What Should a Supplier Risk Assessment Actually Cover?
Most businesses have some form of process for assessing and approving suppliers.
There might be a questionnaire, a request for insurance certificates, financial checks, quality accreditations or evidence of compliance.
All perfectly reasonable things to do.
But I’ve always felt there’s a much more important question that needs answering first.
What would happen to our business if this supplier couldn’t deliver what we needed?
Because a supplier can pass every approval check and still represent a significant risk to your business.
And equally, a supplier that doesn’t have an impressive collection of accreditations might be perfectly capable of providing what you need.
The challenge is understanding the difference.
Start with what you’re buying, not just who you’re buying from
One of the first things I’d want to understand is the nature of the product or service being supplied.
Is it a standard consumable that can be purchased from several alternative sources?
Or is it a specialist component, material, process or subcontracted service that would be difficult to replace?
The answer makes a considerable difference.
Imagine a manufacturer spending £250,000 annually with a supplier of readily available consumables.
Now compare that with a supplier receiving £25,000 annually but providing a specialist component that’s critical to production.
If that second supplier stopped delivering tomorrow, how quickly could the business recover?
Would another supplier be able to produce the component? Would tooling need transferring? Would the alternative need testing or customer approval? How long would that take?
The business might have considerably more exposure through the smaller supplier, despite spending a fraction of the money.
That’s why I don’t believe supplier risk assessment should begin and end with annual spend.
You need to understand business criticality and dependency alongside the commercial relationship.
What risks should we actually be assessing?
There isn’t one assessment that works equally well for every supplier.
However, there are several areas I’d expect a business to consider.
Financial stability
Is there evidence that the supplier is experiencing financial difficulties? How dependent are they on a small number of customers, and could that affect continuity?
Capacity and operational capability
Can the supplier consistently meet demand? Do they have the people, equipment, systems and resources required? What happens if your requirements increase?
Quality and delivery performance
Are they delivering what was agreed, when it was agreed? Are problems recurring? More importantly, are the causes understood and being addressed?
Compliance and assurance
Are the necessary legal, contractual, regulatory, quality and safety requirements being met? The evidence needed will depend on the product, service and operating environment.
Business continuity and external exposure
Could geographical concentration, logistics, cybersecurity issues, raw-material shortages or disruption elsewhere in their supply chain affect delivery?
The point isn’t to ask every supplier hundreds of questions.
It’s to understand which risks are relevant, what evidence is proportionate and what needs managing.
Understanding dependencies is just as important
Supplier assessment often concentrates on the supplier itself.
But some of the biggest risks can sit within the relationship between the supplier and your business.
For example:
- Are they the only approved supplier?
- Do you own the tooling or intellectual property required to manufacture the product?
- How long would it take to qualify an alternative?
- Are several apparently different suppliers dependent on the same subcontractor or material?
- Is your business becoming increasingly dependent on a particular supplier’s specialist knowledge?
- What would disruption mean for production, customers, costs and cash?
These are operational and commercial questions, not simply compliance questions.
And they’re fundamental to building Supply Chain Resilience.
Not every supplier needs the same level of assurance
This is an area where I think businesses can make life unnecessarily difficult for themselves.
If every supplier receives exactly the same assessment, regardless of what they’re supplying or the risk involved, the process can become burdensome.
It creates work for the business and for suppliers, sometimes without providing much additional assurance.
A more useful approach is to establish the nature of the supply, its importance to the business and the relevant risks.
That can then inform the level of assessment, evidence, approval and ongoing review required.
A small local supplier shouldn’t automatically face the same administrative demands as a much larger organisation simply because that’s what the standard questionnaire says.
But where legal, safety or other mandatory requirements apply, those still need to be satisfied.
The aim is to make assurance proportionate, not to reduce standards.
Approval is only the beginning
We explored this in our earlier article, You Approved the Supplier. But Are They Still the Right Supplier?
A supplier can be financially healthy, capable and performing well when they’re first approved.
Twelve months later, the situation might look very different.
Demand may have increased. Key employees may have left. Financial pressures may have developed. A subcontractor may have failed. Your own business requirements might have changed.
This is why I see Supplier Assurance as an ongoing management responsibility.
A meaningful approach should consider:
- Which suppliers need regular performance reviews?
- What information would tell us that risk is changing?
- Who is responsible for managing the relationship?
- When should an issue be escalated?
- What action should follow when performance starts deteriorating?
- How often should the original assessment be revisited?
And that doesn’t necessarily mean introducing another layer of complicated administration.
Sometimes it means having better conversations, clearer expectations and reliable information about what’s actually happening.
Supplier performance is a two-way responsibility
Over the years I’ve spent in procurement, I’ve seen businesses devote enormous amounts of time to dealing with supplier problems.
- Late deliveries
- Quality issues
- Increasing costs
- Relationships becoming strained.
The usual response is to get everyone involved, resolve the immediate problem and move on.
But sometimes the underlying cause isn’t entirely within the supplier’s control.
- Requirements change without enough warning.
- Forecasts are unreliable
- Specifications are unclear
- Decisions take too long
- Commercial expectations aren’t properly understood.
It’s important to assess suppliers fairly and recognise the role our own business plays in the relationship.
I’ve always believed that good procurement should give suppliers every reasonable opportunity to succeed, while still holding them accountable for agreed performance.
That requires ongoing engagement, not simply a scorecard showing what went wrong last month.
Making supplier information useful
Most businesses already hold a significant amount of information about suppliers.
Purchase orders, delivery records, quality issues, financial information, contracts, correspondence and spreadsheets.
The difficulty is often bringing that information together so that someone can see where attention is needed.
For example, wouldn’t it be useful to know when a critical supplier’s delivery performance is deteriorating, rather than discovering the extent of the problem after production has been affected?
Or to identify where several important products rely on the same supplier or process?
This is where procurement knowledge and Business Intelligence can work together.
Not simply by producing another dashboard, but by establishing which questions matter, what information is available and how it can support better decisions.
Good reporting should help people understand what is changing, why it matters and where action may be needed.
Where should an SME start?
For a growing manufacturer, the starting point doesn’t need to be a large transformation programme or new technology.
I’d begin with some straightforward questions:
- Do we know which suppliers, materials and services are genuinely critical?
- Do we understand our biggest supply dependencies?
- Are our supplier assessments proportionate to the risks involved?
- Do we have meaningful performance information and clear relationship ownership?
- Would we recognise a developing problem early enough to do something about it?
If those questions are difficult to answer, there’s probably an opportunity to strengthen the approach.
And that is really what Supply Chain Resilience is about.
Not eliminating every possible risk, because that isn’t realistic.
It’s understanding where the business is exposed, making informed choices and being better prepared when circumstances change.
See the Whole Picture
At Alliance Procurement Solutions, we help UK businesses understand supplier risks, dependencies and performance, and develop practical approaches to Supplier Assurance and Supply Chain Resilience.
Our Supply Chain Resilience Discovery provides a focused starting point to understand where the business is exposed, where existing arrangements could be strengthened and what action should be prioritised.
You don’t need to know all the answers before starting that conversation.