This is one of those situations where you would need to find the balance between your quality management plan and your risk management plan. You need to satisfy your quality requirements first and then you need to assess the risk regarding the changes you’ve made. If you really thought about the risk involved in having a critical component and its back up sourced by the same supplier then you may start to think of all the things that can go wrong at the facility like smk45 mentioned, natural disasters and sub-supplier failures. You would have to base your management of these risks on their severity and frequency. Earthquakes, fires, tornados, and catastrophic disasters in general are very rare in occurrence but high in severity while sub-supplier failures are minor in severity and infrequent in occurrence. Just as Davos Neuro had to select at least two sources for a critical component based on their quality program, the supplier (if they are intelligently managing quality and risk) would ideally have alternative sourcing for their critical components, and noncritical components can be readily sourced. Thinking this way further reduces the risk in selecting a single supplier to source your critical component and its back up.