Many organizations still treat supplier risk management as a reactive firefighting exercise, leaving them vulnerable to disruptions that could have been prevented.