Supplier Risk Assessment Calculator

Four main dimensions: financial (weak balance sheet, payment problems, bankruptcy risk — a failed supplier stops supplying), operational (poor quality, unreliable delivery, capacity constraints, weak processes), geographic/geopolitical (concentration in a disruption-prone region — natural disaster, political instability, trade restrictions, single-port dependency), and dependency (how hard they are to replace). The first three measure how likely failure is; dependency measures how much a failure would hurt. High scores across them, especially dependency, mark the suppliers most able to damage your operation.

Because risk is probability times impact, and dependency drives the impact. A risky supplier you can replace quickly has limited downside — if they fail, you switch. A risky SOLE SOURCE has potentially unlimited downside — their failure halts your production with no immediate alternative. So a sole-source supplier of a critical component, even at moderate individual risk, can be your single biggest vulnerability, while a high-risk supplier of a commodity available from ten others barely matters. This is why the tool flags risk-and-dependency together: that intersection is where catastrophic failures live.

Match the mitigation to the risk-dependency profile. For risky sole-sources: dual-source (qualify a second supplier), build buffer/safety stock to bridge a disruption, deepen the relationship to monitor and reduce their risk, or redesign to use a more available input. For geographic concentration: diversify regions/ports. For financial risk: monitor credit, secure supply agreements, prepare alternates. The goal isn't zero risk (impossible) but eliminating single points of failure and having a plan for the links that matter. Spend mitigation effort where risk × dependency is highest.

At least annually, and more often for critical or volatile situations — supplier financial health, geopolitical conditions, and your own dependency all change. A supplier sound last year can be struggling now; a stable region can become a flashpoint; a second source you had can disappear. Trigger reassessments on warning signs (late payments to THEIR suppliers, quality drift, management changes, regional events) and on changes to your own sourcing. Risk assessment is a living program, not an onboarding form — the whole value is catching the fragile link before it breaks, which requires current data.