Supplier risk: a proportionate assessment

Not all suppliers are equal

Treating every supplier the same way looks like the fairest option, but it is the least effective one. Apply the checks designed for your most critical suppliers to everyone and the process becomes slow and expensive; apply only the minimum checks to everyone and the real risks slip through unnoticed.

A proportionate assessment starts from a simple idea: the effort you ask of a supplier should depend on how much that supplier can affect your business. Someone delivering consumables and someone handling your customers’ data do not deserve the same questionnaire, nor the same review frequency.

Being proportionate does not mean lowering your guard. It means deciding in advance where the reviewers’ time is best spent, and saying so explicitly, so the approach is consistent from one supplier to the next and can be defended when someone asks why a check was or was not carried out.

The criteria that matter

Assigning a risk level takes only a few criteria, as long as they are clear and verifiable. The most useful concern access to personal or confidential data, access to your information systems, the operational impact of a service interruption, how easily the supplier could be replaced, and whether they rely on sub-suppliers.

Each criterion should have closed answers, such as yes, no or a three-point scale, and the final score should be calculated transparently. An assessment nobody can explain will not survive an audit, and it will not convince the people who have to apply it either.

The risk level should be set at the start of registration, because it determines which information you ask for next.

Assessment criteria

• Access to personal data
• Access to systems
• Impact of an interruption
• Replaceability
• Use of sub-suppliers

From risk level to the information you request

Once the level is set, the registration file should adapt accordingly. For a low-risk supplier, legal identity, contacts, bank and tax details are enough. For a medium-risk one, you add privacy documentation and information on the services provided.

High-risk suppliers are asked for more: security measures, certifications, continuity plans, a list of sub-suppliers and, where needed, a data processing agreement. This way the effort goes where it delivers real benefit, and smaller suppliers are not put off by disproportionate requests.

Low risk

• Legal identity
• Contacts
• Bank and tax details

High risk

• Security measures
• Certifications
• Sub-suppliers
• Data processing agreement

Looking beyond the first tier

Many risks do not come from the direct supplier, but from the people working for them. An IT support provider may rely on another company for overnight support; a software vendor may host data with an external provider. If this chain is unknown, even the most careful assessment remains incomplete.

That is why it pays to ask your most critical suppliers to name their relevant sub-suppliers, with the service performed and the country they operate in, and to report any change. The goal is not to police the entire supply chain, but to know who comes into contact with your company’s data and processes.

Proportion applies here too: there is no need to ask low-risk suppliers anything, while critical ones should provide the list at registration and confirm it at every periodic review, with a check that declared sub-suppliers meet requirements consistent with those set for the main supplier.

An assessment that stays alive

Risk changes over time. A marginal supplier can become central, a service can extend to new data, a certification can expire. An assessment carried out once and never revisited quickly loses its meaning. Set a review frequency tied to the risk level, more frequent for critical suppliers, and reassess whenever the scope of the service changes.

In the Innovaq CRM, the registration file brings the Risk, Privacy, Security and Sub-suppliers tabs together in the same record, so the assessment stays linked to the data and documents that justify it, and review dates become reminders assigned to an owner.

The effort you ask of a supplier should depend on how much that supplier can affect your business.