 percent increase in food costs, modest by recent inflationary standards, erodes roughly a quarter of their net profit. Large QSR chains, which source directly from producers and maintain multi-supplier contracts managed by corporate procurement teams, will barely notice the deal. The difference is not luck. It is organizational altitude.
In semiconductors, Iranian strikes on Qatar’s Ras Laffan complex in March 2026 removed one-third of the global helium supply overnight. Helium has no substitute in chip fabrication at cryogenic temperatures; the USGS confirms this. Samsung and SK Hynix sourced 64.7 percent of their helium from Qatar, according to the Korea International Trade Association. TSMC sourced from at least three non-correlated geographies, maintained a two-month buffer, and had invested in closed-loop recovery systems that recapture over 90 percent of process helium. Both companies face identical physics; helium is equally non-substitutable for both, yet TSMC’s operational exposure is fundamentally different. The reason is that TSMC appears to classify helium as a strategic utility subject to diversification requirements. Samsung appears to have classified it as an industrial gas managed by procurement. Same input, same shock, different altitude.
In consumer goods, five retailers control over half of the US home and hygiene sales. Private-label products reached $271 billion in 2024 and are growing at nearly four times the rate of national brands. AI-powered shopping agents now mediate which products consumers see. Incumbent brands treating retail access as a sales-management problem, managed by teams optimizing quarterly sell-through, are losing shelf space to private labels and insurgents who treat it as a strategic positioning problem. Brands holding ground elevate channel concentration to a board-level concern and invest accordingly: in retailer-specific strategies, in product data infrastructure for AI discovery, and in innovation pipelines that give retailers a reason to keep them on the shelf.
Santiago & Company developed a scoring tool, the Structural Vulnerability Index, to help boards identify operational dependencies that carry this classification risk. It measures five things: supply concentration, the presence of substitutes, the thickness of the margin buffer, the time available to adjust, and whether the dependency is treated as a commodity or a strategic utility. The last factor matters most, as it shapes the decisions about the other four.
When we scored eight operator types across the three disruptions, the results ranged from 14 to 82 on a 100-point scale. The scores are estimates, not audited figures, and the methodology is transparent in the appendix. But the rank order is robust: entities that govern critical dependencies at the board level consistently score 30 to 50 points lower than entities in the same industry that govern them in procurement. The gap between Samsung and TSMC, both facing identical helium substitutability constraints, is 34 points, almost entirely explained by governance altitude.
First, identify which dependencies in your operation are actually strategic utilities. These are functionally non-substitutable, supply-concentrated, and not bufferable through inventory. Most organizations have two to five of these. They are rarely classified correctly.
Second, move those dependencies from procurement to the risk committee. Review them on the same cycle as energy, water, and cybersecurity. The cadence change alone will produce different sourcing and contracting decisions.
Third, restructure the relevant supply agreements from price-optimized to allocation-secured, with diversified sourcing across non-correlated geographies. This costs more than the current arrangement. It costs less than the disruption.
Timeframes differ by case. In foodservice, there are twelve to eighteen months before the Sysco deal closes. In helium, only weeks remain before distributor buffers deplete. For consumer goods, it’s two to three years before AI-mediated discovery becomes the default channel. In each case, the required action is the same and available now: elevate the dependency so the right decisions are made.
Methodology Note
The Structural Vulnerability Index is an analytical construct of Santiago & Company. The five dimensions were derived from failures seen in three industries during Santiago & Company’s 2026 research program. They are not from one dataset or statistical model. The weights—governance classification (25%), supply concentration, substitutability, margin buffer (each at 19%), adjustment window (18%)—reflect our judgment of factor importance, based on cross-industry evidence. We tested alternate weightings, such as equal or supply-heavy weights. The rank order and the clustering of high- and low-SVI groups were stable, with maximum score shifts of 5 points. Individual operator scores are based on industry-average data from the sources cited in the appendix; individual operators will vary. Supply concentration estimates for foodservice are based on publicly reported broadline market shares and our assessment of cash-and-carry channel structure. Helium sourcing data for Samsung and SK Hynix uses the 64.7 percent Qatar dependency figure from the Korea International Trade Association; TSMC’s sourcing structure is inferred from public reporting and analyst commentary. The margin sensitivity model uses industry-average cost structures and is designed to show format-level sensitivity differences, not to predict specific outcomes.
Source Appendix
Three unrelated disruptions exposed the same hidden management failure: many companies still govern their most critical dependencies too low in the organization. This article explains why that mistake is now breaking operating models across industries and what boards can do now to fix it before the next shock makes the cost irreversible.
The restaurant industry’s next major disruption is coming from the supply side, not the consumer side. This article explains how Sysco’s $29.1 billion Restaurant Depot deal could reshape procurement economics for hundreds of thousands of independent operators. It also discusses what the most exposed formats need to do before the pressure becomes permanent.
After years of expansion, US restaurants are navigating a more demanding consumer. Our latest analysis reveals where diners are cutting back, where they’re still willing to splurge, and what operators must do now to protect margin while building the loyalty that will matter even more when conditions ease.
A regional strike on Qatar exposed something much larger than a temporary helium shortage: it revealed that industry is still managing a strategically indispensable input with the wrong model. This article shows why the disruption will deepen after the ceasefire and what boards must do now to prevent helium from becoming a recurring production-limiting constraint.
