What is the process for conducting a supplier risk assessment for a new sourcing project?

2 Collect and analyze data

The next step in conducting a supplier risk assessment is to collect and analyze data from various sources to validate and verify the information provided by the suppliers. You can use questionnaires, interviews, audits, references, market research, risk databases, and other tools to gather data. Aim for data that is relevant, accurate, timely, and consistent and use analytical techniques to detect patterns, trends, gaps, and anomalies. Also consider benchmarking the suppliers against each other and against industry norms.

3 Identify and prioritize risks

The third step in conducting a supplier risk assessment is to identify and prioritize the risks that could affect your sourcing project. You can use a risk matrix or a risk register to map out the likelihood and impact of each risk, and assign a risk rating or score. It's important to consider both internal and external risks, such as supplier failure or bankruptcy, product defects or recalls, delivery delays or disruptions, contract breaches or disputes, regulatory changes or sanctions, and cybersecurity attacks or data breaches. Of these risks, you should prioritize those with the highest probability and severity, as well as those that could cause the most damage to your business goals, reputation, or stakeholders.

4 Develop and implement mitigation strategies

The final step in conducting a supplier risk assessment is to develop and implement mitigation strategies to reduce or eliminate the risks that you have identified and prioritized. Depending on the type and level of risk, you can diversify or switch suppliers, negotiate or revise contracts, improve or monitor quality, implement or enforce compliance, enhance or update technology, and create or activate contingency plans. It's important to communicate and collaborate with the suppliers to ensure they understand and agree on the mitigation strategies, and that they have the resources and capabilities to execute them. Additionally, you should monitor and review the results and effectiveness of the mitigation strategies, making adjustments as needed.