When the auditor asks for objective evidence - what are you going to show the auditor?
Are we required to go thru each raw material and determine the risk of single source supply for each? Is it sufficient just to hit the big one? Where does it stop?
I can just see a point where we are writing novels on risk, so we have our objective evidence, with very little added value. To me it should be about focusing on the macro level risks - probably 4-5. As opposed to every single itty bitty micro risk we deal with on a daily basis.