Supplier risk mitigation: corrective action plan and example
Give each supplier-risk finding an owner, an action plan, and evidence of closure, with a worked capacity example and a reusable template.
A supplier assessment finds that the only qualified source for a valve body can deliver 60 accepted units a week. Your production plan needs 100. The supplier proposes a second shift, but the equipment and inspection capacity for that shift have not been confirmed.
The assessment has identified a risk. Procurement, quality, and operations now need a shared plan for protecting deliveries and resolving the shortfall. The same workflow applies whether the underlying risk is capacity, financial, ownership, or quality; it isn't only a formal corrective action tied to a nonconformance.
What is a supplier corrective action plan?
A supplier corrective action plan gives an identified risk one accountable owner, a set of actions with their own owners, completion targets, dependencies, and measurable evidence of completion, and a review cadence against the original assumptions. It closes when the evidence meets its acceptance criteria and any remaining risk has an owner.
EO 14415 directs the same sequence for defense suppliers: timely mitigation, tracking through closure, notification within 15 days of completed vetting, a corrective action plan within 45 days, and a closeout report once that plan is complete. EO 14415, Section 3(c). The workflow below shows how a team can organize that work, using a fictional example with illustrative internal targets.
Write a finding that supports a decision
“Supplier capacity risk” leaves too much for the next person to interpret; it names a category without saying what happened or what it means for the build. A useful finding identifies the item, the source, the evidence behind the number, and the consequence for the delivery schedule if nothing changes.
For the valve body, record:
The only qualified source for V-430 revision D demonstrated 60 accepted units per week against planned demand of 100. The 40-unit weekly shortfall would consume the current 160-unit usable buffer in four weeks if demand and output remain constant. A second shift is proposed; its staffing, machine availability, and inspection throughput remain unverified.
This statement gives the team a calculation it can challenge and assumptions it can monitor. It also separates demonstrated output from proposed capacity. If usable inventory falls or demand rises, the available response time changes.
Attach the supporting capacity review, acceptance records, inventory snapshot, and demand plan. Record their dates and the relevant production facility. A company-wide capacity presentation may not describe the line that makes the affected item.
Assign responsibility for the decision and the work
Give the risk one accountable internal owner, even though individual actions can have different owners. A buyer can secure material, an engineer can define a qualification test, and supplier quality can verify accepted output, but one person still needs to see the whole finding through to a decision.
The accountable owner needs authority to coordinate those actions or a defined route to someone who does. Record the program decision that is at stake, such as preserving the next delivery lot, authorizing qualification spend, or changing the production sequence.
Choose a risk rating using the program's approved method and explain it. A rating should reflect the likelihood and consequence for this program, including time to impact and the reliability of the evidence. Record who reviewed the rating and when it will be reassessed.
The SCRM Plan data item description referenced by the order, DI-MGMT-82256A, addresses identification, assessment, handling, and monitoring. It calls for defined handling activities, success criteria, and residual-risk assessment. Its broader plan requirements should be checked against the applicable contract data requirements. DI-MGMT-82256A, Sections 3.4(e)–(h). Where the material source itself is unresolved, pair this workflow with raw material traceability.
Build a plan with observable results
For each action, specify the owner, a completion target, any dependency on another action, and the evidence required to verify the result once it's done. Make the acceptance condition measurable enough that a reviewer, not just the person doing the work, can determine whether the action is actually complete.
| Action in the valve-body example | Owner | Internal target | Evidence of completion |
|---|---|---|---|
| Confirm usable inventory, demand, and committed shipments | Materials planner | Day 2 | Reconciled inventory and time-phased supply plan |
| Validate the proposed second shift | Supplier operations lead, coordinated by the buyer | Day 5 | Staffing, machine, material, and inspection plan |
| Demonstrate sustained recovery to required output | Supplier quality engineer | Day 20 | Two consecutive production weeks with at least 100 accepted units each |
| Establish an alternative-source option | Engineering lead | Day 10 for the plan | Approved test scope, budget, approval path, and achievable schedule |
These targets are management choices for the example. They do not replace a contractual reporting or delivery deadline. When the alternative-source option becomes a standing second source rather than a one-time recovery, dual sourcing covers qualifying it and setting a volume split.
