Identify risks → Analyze probability and impact → Evaluate overall exposure → Mitigate with action plans. This structured approach ensures no risk category is overlooked and each supplier is assessed consistently.
Step 1 — Identify
List every supplier you depend on. Start with strategic suppliers — sole-source, high-spend, or critical-path. A surprising number of procurement teams cannot name their top 10 riskiest suppliers on demand. For each supplier, map which risk categories apply — not every supplier warrants all five assessments.
Step 2 — Analyze
Score each risk category on two axes. Probability: 1 = Remote (<5% chance in 12 months), 2 = Unlikely (5-20%), 3 = Likely (20-50%), 4 = Almost Certain (>50%). Impact: 1 = Negligible (minor inconvenience), 2 = Moderate (recoverable within 1 week), 3 = Major (1-4 weeks disruption), 4 = Critical (production halt, no immediate alternative). Use real data where available — financial statements for financial risk, quality reports for operational risk, geopolitical indices for geographic exposure. Where data is thin, use structured expert judgment but document assumptions.
Step 3 — Evaluate
Multiply P × I for each category. Score 1-3 is Low risk (monitor periodically). 4-8 is Medium (review quarterly). 9-12 is High — mitigation plan required within 30 days. 13-16 is Critical — escalate immediately, contingency plan mandatory. The total score across categories gives a ranked risk register — tackle the highest total first.
Step 4 — Mitigate
For every High or Critical risk, document a specific mitigation action with owner and deadline. Strategies include: dual-sourcing qualification, safety stock buffers (calculate buffer: lead time variability × daily demand × service level factor), contract terms (force majeure, penalty clauses, right-to-audit), insurance, or supplier development programs. Reassess quarterly — risk is dynamic. A supplier that was green last quarter can turn red overnight.