How it Works: Supplier Risk Assessment

A supplier risk assessment is a structured process for identifying, scoring, and managing threats that could disrupt supply. Procurement teams use it before selecting a supplier and throughout the supplier lifecycle. The assessment considers operating location, external exposure, material criticality, and risk controls. Its purpose is not to eliminate every risk. It is to help you make sourcing decisions that fit your organization’s risk appetite.

In this guide, you will learn how to:

• Screen suppliers before you award a contract.
• Weight risks according to their likely business impact.
• Identify materials that require stronger contingency plans.
• Monitor changes in supplier risk over time.

Figure 1: To strengthen supply chain resilience, supplier risk scoring should be an integral part of the selection process, and continuous monitoring should occur over the supplier lifecycle.

What is a supplier risk assessment?

A supplier risk assessment helps you understand whether a supplier can reliably support your business. It evaluates the threats associated with the supplier, the material supplied, and the supplier’s operating environment. It also considers the steps the supplier takes to reduce those threats.

A useful assessment looks beyond price, capacity, and quality. It also asks whether a disruption could affect your ability to manufacture, serve customers, or meet your own compliance obligations.

The goal is not to remove every supplier with some exposure to risk. No supplier relationship is entirely risk-free. Instead, the goal is to identify the risks you can accept, the risks you can mitigate, and the risks that require a different sourcing decision.

Risk appetite is the amount and type of risk your organization is prepared to accept while pursuing its business objectives.

Why assess supplier risk before you select a supplier?

Choosing a new supplier for your business can be a critical decision. Your suppliers play a central role in your organization’s success.

As a result, the supplier selection process is rigorous. From the early stages of defining requirements to market research, requests for information and quotes, through to evaluating suppliers, shortlisting, and negotiation, companies carefully consider all their options.

As part of due diligence, companies will review a supplier’s reliability, operational capabilities, financial health, and so forth. Companies do this to mitigate potential risk and ensure a mutually beneficial partnership.

Assessing supplier risk during selection

Supply chains face a wide range of risks, and any one of them could seriously affect both a supplier and your organization. Modern supply networks are closely connected, so disruption at one point can quickly create consequences elsewhere.

If a supplier lacks effective systems and procedures to identify and reduce risks before they escalate, your business may eventually experience the impact.

Even before engaging directly with a potential supplier, you can assess risk exposure across several areas during the initial vendor assessment stage. These may include:

• Natural disaster and climate risk: Earthquakes, floods, hurricanes, tropical cyclones, and water-related risk.
• Socio-political and geopolitical risk: War, civil unrest, terrorism, law-enforcement activity, and strikes.
• Sustainability and ethical risk: Child labor, workers’ rights concerns, and corruption.
• Logistics risk: Customs delays and disruptions affecting sea, road, rail, or air transport.
• Tax, economic, and legal risk: Tax inconsistency, inflation, sovereign default, expropriation, contract enforcement, and so forth.

These risk ratings are based on the supplier’s production location or wider operating region. You therefore need to know where the supplier intends to manufacture the parts or products it will provide. Make this information a mandatory field in initial bids and supplier-information requests.

By using these ratings early, you can identify potential concerns sooner and establish clear thresholds for suppliers that do not meet your requirements.

This approach also makes the bidding process more efficient for evaluation teams. With relevant, actionable data available from the outset, they are less likely to select an unsuitable supplier.

What is Everstream Analytics Risk Assessment?

Everstream Analytics Risk Assessment delivers automated, location-based strategic risk scoring that empowers procurement teams to develop risk-informed sourcing decisions. This helps you build supply chain resilience into the supplier selection process.

The solution offers more than 40 automated scores to evaluate external risks. Our scorecards assess risks such as weather and natural disasters, political violence, ESG and sustainability issues, operational risks, and so forth.

The scores are based on proprietary data as well as trusted sources that include S&P Global, Transparency International, Munich Re and others.

Think of this as strategic risk intelligence. In other words, the supplier has certain vulnerabilities that could cause supply chain disruptions at a later stage.