Away from this example, the same seven columns work for any supplier-risk finding, whatever category produced it:
| Risk | Action | Owner | Dependency | Acceptance evidence | Due date | Residual risk |
|---|---|---|---|---|---|---|
| (Example) Sole-source capacity shortfall, V-430 valve body revision D | Demonstrate sustained output at the required rate | Supplier quality engineer | Confirmed second-shift staffing, machine, and inspection plan | Two consecutive weeks at or above 100 accepted units | Day 20 | Single-source concentration remains; qualification plan needed |
Where an action depends on the supplier's own commitment, such as confirming the second shift, your team can open it as a task and hand it to Scout Agent, who follows up with the supplier by email and phone, within the permissions your team sets.
The immediate supply plan and the longer qualification effort should remain connected. A temporary buffer may protect the next shipment while leaving the sole-source dependency unresolved; see expediting for that near-term recovery. Record both the short-term effect and the risk that remains.
Keep reporting dates tied to their trigger
Reporting dates run from when supplier vetting completes, not from when a buyer opens a task or a plan gets written. Section 3(c) directs the agency to write that sequence into its regulations: notification within 15 days, a corrective action plan within 45 days, and a closeout report once the plan is done.
| Trigger | Directed reporting requirement |
|---|---|
| Completion of supplier vetting | Notify the department of significant risks within 15 days. |
| The same completion of supplier vetting | Submit a confidential written corrective action plan within 45 days, including implemented mitigations and a strict completion timeline. |
| Completion of the corrective action plan | Submit a closeout report. |
The 45-day clock runs from completed vetting, rather than from the 15-day notification. The order also directs timely mitigation; the reporting interval is not an instruction to wait before acting. EO 14415, Section 3(c)(i)–(v).
For a particular program, have the contract owner establish which requirements apply, the recognized vetting-completion event, the recipient, and the submission method. Store the triggering record and the resulting due dates with the risk. If the program has an earlier notification requirement, the team still needs to meet it.
Record the vetting-completion event separately from internal action targets. A buyer's task date should never silently replace a reporting obligation.
Review progress against the original assumptions
At each review, compare demonstrated output with the recovery plan, confirm the remaining buffer, and check which actions are due before the next review. Keep an explicit record of any assumption that changed since the finding was written, since a stale assumption can make a plan look on track when it isn't.
If the supplier reaches 100 units in one exceptional week, the team should check whether it can sustain that rate with normal staffing, material availability, and inspection. If the second shift consumes the same constrained material or uses the same unavailable equipment, it may not address the original cause.
When an action slips, capture the consequence and a revised decision. A new due date without an explanation hides the effect on the delivery plan. Escalate when the projected recovery falls beyond the buffer or a critical dependency loses its owner, funding, or approval.
Close the plan with evidence and a remaining-risk decision
In the fictional example, two consecutive weeks of 104 and 108 accepted units satisfy the team's output criterion. The planner confirms no missed program deliveries, and supplier quality attaches the acceptance records. The program owner reviews those results and the remaining single-source dependency.
That can support closure of the capacity-recovery plan if its agreed criteria are met. The remaining concentration risk should have an explicit owner and disposition, such as a separate qualification plan and continued capacity monitoring. Closure should identify what was resolved and what remains under management.
When the plan changes, record the revised commitment and its consequence for deliveries. At closure, keep the acceptance records and the reviewer's decision alongside the completed actions. A promise to add a second shift remains distinct from the production records showing that it delivered the required output, and your contract owner remains responsible for the reporting requirements and submissions themselves.
If your team needs a consistent way to track supplier-risk findings to closure, talk to our team.
This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.