Supplier risk assessment: assess the part, site and build exposure
Build a supplier risk assessment around critical parts, verified evidence, refresh triggers and dated mitigation actions.
What is a supplier risk assessment?
A supplier risk assessment identifies what could prevent a supplier from delivering a specific part, how that failure would affect your build, and what action reduces the exposure. It combines supplier evidence with your own dependency: qualified alternatives, usable inventory, recovery time, and the date production would first be affected.
The outcome is a purchasing decision you can explain. You know which part needs another source, which supplier needs closer monitoring, and which evidence is still missing. A completed questionnaire helps only when somebody uses its answers to protect a build. This lesson belongs to Resilience: keeping supply risks from becoming production shortages.
When should you assess supplier risk?
Assess risk before awarding a critical part, when demand or the supplier changes, and whenever operating signals suggest the existing assessment is stale. Start with parts that can stop a build. A routine review remains useful, but an annual questionnaire cannot explain an ownership change or a new credit hold that appeared yesterday.
Define criticality using the bill of materials and the production plan. Ask whether the part has a qualified substitute, whether customer approval is required for a source change, and how long that approval takes. Include processes your direct supplier buys elsewhere. A machined part may depend on one outside heat-treatment facility even when several machine shops can make it.
Choose a review cadence your team can sustain. For a part with no qualified alternative and little inventory, review delivery signals each week and revisit the assessment after a material change. For an interchangeable item with several approved sources, a less frequent review may be sufficient. These are suggested operating choices, not mandated review intervals.
Why should you assess risk by part and site?
Supplier health and your exposure answer different questions. A financially sound business can make your only qualified casting at one vulnerable site. A troubled supplier can also supply an interchangeable fastener you can replace quickly. Record the supplier, manufacturing site, part, and affected build together before assigning a risk rating or mitigation.
Avoid copying one supplier score across every purchased item. Separate company-wide concerns from part-specific consequences. Financial distress may affect the whole business; a furnace outage affects the parts using that furnace. A change of ownership may require a compliance review; a customer-directed source may prevent you from moving the work without approval.
The following example shows the distinction. Both parts come from the same fictional supplier. There are no measured probabilities, industry benchmarks, or implied universal thresholds.
One supplier, two different build exposures
Illustrative comparison of two parts supplied by the same fictional business. An interchangeable bracket has another approved source and stocked protection, while a casting has no qualified alternative and depends on a single foundry. The different actions follow from the part and build dependency rather than a company-wide supplier score.
| Part | Dependency | Available protection | Action |
|---|---|---|---|
| Interchangeable bracket | Several approved sources | Usable stock and an approved source with confirmed availability | Monitor commitments and preserve the alternate |
| Custom casting | One qualified foundry | No qualified substitute; check usable stock against builds | Assign qualification and interim protection actions |
Illustrative example: assess the dependency behind each part, even when the supplier is the same.
Keep the dependency visible even when the supplier's overall score improves. More cash does not create another qualified casting source. The appropriate action may still be dual sourcing, while a delivery problem on the interchangeable part needs a smaller intervention.
What evidence should you collect?
Collect evidence that answers a decision, rather than sending every supplier the same long form. For critical parts, cover financial continuity, ownership, demonstrated capacity, upstream dependencies, quality approval, and delivery performance. Give each answer a source and date. Mark missing evidence as unknown instead of treating silence as a favorable answer.
Use short requests by category:
- Financial continuity: ask finance to review available statements and any changed payment request; see supplier financial risk
- Ownership: identify the contracting entity and changes in control, then route applicable questions to compliance
- Capacity: identify the operation limiting output and evidence supporting the quantity committed to you
- Upstream dependencies: identify essential outside processes, material sources, and the sites doing that work
- Qualification: distinguish a candidate source from one approved to ship your part
- Delivery: compare the confirmed date, changes to that date, actual receipts, and the next build's need date
Separate a supplier statement from evidence you verified. “Capacity available” is an assertion. Output records for the relevant process, checked against committed demand, support a more useful conclusion. Record access limits honestly: a supplier may share upstream information under an NDA without authorizing broad internal distribution.
NIST SP 800-161 provides a structured approach to identifying, assessing, and mitigating cybersecurity supply-chain risks. Its scope is cybersecurity for systems and organizations; it does not establish a general financial rating method for every manufacturing supplier. Use its structure where that exposure matters, alongside your manufacturing and purchasing assessment. NIST SP 800-161 Rev. 1, updated November 2024.
How do you turn evidence into a decision?
