The Supply Chain Risk Your Financial Auditor Cannot See

What the Strait of Hormuz crisis reveals about supply chain concentration risk in any acquisition, and why standard due diligence consistently misses it.

On 28 February 2026, the Islamic Revolutionary Guards Corps broadcast warnings to vessels in the Strait of Hormuz that passage was no longer permitted. Shipping giants Hapag-Lloyd and Maersk suspended transits. Oil prices jumped 10% overnight. And somewhere right now, a private equity firm is preparing to close a mid-market acquisition in a business that has never once stress-tested what happens when the supply chain that sustains its margins simply stops.

This article is not about geopolitics. It is about the question that operational due diligence exists to answer: if an external shock removes a critical input or logistics route from the equation, does the business you are acquiring survive intact, or does it reveal a concentration risk that was hiding in plain sight?

The Connection Is Closer Than You Think

The instinctive reaction of many investors is that Hormuz is a distant problem, relevant to energy majors and multinationals but not to a mid-market food processor, a regional distributor, or a manufacturing business with no direct Middle Eastern supplier relationships. That assumption is worth examining carefully before you close your next deal.

Why Standard Due Diligence Misses This

Financial due diligence reviews historical cost of goods sold. It tells you what inputs have cost. It does not tell you what they would cost if the supply route was disrupted, who the alternative suppliers are, what the lead time is to switch, or whether the business has any contractual protection against input price shocks.

Legal due diligence reviews supplier contracts. It tells you what the terms are. It does not tell you whether those contracts contain force majeure clauses that allow suppliers to exit without liability in exactly the circumstances now unfolding, or whether price-escalation exposure sits off the balance sheet.

Operational due diligence asks the questions that neither workstream reaches:

• How many suppliers does the business rely on for its three most critical inputs?
• What is the geographic concentration of those suppliers, and where do the single points of failure sit?
• Has management mapped the supply chain beyond Tier 1 to understand where the real dependencies lie?
• What is the stock cover for critical inputs, and at what point does disruption become an operational crisis?
• Can the business pass input cost increases through to customers, and over what timeframe?

In our experience of mid-market transactions, management has rarely mapped this exposure systematically. The supply chain works until it does not, and nobody has modelled what happens when it does not.

Three Categories of Supply Chain Risk in Mid-Market M&A

Direct import dependency

The most visible category. The business sources a material percentage of its inputs or finished goods from foreign suppliers, and the supply chain passes through a geographic concentration point. What to assess: supplier concentration by geography, alternative sourcing options and lead times, stock cover at acquisition date, and the margin sensitivity to a 20–30% increase in landed input costs.

Indirect energy and logistics exposure

Less visible but more widespread. The business does not import from the affected region but depends on fuel at a price point that makes its logistics economics work. A cold chain operator, a distribution company, a food processor with significant transport costs, all carry Hormuz exposure without a single direct import relationship in the affected region. What to assess: fuel as a percentage of COGS, the ability and lag time to pass fuel cost increases to customers, and whether the current margin structure is sustainable at 20–40% higher energy costs.

Supplier-of-supplier concentration

The least visible and most frequently missed. The business's own suppliers are import-dependent, and a supply chain shock manifests as delivery failures or price increases at the tier above rather than at the business itself. The business carries the operational risk without any contractual relationship with the original source of the disruption. What to assess: whether Tier 1 suppliers have been asked about their own supply chain concentration, and whether any critical input has a de facto single-source dependency sitting two steps upstream.

What Operational Due Diligence Produces

A well-executed ODD workstream on supply chain risk does not produce a list of potential problems. It produces three structured outputs:

The Question to Ask Before You Close

The Strait of Hormuz will likely reopen. The US maintains a substantial naval presence in the region, and a sustained physical closure is considered unlikely by most analysts. But the disruption has already affected freight rates, insurance costs, and oil prices in ways that will take months to work through global supply chains.

More importantly, the question for an investor is not whether the current crisis resolves. It is whether the business you are acquiring has a supply chain that can absorb shocks of this nature without structural damage to its margins, its customer relationships, or its operational continuity.

That question is not answered by a financial model.