Core topic · scoring, credit, sanctions
Supplier risk does not grow suddenly. It only becomes visible suddenly.
Late payments, a change of ownership, an entry on a sanctions list, a lapsed certificate: the signs are there before the damage is. You need someone or something that looks.
Supplier risk management assesses what damage a supplier’s failure or misconduct would cause, how likely that is, and what is being done about it. Unlike general risk management, the observation boundary sits outside the company.
Three layers run in parallel: criticality, meaning how heavily a failure weighs; reliability, readable from delivery performance and complaints; and integrity, meaning credit standing, ownership and sanctions exposure. Looking at only one of them reliably misses the others.
The signals that matter
- A cluster of late deliveries from one supplier within a few months.
- Deteriorating payment behaviour or credit rating.
- Change of ownership or control, particularly across borders.
- A hit on a sanctions or watch list, beneficial owners included.
- A withdrawn or expired certification with no replacement evidence.
The structure
- Criticality
- Impact of failure and replaceability set the class – not order value.
- Scoring
- One set of criteria and one scale, so results stay comparable.
- Screening
- Checks against sanctions and watch lists, recorded with date and result.
- Action
- Second source, contract clause, condition or a consciously carried risk – recorded with reasoning.
- Recurrence
- Fixed cycles per class so assessment does not quietly stop.
How SCRM covers it
Risk classes with rules
Defined once, then applied automatically and defensibly.
Scoring history
A trend rather than a snapshot – deterioration stands out.
Incidents on the record
Complaints and disruptions sit where the assessment needs them.
Due reviews
What is coming up appears as a task, not an intention.
Frequently asked
How many risk classes make sense?
Three or four. More classes raise upkeep without improving the decision – grade too finely and you end up debating classifications instead of actions.
Must every supplier be screened?
No. Screening at onboarding and thereafter on a risk basis is sensible. What matters is that the rule is defined and followed – arbitrary practice is harder to defend in an audit than a deliberately narrow one.
How is this different from supplier evaluation?
Evaluation measures past performance. Risk management estimates future vulnerability. Both belong on one record, otherwise the results contradict each other.