Procurement teams that rely on gut instinct to assess supplier risk are playing roulette with their supply chain. The alternative — a 40-page risk assessment framework with 100+ questions — is equally problematic: nobody fills it out, and when they do, the data is stale before the ink dries.
The P×I (Probability × Impact) method sits in the sweet spot: structured enough to produce objective, comparable scores across suppliers, yet simple enough that you can assess a vendor in under 10 minutes. It is the framework Fortune 500 procurement leaders default to when they need a fast, defensible risk picture.
What the P×I method does
At its core, P×I scoring asks two questions about each risk category:
- What is the probability this risk will materialize? Is it a remote possibility or something that has already happened to similar suppliers?
- If it does happen, how bad would the impact be? Would it be a minor inconvenience or a production-halting catastrophe?
Multiply the two scores together and you get a single number from 1 to 16 — a risk score that is directly comparable across suppliers, categories, and time periods. No weighted formulas, no subjective ranking arguments, no analysis paralysis.
The elegance of P×I is that it forces separation. A high-probability, low-impact risk (like minor delivery delays) scores differently from a low-probability, high-impact risk (like supplier bankruptcy). Both matter — but for different reasons.
How to score probability (1–4)
Assign a probability score based on the likelihood the risk event will occur within the next 12 months:
- 1 — Remote: Less than 10% chance. The risk has not materialized in your industry or with this supplier in the past 5 years.
- 2 — Unlikely: 10–30% chance. Isolated incidents have occurred in the broader market but not with this specific supplier.
- 3 — Likely: 30–60% chance. This supplier or similar suppliers have experienced this risk in the past 2 years. Warning signs are present.
- 4 — Almost Certain: Above 60% chance. The risk is actively materializing — the supplier has missed payments, received regulatory notices, or operates in an active conflict zone.
The key to probability scoring is using evidence, not intuition. Check the supplier's Dun & Bradstreet report, review their on-time delivery history in your ERP, scan news alerts for their parent company, and ask your account manager directly about capacity and staffing. The more data points you reference, the more defensible your score.
How to score impact (1–4)
Assign an impact score based on the consequences if the risk materializes:
- 1 — Negligible: No disruption to operations. Minor cost increase (<2%) or delay (<1 day) that can be absorbed.
- 2 — Moderate: Noticeable but manageable disruption. Requires reallocation of resources, 1–5 day delay, or 2–5% cost increase.
- 3 — Major: Significant disruption to a product line or region. 1–4 week delay, 5–15% cost increase, or regulatory fines. Would require executive attention.
- 4 — Critical: Potential to halt operations, breach customer contracts, or cause reputational damage. 4+ week delay, >15% cost increase, or legal liability.
Impact scoring must account for supplier criticality. A sole-source supplier of a patented component with zero alternatives scores higher impact than a commodity supplier with three qualified backups, even if the risk event is identical.
The 5 risk categories
Score each supplier across all five categories to build a complete risk profile:
Financial risk
Measures the supplier's ability to remain solvent and deliver on their commitments. Look at credit ratings, debt-to-equity ratios, revenue concentration (any single customer >30% of revenue is a red flag), and payment history. A supplier with declining revenue for three consecutive quarters scores at least P=3.
Operational risk
Measures the supplier's ability to produce and deliver consistently. Evaluate on-time delivery percentage, quality defect rates, capacity utilization, and equipment age. A supplier running above 90% capacity with no expansion plans scores P=3 — one demand spike and they cannot deliver.
Geopolitical risk
Measures external threats from the supplier's location. Consider trade restrictions, tariffs, political stability, natural disaster frequency, and shipping route dependencies. A supplier with a single facility in a flood-prone region on a contested trade route scores P=4.
Compliance risk
Measures regulatory and standards compliance. Check ISO certifications, industry-specific accreditations, environmental permits, and labor practice audits. A lapsed certification is an automatic P=3 — the clock is already ticking on a possible shutdown.
Cyber risk
Measures data and systems security. Assess breach history, security certifications (SOC 2, ISO 27001), data handling policies, and third-party penetration test results. A supplier that handles your IP without multi-factor authentication in place scores P=3 minimum.
Reading the heat map
Plot each supplier on a 5×5 grid where the x-axis is Probability (1–4) and the y-axis is Impact (1–4). Color-code the cells:
- Green (1–3): Low risk. Monitor annually. Standard supplier management processes apply.
- Yellow (4–8): Medium risk. Reassess every 6 months. Begin documenting mitigation options.
- Orange (9–12): High risk. Reassess quarterly. Active mitigation plan required with monthly progress reviews.
- Red (13–16): Critical. Reassess monthly. Escalate to leadership. Begin dual-sourcing or replacement planning immediately.
A single supplier can appear in multiple zones across different categories. The heat map makes this instantly visible — a supplier with green financial risk but red geopolitical risk tells a very different story than one that is yellow across the board. Both total score and category-level scores matter.
From scores to action: mitigation strategies
Scoring is only valuable if it drives decisions. Map each risk zone to a standard mitigation playbook:
- Red-zone risks: Dual-sourcing or supplier replacement is the priority. In the short term, increase safety stock, negotiate penalty clauses, and conduct quarterly on-site audits. Assign a senior procurement manager as the single point of accountability.
- Orange-zone risks: Qualify at least one backup supplier. Increase monitoring frequency. Negotiate improved contract terms including force majeure protections and minimum service level guarantees.
- Yellow-zone risks: Document mitigation options without committing resources. Include the supplier in your quarterly business review cadence. Monitor for score changes that could push them into orange.
- Green-zone risks: Annual reassessment is sufficient. Focus procurement energy on relationship building and cost optimization — these suppliers are your stable base.
The goal is not to eliminate all risk — that is impossible and uneconomical. The goal is to know which suppliers need your attention right now, and to have a plan for the ones that might need it soon.