Describe the failure scenario first, then judge its likelihood and consequence using defined categories. Record the evidence supporting those judgments, the current controls, and the action owner. A low numerical average must not hide a single failure that blocks a build; escalate that dependency explicitly, even when other categories look satisfactory.
For example, use “unlikely,” “plausible,” and “already occurring” for likelihood, with written definitions your team agrees on. Describe consequence in operational terms: replenishment work, a missed kit, or a customer shipment affected. These categories are a suggested method, not a recognized certification scale.
Make the decision specific. “Monitor supplier” is too loose. “Buyer obtains the next casting completion date by Thursday; supplier quality confirms alternate-source approval status; planning calculates the first affected build” assigns work somebody can finish. For unresolved exposure, name the manager who accepts it and the next review date. Do not turn lack of evidence into an estimate with a false decimal precision.
In the United States
As checked on September 26, 2026, EO 14415 §3(b)(ii) directs proposed regulations to require written supplier-vetting procedures covering financial, foreign-influence, and manufacturing/supply risks. This is an implementing-rule direction, not an immediate universal questionnaire duty. Identify applicable contract requirements and watch the implementing rules. EO 14415 §3.
Selling into the EU?
For entities within NIS2's scope, Article 21 includes cybersecurity supply-chain security and consideration of direct suppliers' vulnerabilities and cybersecurity practices. Scope and implementation depend on the entity and applicable national law. This does not turn every manufacturing supplier assessment into a NIS2 compliance review. Directive (EU) 2022/2555, Article 21.
What should trigger a fresh assessment?
Refresh the affected assessment when its assumptions change: an acquisition, a manufacturing-site transfer, a faster-payment request, repeated missed acknowledgements, or a changed upstream source. Ask which part and build the change affects. Preserve the earlier assessment, record the new evidence, and update the action rather than replacing the history with a new score.
Assign each signal to an owner. Finance evaluates payment and liquidity concerns. Supplier quality reviews process and qualification changes. Purchasing checks commitments and contacts. Planning translates the supply impact into build dates. Compliance checks restrictions or ownership questions where relevant. One coordinator keeps those judgments connected to the same part and site.
At scale, send a short request for the changed category with a named contact and due date. Keep a queue of unanswered requests, follow up through agreed channels, and escalate incomplete or conflicting evidence to the buyer. Avoid an automated “pass” based only on completion of the form. A complete answer can still reveal a serious dependency.
What belongs in a supplier risk assessment tracker?
A useful tracker connects the risk to a part, decision, and follow-up. Include the evidence date, failure scenario, affected build, current protection, action owner, due date, and closure proof. Keep unknowns visible. The tracker should let another buyer continue the work without reading a month's worth of email to reconstruct the decision.
Use this checklist for each critical dependency:
- Record the supplier legal entity, manufacturing site, part and revision
- Name the upstream operation or material that could interrupt supply
- Calculate usable inventory against the next affected need date
- Record the alternate source's actual qualification status and remaining approvals
- Save the evidence, who checked it, and when it was checked
- Describe the consequence and current protection in plain language
- Assign a dated action, owner, escalation contact, and next review trigger
- Close the action only when the promised evidence or protection exists
Keep the full action log in your supply chain risk management plan. An assessment identifies the exposure; the plan makes the response executable.
What questions do teams ask about supplier risk assessment?
A supplier assessment works best when the team agrees what its evidence can establish. Separate missing information from a confirmed failure, and review criticality alongside commercial exposure. The following answers address common choices about questionnaires, purchasing priority, and unanswered requests without turning suggested practices into mandatory rules.
Is a supplier questionnaire enough?
A questionnaire is an input. Check its answers against the part, site, approval requirements, and recent delivery evidence. Assign actions to gaps and refresh the record after changes. A signed form does not establish how long your build can continue if the supplier stops shipping or whether an alternate can actually deliver.
Should spend determine review priority?
Spend helps explain commercial exposure, but it can miss a cheap part that stops final assembly. Prioritize the operational consequence, recovery time, and available protection alongside spend. A low-cost casting with no approved substitute may deserve an earlier review than a large purchase you can move immediately to another qualified source.
Is an unanswered request proof of high risk?
An unanswered request creates an evidence gap. Confirm the contact and explain what decision the information supports, then set a follow-up date. Escalate the unresolved gap when the part's criticality warrants it. Do not describe silence as proof of insolvency or wrongdoing, and do not treat it as evidence that everything is fine.
If supplier follow-up keeps risk reviews unfinished, talk to our team about the work your buyers need to complete before the next build.
This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.