Knitted Bag Sourcing Risk Management: Twelve Controls Across Six Categories, in the Order to Apply Them
How should a buyer approach knitted bag sourcing risk? In a fixed order: capacity and schedule first, because they cause most of the damage, then quality, compliance, logistics, design and concentration. Twelve controls cover the six categories, and about half of them cost nothing to apply. This article sets out the twelve with the trigger each one watches, the owner each one needs, and how to score likelihood and impact without turning a sourcing programme into a compliance project.

The Order to Apply the Controls
The twelve controls belong to six categories and should be applied in a fixed order: capacity and schedule first, then quality, compliance, logistics, design, and finally concentration.
The order is not arbitrary. It reflects observed damage rather than abstract severity. Capacity and schedule failures cost the most per occurrence, because a slipped delivery is a missed season rather than a returned item, and they are also the most preventable, since a booked window can be confirmed before an order is placed. Quality failures cost less per occurrence but occur more often. Compliance failures are rare and severe, and while they are inexpensive to prevent they are expensive to discover late. Design and concentration risks are slow-burning: they cost nothing until the year the buyer needs to move a programme.
Category One: Capacity and Schedule Risk
Capacity risk is the largest exposure on a knit programme, and two controls address it: confirming a booked window rather than an installed figure, and building the calendar backward from the in-store date.
The first control is a question with a specific expected answer. Installed capacity across 7 production lines running about 200,000 pieces a month says nothing about availability; the committed position for a named week six weeks out does. A partner who can state which gauge each line is set to in that week has a schedule, and one who cannot is quoting a figure. The second control is the calendar: about 12 weeks for a first programme and about 8 for a repeat, built backward from the in-store date so that the two holiday shutdowns are visible rather than discovered.
The trigger each control watches is worth naming, because a control without a trigger is a belief. For capacity the trigger is a booking confirmation in writing for the specific week. For schedule it is a written plan showing sampling at 7 working days, bulk at 30 days, inspection at 2 to 3 days and sea freight at about 21 days, with the shutdowns marked. Both triggers are checked before the deposit is paid, which is the point at which they still cost nothing to insist on.
- 1. Capacity, booked window
- Committed position for a named week, with the gauge per line
- 2. Capacity, backward plan
- About 12 weeks first run, about 8 repeat, from the in-store date
- 3. Quality, specification freeze
- Signed annex; changes written with a stated cost in days
- 4. Quality, defect list
- AQL 2.5 under ISO 2859-1, tolerances and zero tolerance items
- 5. Compliance, market screen
- REACH Annex XVII, Prop 65, CPSIA, OEKO-TEX as applicable
- 6. Compliance, document set
- Named documents, assembled during bulk not after it
- 7. Logistics, booking and space
- Carrier space reserved before the August to November peak
- 8. Logistics, freight mode
- About 21 days sea, about 18 rail, about 5 air, charged on volume
- 9. Design, confidentiality
- Signed before disclosure, term about three to five years
- 10. Design, file and tooling
- Stitch file and paid tooling owned by the buyer and transferable
- 11. Concentration, second source
- Qualified on one specification, held at about 30% of volume
- 12. Concentration, commercial terms
- Currency band of about 2% to 3%, price validity, payment structure
Category Two: Quality Risk
Quality risk is addressed by two controls that cost nothing: a specification freeze with written change control, and a defect list built from the approval figures rather than written at inspection.
The freeze works because every later stage is built from it. A change to GSM of more than about 5% or a change of gauge restarts the 30 days rather than adjusting them, and requiring that a change be written with its cost in days stated is what makes that visible before it is incurred. The defect list works for the complementary reason: under ISO 2859-1 at AQL 2.5, a lot of 281 to 500 pieces draws 50 with an acceptance number of 3, which tells an inspector how many to look at and nothing about what to look for. The list supplies the latter, with tolerances and with handle attachment at zero tolerance.
A third element sits inside this category and is worth stating even though it is not a separate control: the switching rules. Inspection moves between normal, tightened and reduced sampling based on recent results, and knowing the current state tells a buyer whether a pass means what it appears to mean. A programme that has moved to tightened sampling after two of five consecutive lots were rejected is a programme with a quality problem, and that is information worth having before the next order rather than after it.