Weighting the risks

Not all companies are concerned about the same risks. This is where risk weighting comes into play.

External risks are weighted according to your priorities. This weighting helps create the supplier scorecard.

Take for example a supplier based in an area prone to earthquakes. The supplier has invested in an earthquake-proof building.

If you source industrial machine parts from this supplier, the earthquake-proof building should be enough to outweigh the risk this location poses. Therefore, you would weight earthquake-related disruptions as a lower priority for your company.

However, if you source semiconductors or specialty glass, even minor tremors can cause serious issues. Therefore, you would weight earthquakes and tremors as a high-priority risk.

Once you have weighted the risks according to your priorities, the supplier scorecard is ready.

This is a number between 1 and 25, where 1 represents a low level of risk, and 25 is a very high level of risk.

This numerical value makes it easy to understand supplier risk across multiple dimensions.

You can use this to set “no go” thresholds and remove highly risky suppliers from consideration.

Supplier risk assessment after onboarding

The ideal time to assess supplier risk is before awarding a contract. But if you have not done this, you can still assess your existing suppliers to see which ones pose the greatest threats to your operations.

If you have internal supplier performance metrics, such as on-time delivery, product quality, relationship strength, and so forth, these can be included in the supplier scorecard.

Some companies include spend in this analysis. However, a more effective approach is to assess material criticality based on the specific materials or parts each supplier provides. This shifts the risk review from the supplier as a whole to the importance of the item itself.

From a risk standpoint, four factors determine how critical a part is to production:

• Substitutability: How easily can the part be replaced with an alternative.
• Tool replacement lead time: How long is the replacement time for the necessary tools.
• Availability of alternative suppliers: How many other qualified suppliers can provide the same part.
• Supply chain complexity: How complex and vulnerable the end-to-end supply chain is for the material.

A material becomes more critical when it is difficult to substitute, requires lengthy tool-replacement times, has few alternative sources, or depends on a complicated supply network.

Impact assessment

Should you realize that an existing supplier falls outside your risk appetite, you need to answer a very important question: What would be the impact on your business if this high risk supplier failed?

Once you know that, you will need to consider your options.

• Can you work with your supplier to reduce risk?
• Do you need to dual source this material?
• Should you look for an alternative supplier?

There is no right answer here. Your company may decide that certain risks, such as child labor or forced labor, are so unacceptable that finding an alternative supplier is the only course of action.

Depending on your relationship with the supplier, you may or may not have enough leverage to enforce risk mitigation strategies.

Sometimes you may decide that you will need to accept the risk. This could be because the supplier offers the best quality product at the lowest price per unit or that there are no viable alternative suppliers. In this case, it would be wise to continuously monitor this supplier – and potentially its sub-tier suppliers – for disruptive incidents.

If something does go wrong, an early warning means you are better placed to respond and reduce the impact on your operations.

Why supplier risk assessment needs location risk scores

Supplier risks are not static. Because of this risk scores are assessed and updated regularly. Furthermore, the location assessment varies from as little as 500 meters to countrywide. This is because some risks vary depending on the location of your supplier.

Some countries have higher incidents of earthquakes than others. Countries have different levels of corruption or violent crime. Tax regulations, transportation infrastructure, and the likelihood of tropical storms differ from country to country.

Certain risks are not just at the country level, but regional. For example, you are more likely to get tsunamis than tornadoes in Alaska. Snow is very unlikely at sea level in Australia, but common on highland areas.

Then there are also risks specific to a facility’s location. For example, is the supplier’s manufacturing facility close to a river that floods often?

Everstream Analytics alerts you when a risk score changes. If you see a risk score rising over time, this gives you a clear indication that a disruption is increasingly likely. As a result, you have time to create contingency plans or enact measures to protect your supply network before a potential risk becomes an operational problem.

See Everstream Analytics in action

If you would like to see how Everstream Analytics can help you assess your suppliers for risk, please contact us for a personalized demonstration.