Mapping your company's critical raw material exposure starts with data you already hold. The path follows five steps. None of them require a supplier survey to get started.

For the business rationale & methodology behind this exposure picture – why procurement systems miss critical raw material risk and how large the gap is – see: Why Most Companies Miss Where Their Critical Raw Material Risk Actually Sits

Step 1: Scope the Exercise

Define the boundary before you start. Which legal entities, product lines, and reporting period are in scope? What is driving the exercise – the company's own interest in supply security, a regulatory obligation under ESRS E5 or CRMA Article 24, or both?

Getting the scope right determines what the output needs to look like and who owns the findings. A risk function running a supply security analysis and a sustainability team preparing an ESRS E5 disclosure have different output requirements, but the same underlying data need. Clarifying the scope upfront prevents the exercise from expanding into something unmanageable.

Step 2: Map the Exposure

Translate procurement spend into material-level supply-chain exposure. It answers one question: how many tonnes of each critical and strategic raw material is your company exposed to, and where in your supplier network do those exposures sit?

The input is procurement spend, broken down by sector, supplier, and geography – data large manufacturers already record. A supply-chain decomposition model runs that spend through the inter-industry relationships that carry raw materials through components and into finished goods, revealing where each material shows up across the supplier network. Spend data in, exposure map out. Roughly four weeks to first findings.

This is the step ctrl+s runs. The output is a first risk map: spend at risk by material and category, supply-chain flow by tier, and a per-material scorecard showing source concentration, export-control status, and substitutability.

Step 3: Assess the Risk

Test each exposure against three criteria: source concentration (how much of the global supply comes from a single country or company), export-control status (is this material currently restricted, and by whom), and substitutability (can it be replaced without significant loss of performance or cost).

The risk function owns this step. It holds the supplier relationships and commercial context that determine which exposures are operationally urgent versus theoretically significant. The exposure map from Step 2 provides the input; the risk assessment determines the priority order for action.

Step 4: Mitigate

Act on the ranked exposures. Qualify alternative suppliers, redesign components where feasible, build buffer stock, adjust contracts. The decisions here are commercial and specific to the business.

Procurement and strategy own this step. The exposure map and risk assessment don't make these decisions – they tell you where the decision needs to be made and what the trade-offs are. Mitigation is inherently slow for some materials (alternative sourcing for some rare earths can take years) and fast for others (buffer stock, contract terms). Knowing which is which before a disruption is the point.

Step 5: Monitor and Report

Re-run the exposure map each reporting cycle – annually at minimum. Feed the findings into the ESRS E5 resource-inflows disclosure (E5-4) and the CRMA Article 24 supply-chain risk assessment. Track how the picture moves as procurement decisions, supplier relationships, and regulatory scope evolve.

Sustainability and risk own the reporting cadence. The same model that produced the first map can be re-run on updated spend data, making the monitoring step repeatable rather than a one-off project.

The first time through this process, the output is a starting point, not a finished picture. The exposure map shows where the deeper work will pay off. Each high-ranking exposure can then be traced to named suppliers, specific components, and primary data in a later, more targeted pass.

The alternative – waiting for a disruption to reveal the exposure – is also a choice, but it leaves less room to respond.