Category Three: Compliance Risk
Compliance risk is rare and severe, and two controls contain it: screening the destination market during production rather than after it, and naming the document set in the contract rather than requesting it later.
The timing is the entire control. A restriction screen applies to the material and the market, not to the finished goods, which means it can be commissioned during the 30 days of bulk at no cost to the schedule. Commissioned after production, it applies to goods that already exist, and a finding at that point has nowhere to go. The documents follow the same logic: a REACH Annex XVII position for the EU, a Prop 65 position for California, CPSIA documentation for a children's product, and OEKO-TEX STANDARD 100 as the single certificate that covers the restricted substance question across several markets.
One further check belongs here and is routinely missed: which stages sit outside the audited floor. Dyeing, printing, hardware plating and sometimes assembly are commonly placed with outside vendors, and a stage placed outside is outside both the audit scope and the scheduling control the buyer believes they have. Asking which stages are placed out, at the point of the compliance check rather than at the point of a finding, is what keeps the category contained.
Category Four: Logistics and Document Risk
Logistics risk has two controls: reserving carrier space before the peak season, and choosing the freight mode against the actual cause of any delay rather than as a reflex.
Space is the first because it is the one that surprises people. The peak booking window runs roughly from August to November for spring deliveries, and space in that window tightens well before the cargo is ready. Reserving before the goods are finished costs nothing and prevents the most avoidable freight delay there is. The mode decision is the second: about 21 days by sea from Xiamen, about 18 by rail on the land bridge and about 5 by air, with air on a bulky knit charged on volumetric weight at a divisor of 6,000.
The discipline in the mode decision is worth stating plainly. Air freight recovers a schedule that has already slipped; it does not fix the cause. Four of the six failure modes on a knit programme sit before production ends, in booking, colour approval, specification change and trim, and none of them is touched by a faster aircraft. Where a programme has a genuinely late start, air is the right tool. Where it has a planning problem, the same money spent on a held week of yarn buys more certainty.
Category Five: Design and Intellectual Property Risk
Design risk is contained by two controls, and both are administrative: a confidentiality agreement signed before disclosure, and a clause giving the buyer the stitch file and any paid tooling.
The first has an expiry of its own, which is why it comes before anything else: a design disclosed without an agreement in place is disclosed. A term of about three to five years from the date of disclosure is standard. The second is usually justified as protection and turns out to be what makes a second source possible, because five parameters, gauge, loop length, yarn count, panel dimensions and structure map, plus a specification are enough for another floor to reproduce the product inside one sample round.
Registration is a third option rather than a control, and it is worth deciding on the basis of the term rather than of anxiety: 15 years from grant for a US design patent, 15 years from filing in China, up to 25 years for a registered design in the EU and the UK, and an automatic three years for an unregistered EU right. For a one-season promotional piece the automatic right plus dated records is proportionate. For a style intended to run several seasons, registration is the better answer.
Category Six: Concentration and Commercial Risk
Concentration risk is addressed by qualifying a second source on one specification, and commercial risk by stating the currency, price validity and payment structure in writing rather than inheriting them.
The second source is best understood as insurance against concentration rather than as a quality measure. A split of about 70% to the incumbent and 30% to a second floor keeps both qualified, and the qualification itself, one sample round of 7 working days and a trial order of about 500 pieces, is the cost of the insurance. The commercial controls are smaller and worth listing because each one prevents a recurring argument: USD with a review band of about 2% to 3%, a price validity period of 30 or 60 days, and a stated payment structure with the balance tied to a document.
