On 1 October 2026, Pandora opened a new jewellery crafting facility in Vietnam. In its own announcement, the company describes a USD 150 million investment, its first production site outside Thailand, and a facility that strengthens supply chain resilience and builds a more diversified manufacturing footprint.
Press coverage adds scale and context. A report on Emirates 24|7, which attributes its reporting to Reuters, says the plant is expected to account for around one-third of Pandora’s production capacity eventually, and that all of the company’s output had previously come from three factories in Thailand. We could not open the Reuters article directly, so we rely on Pandora’s release and on that secondary report for these details.
This article is about what the move illustrates for risk leaders. It is not a claim about Pandora’s full reasoning, and Pandora is not a Crest.Digital customer.
Crest.Digital’s platform helps procurement, supply-chain and risk teams map suppliers to locations and watch concentration continuously, not once a year.
Explore the PlatformWhat Pandora Actually Did
The Facts, as Reported
- Date and size: Opened 1 October 2026, a USD 150 million investment, per Pandora.
- Output: Pandora says it adds 60 million pieces a year of capacity and a 50% increase in manufacturing capacity.
- Footprint: Pandora’s first production site outside Thailand, described by the company as a more diversified and resilient footprint.
- Share of capacity: Reported to start smaller and eventually reach around one-third of production.
- Pandora’s wider aims: Capacity, flexibility, innovation and growth are also named by the company, alongside resilience.
Resilience is therefore one stated rationale among several. That is fine. A useful lesson does not need the move to be purely about risk. It only needs to show a company treating where capacity sits as a decision it can shape, rather than a fact it inherits.
From Risk Exercise to Manufacturing Strategy
Most supply-chain risk programmes are reactive by design. Onboard the supplier, run the assessment, score it, watch for alerts, respond when something breaks. That discipline matters, and we have written about why a questionnaire cannot see supplier cyber risk and about compliance in manufacturing supply chains.
But screening only changes what you know about a supplier. It does not change how much of your business depends on one place. When a company opens a second site, qualifies a second country or splits volume, it changes the exposure itself. Risk has moved from the reporting cycle into capital allocation, network design and sourcing strategy.
The OECD Supply Chain Resilience Review (June 2025) frames the point well: the key to resilience is not eliminating risk but navigating it effectively. Choosing where capacity lives is one of the ways organisations navigate it.
Supplier Risk Is Not the Same as Dependency
Here is the gap in many dashboards. A supplier can score well on financial health, cyber hygiene and compliance and still be a single point of failure. Conversely, a mediocre score on a supplier you could replace in a week is a smaller worry than a good score on one you could not replace in a year.
Concentration is portfolio-level by nature, a theme we explored in vendor concentration risk as a portfolio problem and, for AI providers, in the concentration risk behind Lagarde’s warning. Sites and countries behave like shared providers: a flood, port outage or tariff decision hits everyone who depends on them at once. Our note on geopolitical third-party risk covers that side.
What One Factory Does Not Prove
It is worth being careful. One company’s factory is one data point. It does not show that manufacturers everywhere are relocating, and it does not tell us everything that drove Pandora’s decision. Capacity, cost, labour, market access and sustainability can all play a part.
A second site is also not free. It takes capital and years, and it introduces new country, regulatory, labour and logistics exposures that need their own monitoring. For many organisations the right first step is lighter: qualify an alternate source, split volumes, hold buffer stock, or negotiate capacity options. The point is the order of operations. Measure the dependency, then choose the lightest lever that brings it within risk appetite.
Crest.Digital’s Agentic GRC and Agentic AI workflows keep supplier, location and concentration data current, with human approval and a full activity record. See the industries we cover.
An Eight-Step Dependency Map
Here is a practical sequence that takes you from supplier lists to an alternate source. Each step feeds the next, and the output is a view a COO or board can read in minutes.
Supplier
Start with the full list of suppliers, including sub-tier and contract manufacturers, and record what each one provides to which product or process.
