Supplier risk assessment is the structured process of identifying, scoring and mitigating risks that could prevent a supplier from meeting your commercial, quality, service or continuity requirements. A strong supplier may still carry significant risk if it is financially weak, capacity-constrained, concentrated in one site, heavily dependent on a single route, or difficult to replace.
Why Supplier Risk Assessment Matters
- Identifies vulnerabilities before they become supply disruptions.
- Supports supplier selection and sourcing decisions.
- Prioritizes due diligence and audit effort.
- Highlights single-source and concentration exposure.
- Creates clear mitigation actions, owners and review frequencies.
- Improves business continuity planning for critical suppliers.
Eight Practical Supplier Risk Dimensions
| Risk Dimension | Example Weight | What to Review |
|---|---|---|
| Financial Stability | 15% | Liquidity, profitability, credit status, overdue liabilities |
| Operational Reliability | 15% | OTIF, outages, process stability, operational controls |
| Quality Risk | 15% | Defects, NCRs, CAPA, certifications, complaint history |
| Capacity & Scalability | 10% | Utilization, bottlenecks, surge capacity, tooling and labor |
| Geographic / Country Risk | 10% | Political, infrastructure, logistics and disaster exposure |
| Compliance & ESG | 10% | Legal, sanctions, labor, environmental and ethics controls |
| Dependency / Concentration | 15% | Single-source exposure, spend concentration, substitutability |
| Business Continuity | 10% | BCP, backup site, disaster recovery and alternate transport |
The weights above are a practical starting point, not a universal standard. Critical industries may assign more weight to quality, compliance or continuity, while commodity sourcing may emphasize financial and commercial exposure.
A Simple 1–5 Supplier Risk Scale
| Score | Interpretation |
|---|---|
| 1 | Low risk; strong controls and little evidence of exposure |
| 2 | Minor risk; manageable with normal monitoring |
| 3 | Moderate risk; mitigation or closer review required |
| 4 | High risk; significant exposure and action plan required |
| 5 | Critical risk; immediate mitigation, escalation or sourcing alternative required |
Weighted Supplier Risk Formula
Weighted Risk = Risk Weight × Risk Score
Supplier Risk Index = Sum of all Weighted Risk Scores
When weights total 100% and each risk is scored from 1 to 5, the final Supplier Risk Index also falls between 1 and 5.
Example Risk Bands
| Risk Index | Band | Typical Response |
|---|---|---|
| 1.00–2.00 | Low | Annual review |
| 2.01–3.00 | Moderate | Semi-annual review and targeted mitigation |
| 3.01–4.00 | High | Quarterly review, formal action plan and contingency |
| 4.01–5.00 | Critical | Executive review, immediate mitigation and alternate-source planning |
Supplier Risk Assessment Process
- Define which suppliers are critical enough to assess in detail.
- Collect evidence from performance history, audits, financial data, certifications and supplier discussions.
- Score each risk dimension using consistent definitions.
- Apply agreed weights and calculate the overall risk index.
- Identify individual high-risk dimensions even when the total score appears acceptable.
- Create mitigation actions with owners and due dates.
- Review residual risk after mitigation.
- Repeat the assessment according to the supplier’s risk band or when major changes occur.
Risk Assessment vs Supplier Performance Scorecard
A supplier performance scorecard measures how the supplier has performed, such as delivery, quality, cost and service. A supplier risk assessment looks forward and asks what could prevent future performance. The two tools should therefore be used together rather than treated as substitutes.
Common Supplier Risk Mistakes
- Using the total score while ignoring one critical risk dimension.
- Scoring suppliers without evidence or common definitions.
- Giving every risk the same weight regardless of business criticality.
- Failing to distinguish supplier performance problems from structural supply risk.
- Ignoring sub-tier dependencies and single-site exposure.
- Completing the assessment once and never reviewing it again.
- Creating mitigation actions without owners, deadlines or residual-risk review.
Download the Practical Workbook
Use the SCMANA Supplier Risk Assessment workbook to score eight risk dimensions on a 1–5 scale, calculate a weighted Supplier Risk Index and risk band, compare multiple suppliers, and track mitigation actions and residual risk. The default weights are editable so the model can be adapted to your industry and supplier criticality.
Download the Supplier Risk Assessment Workbook (Excel)