| Risk | Control | Trigger to watch |
|---|---|---|
| Booked window not real | Committed position for a named week with gauge per line | Written booking confirmation before deposit |
| Calendar slips | Backward plan from the in-store date, shutdowns marked | Plan showing 12 weeks first run, 8 repeat |
| Specification drift | Signed freeze, written change with cost in days | Any change requested after the freeze date |
| Release is an opinion | Defect list at AQL 2.5 with tolerances | List attached to the contract before bulk |
| Compliance finding late | Screen commissioned during the 30 days of bulk | Screen ordered in week one of bulk |
| Documents missing at release | Document set named in the contract | Set complete before goods finish |
| No carrier space | Space reserved before the August to November peak | Booking made before production ends |
| Wrong freight decision | Mode chosen against the cause of the delay | Cause identified before air is authorised |
| Design disclosed unprotected | Confidentiality signed before disclosure | Agreement dated before the first file is sent |
| Programme cannot move | Stitch file and tooling owned and transferable | Five file parameters held by the buyer |
| Single point of failure | Second source qualified on one specification | Trial order completed, split at about 30% |
| Terms drift each season | Currency band, price validity, payment structure in writing | Clause present at renewal |
The Risk Register: Six Columns, Twelve Rows
A risk register is six columns and twelve rows, and its value is that it gives each control an owner and a trigger rather than leaving them as intentions.
The six columns are the risk, the control that addresses it, the trigger that shows whether the control is working, the person who owns it, and a likelihood and an impact score on a scale of 1 to 5. Twelve rows means the register fits on one page, which is the point: a register nobody reads is not a control. The scores multiply to give a number between 1 and 25, and anything above about 12 is worth doing something about before the next order rather than noting.
Scoring Likelihood and Impact Without Overthinking It
Score likelihood and impact on a 1 to 5 scale using one question each, and stop: how often has this happened to this programme, and what does one occurrence cost in weeks or in money.
Re-scoring once a year is enough, and the natural moment is the review after a run, when the evidence is available. The register should also be revised when something happens: a failure that was scored low on likelihood and then occurred is a signal that the score was wrong, and correcting it is the point of keeping the document. Buyers who do this for two or three seasons find the register becomes short and specific, which is the sign it is working.
Capacity and schedule
Two controls, highest damage per occurrence. Confirm a booked week and build the calendar backward.
Quality
Freeze and defect list. Both free, and both convert an opinion into a measurement.
Compliance and logistics
Screen during bulk and reserve space before the peak. Both are timing controls rather than spending.
Design and concentration
File ownership and a second source. Slow-burning, and needed in the year a programme has to move.
Which Controls to Apply First on a Small Programme
On a small programme, four controls carry most of the value: a confirmed booking window, a written specification with a freeze, a defect list at AQL 2.5, and a compliance screen commissioned during bulk.
Those four are free, they take an afternoon between them, and they address the categories that cause the most damage first. The remaining eight are not wasted, but their value rises with programme size: a second source is worth its qualification cost at tens of thousands of pieces a year and not at a few hundred. With a 100 pcs per style and colourway minimum, a small buyer can still run a trial order and learn whether the rest is worth applying, which is arguably the most efficient use of a low minimum there is.
Two habits close the gap for a small buyer without adding controls. The first is to keep the record from the first run, since the four figures that make a repeat shorter are produced by the first programme whether or not anybody writes them down. The second is to ask one question at each renewal: what has changed. A destination market added, a construction altered and a volume doubled each re-open categories that were previously closed, and the register is where that gets noticed.

Map the twelve controls onto your programme
Send the style, the volume per colourway, the destination and the required date. Our knit team will return the capacity position for your window, the compliance scope for your markets, and a quotation on 7 working days of sampling and 30 days of bulk. Start on the contact page.
Frequently Asked Questions
What is knitted bag sourcing risk management?
Twelve controls across six categories: capacity and schedule, quality, compliance, logistics, design and concentration, each with a trigger that shows it is working and an owner responsible for applying it. About half of the twelve cost nothing to put in place. It is worth stating in writing before production begins, because it is far harder to agree once the goods exist.
Why start with capacity rather than quality?
Because capacity failures cost the most per occurrence. A slipped delivery is a missed season rather than a returned item, and a booked window can be confirmed before an order is ever placed. Quality failures cost less each time but happen far more often. Record the figure at approval so that inspection and any later run can be measured against it.
How do I confirm a production window is real?
Ask for the committed position for a named week six weeks out, and which gauge each line is set to in that week. A partner who can answer at that level of detail has a schedule rather than an aspiration. Both sides are better served when this is agreed early rather than discovered halfway through the programme.
What are the two quality controls?
A specification freeze with written change control, and a defect list at AQL 2.5 built from the approval figures, with tolerances and with handle attachment at zero tolerance. Both are free to put in place. Both convert an opinion into a measurement. That is the practical control, and it costs nothing to put in place before the deposit is paid.