Location
Map each supplier to the actual sites where the work is done, not just the head-office address on the contract.
Capacity
Record how much each site can produce, how much of it you use, and how much spare capacity is available to take on extra volume.
Concentration
Calculate the share of each critical product or input that depends on one site, region or country, and set a threshold that triggers review.
Country Risk
Overlay the political, regulatory, labour and trade conditions of each country where concentration is high.
Climate
Add physical exposure such as flood, heat, storm and water stress at each critical location, using credible hazard data.
Geopolitics
Test how tariffs, sanctions, border disruption or conflict could cut off a location, and which routes or inputs would be affected.
Alternate Source
For every high-dependency node, name and qualify an alternate site or supplier, and record how long a switch would take.
Run it first for your five or ten most critical products or inputs. If a single site or country supports a large share of any of them, and no alternate can take over quickly, you have found a priority. For the board-level framing, see our piece on connected risk and board action, and for a regional view of controls over third parties, UAE operational risk and third-party controls.
Keeping the Map Current
A dependency map is only as good as its freshness. Suppliers move production, change subcontractors or get acquired, and country conditions change. Continuous monitoring recalculates concentration when the inputs change and flags when a dependency crosses a threshold. Agentic AI can gather and correlate that evidence across sources, while accountable people review exceptions and decide. See end-to-end vendor risk governance and operational resilience and third-party risk.
Your Turn: Do Your Risk Dashboards Measure Supplier Risk, or Actual Dependency?
- Supplier scores only: We rate each supplier, but cannot say how much volume depends on one site or country.
- Concentration visible: We map location and share of volume, reviewed periodically.
- Dependency monitored: Location, capacity and alternates are tracked continuously with thresholds.
Which describes your dashboard today? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Banking regulators globally have moved from principles-based guidance to prescriptive expectations on third-party risk. DORA in Europe, OSFI B-10 in Canada, the 2023 US Interagency Guidance, and the RBI Master Directions each specify what a board-level third-party risk programme must contain. For regulated institutions, the question is no longer whether to have a TPRM programme but whether the programme’s documentation is sufficient to withstand a regulatory examination.
Frequently Asked Questions
Supply chain concentration risk is the exposure that builds up when too much of your output, sourcing or capacity depends on one supplier, one site, one region or one country. The suppliers can each look healthy on paper and the portfolio can still be fragile, because one flood, port closure, tariff change or political shock can hit everything at once. It is a different question from whether a single supplier is well run. It asks how much of the business would stop if one location did.
According to Pandora’s own announcement, it opened a new crafting facility in Vietnam on 1 October 2026, a USD 150 million investment. Pandora describes it as its first production site outside Thailand and says it strengthens supply chain resilience and creates a more diversified manufacturing footprint. Press coverage reports that the site is expected eventually to account for around one-third of Pandora’s production capacity. Pandora’s stated motives are broader than resilience, including capacity and growth, so one factory should not be read as proof of a general trend.
No. Duplicating capacity is expensive, takes years, and can create new risks of its own, such as a new country’s regulation, labour market, logistics and fourth-party dependencies. For many organisations, cheaper levers come first: qualifying an alternate source, holding buffer stock, dual-sourcing critical inputs, or splitting volumes. The useful discipline is to measure dependency first, then choose the lightest option that brings the exposure inside risk appetite.
Start by mapping what each supplier actually provides and where it is produced, down to site and country. Then calculate how much of each critical product, component or service depends on each location, and how quickly an alternate could take over. The output is a concentration view, such as percentage of volume by location and time to switch, rather than only a risk score per supplier. Combine it with country, climate and geopolitical indicators so the board sees exposure and not just ratings.
A concentration map is only useful while it is current. Suppliers move production, acquire competitors or change subcontractors, and country conditions shift. Continuous monitoring keeps the supplier, location and capacity data fresh, recalculates concentration when something changes, and flags when a dependency crosses an agreed threshold. Agentic AI can gather and correlate this evidence across sources, with people reviewing the exceptions and deciding on action.