Definition
Supplier risk management: Supplier risk management is the practice of identifying which third parties could materially disrupt an organization, monitoring those relationships for early signs of trouble, and holding a prepared response, covering financial, operational, geographic, regulatory and information-security risk.
The mistake that makes most programs useless
The common failure is treating every supplier as a risk to be assessed. A questionnaire goes to hundreds of suppliers, responses are filed, and the programme is judged by coverage.
That produces an archive, not protection. It consumes exactly the effort that the handful of genuinely critical relationships needed, and it generates a false sense of control because the folder is full.
Risk is concentrated. The work is knowing where.
Tier on consequence, not spend
Spend is a poor proxy for risk. A large catering contract is replaceable within a quarter. A small contract holding a single-source component, a regulated licence or the system your operation runs on is not.
Three questions place a supplier:
- How fast does it hurt? Immediate, or absorbed for weeks?
- How long to replace? Including qualification, integration and regulatory approval.
- Is there an alternative at all? Sometimes the honest answer is no, and that changes the whole strategy from monitoring to mitigation.
Most organizations end with a tier one of ten to forty relationships. That is the population worth continuous attention.
The signals that arrive first
Financial statements are a lagging indicator, and for private suppliers often unavailable. Commercial behaviour moves earlier, and your own team already sees it:
- Pressure to shorten payment terms, or a request for prepayment
- Slower response times, unfilled roles, a named account manager who has gone quiet
- Quality drift, more rework, more exceptions
- Departures of people who knew your account
- Reporting that arrives late or stops arriving
- Sudden, unexplained flexibility on price
Any one is noise. Several together, in one quarter, is a supplier under strain. It usually shows up in a service review months before it shows up in accounts.
The practical step is to make those observations reportable. The people who see them first are in operations, not procurement.
Concentration is the risk most registers miss
Single-supplier dependency is easy to see. The harder concentrations:
Site concentration. Several products from one supplier, all made in one plant.
Geographic concentration. Different suppliers, same region, same weather, same politics, same port.
Tier-two concentration. Your three suppliers all buying from the same sub-supplier. Invisible unless you ask, and the reason a diversified base can still fail all at once.
Knowledge concentration. One person at one supplier who understands your configuration.
Mapping the second tier for tier-one suppliers is uncomfortable, occasionally resisted, and the highest-value question in this discipline.
Decide the response before you need it
A risk register that records exposure without a response is a document. For every tier-one supplier, someone should be able to answer: what do we do if this stops on Monday?
That means a named alternative where one exists, a known qualification lead time, a view on what inventory or dual-sourcing buys, and the contractual rights that were either negotiated or were not: step-in, source-code escrow, data extraction, transition assistance.
Those rights are cheap to obtain during a negotiation and impossible to obtain during a failure.
What good looks like
A register of tier-one suppliers by consequence rather than spend, with a named owner each. Early-warning signals visible to the people who see them first. Second-tier concentration mapped where it matters. Contractual protections in place for the relationships that warrant them. And a governance forum where procurement, security, legal and the business look at the same list.
Not a questionnaire. A short list, watched properly.
Related
- Spend Analysis: S2V Compass
- Procurement Transformation: S2V Blueprint
- Value Tracking: S2V Pulse
- Facilities & Janitorial Services
- IT Infrastructure & VAR Agreements
- Logistics & Freight
Free downloads
Tools you can use on this, today
The working versions of what is described above: scorecards, checklists and spreadsheets from real engagements. No cost, no sales sequence.
Frequently asked questions
What is supplier risk management?
It is identifying which suppliers could materially disrupt your organization, monitoring those relationships for early warning, and holding a prepared response. It covers financial distress, operational failure, geographic and geopolitical concentration, regulatory and compliance exposure, and information security.
How do you decide which suppliers to monitor?
By consequence, not by spend. Tier on what happens if the supplier stops: how quickly it would hurt, how long replacement would take, and whether an alternative exists at all. A small contract holding a single-source component or a system of record can outrank a large but easily replaced one.
What are the earliest signs a supplier is in trouble?
Commercial behaviour usually changes before the financials are published. Pressure to shorten payment terms or take prepayment, slower response and unfilled roles, quality drift and rising rework, key people leaving, delayed reporting, and sudden willingness to concede on price. Any one is noise; three together is a signal.
What is concentration risk?
Exposure that is structural rather than supplier-specific. Too much depending on one supplier, one site, one region or one trade bloc. It is the most common vulnerability we find, and it is often invisible because the concentration sits one tier down, where several of your suppliers use the same sub-supplier.
How often should suppliers be reviewed?
Tier one continuously, with named triggers rather than a calendar. Tier two on a quarterly or half-yearly rhythm. Everything else at renewal. Annual reviews across the whole base consume the effort that the critical relationships needed and tend to produce a document rather than a decision.
Who should own supplier risk?
Procurement, security, legal and the business each hold part of it, which is why it fails when nobody owns the whole. One governance forum, one register, named owners per critical supplier, and an escalation route that works without a meeting.