What does AQL 2.5 actually accept?
Under ISO 2859-1 at general inspection level II, a lot of 281 to 500 pieces draws 50 with an acceptance number of 3, so a lot with three defects in the sample passes and those units still have to be dealt with. Programmes that skip this step tend to rediscover the same problem on the following season.
When should the compliance screen be commissioned?
During the 30 days of bulk. It applies to the material and the market rather than to the finished goods, so running it after production means it applies to goods that already exist and cannot be changed. Ask for it as a figure rather than a statement, since a statement cannot be checked or compared.
How do I decide between sea, rail and air freight?
Against the cause of the delay. About 21 days by sea from Xiamen, about 18 by rail on the land bridge and about 5 by air, with air charged on volumetric weight at a divisor of 6,000. Air recovers a schedule; it does not fix a plan.
How much volume should go to a second source?
About 30%, with the incumbent at about 70%. Thirty per cent is roughly the smallest share that keeps a floor qualified, with the stitch file loaded and the yarn inside the ordering cycle. Below that, the floor effectively requalifies each season. It belongs in the written specification rather than in a conversation that nobody can quote later.
What columns should a risk register have?
Six: the risk, the control, the trigger, the owner, and likelihood and impact scored from 1 to 5. Twelve rows keeps it to one page that people will actually read and revise. Scores above about 12 are worth acting on. It is worth stating in writing before production begins, because it is far harder to agree once the goods exist.
What should a small programme do first?
Apply four controls: a confirmed booking window, a written specification with a freeze, a defect list at AQL 2.5, and a compliance screen run during bulk. All four are free and take an afternoon together. The rest matter more as the programme grows. Record the figure at approval so that inspection and any later run can be measured against it.
People Also Ask
How do you manage risk when sourcing bags?
Six categories in a fixed order: capacity and schedule first, then quality, compliance, logistics, design and concentration, with twelve controls each having a trigger and an owner. It costs nothing and prevents the argument later.
What is the biggest risk in bag sourcing?
Capacity and schedule, because a slipped delivery is a missed season rather than a returned item. Confirm a booked week rather than an installed monthly figure, then apply the quality controls. That is the figure worth recording at approval.
What is a sourcing risk register?
One page with twelve rows and six columns: risk, control, trigger, owner, likelihood and impact. Score both from 1 to 5 and act on anything above about 12. Confirm it before production rather than after.
How do I reduce quality risk in bag production?
Freeze the specification in writing and attach a defect list at AQL 2.5 with tolerances. Both are free, and both turn release from an opinion into a measurement. Check the detail before the deposit is paid.
Is a second supplier worth it for a small programme?
Usually not below a few thousand pieces a year. Apply the four free controls first, then use the 100 pcs minimum to run a trial and learn before committing. Both are free to agree at the first contract.
Sources and further reading
Every figure on this page is either our own programme data or attributed below. Open the originals before you write them into a specification.
- ISO 2859-1 — Sampling procedures for inspection by attributes, Part 1: AQL-indexed sampling schemesISO The sampling plan and switching rules behind the defect list control.
- Substances restricted under REACH (Annex XVII)ECHA The screen commissioned during bulk rather than after production.
- SMETA auditSedex The audit scope that a stage placed outside the production floor would fall outside.
- amfori BSCI — business social compliance initiativeamfori The alternative social compliance route checked in the compliance category.
- OEKO-TEX STANDARD 100OEKO-TEX The certificate covering the restricted substance question across several markets.
- Incoterms rulesInternational Chamber of Commerce Defines where cost and risk pass, which sets who owns the logistics category.
Apply Four Controls, Then Grow the Rest
Risk on a knit programme is not managed by trying to cover everything. Four free controls, a confirmed booking window, a frozen specification, a defect list at AQL 2.5 and a compliance screen run during bulk, remove most of the exposure on a first order. The remaining eight matter as a programme grows, and the two that are worth doing before they are needed are the stitch file clause and the second source.
For the cost side of the same programme, see knitted bag total landed cost, and for the request that starts it, see knitted bag RFQ template. The framework is set out in the knit bag sourcing guide.