Supplier Risk Assessment: Checklist and Practical Example

A supplier risk assessment helps you decide whether a supplier can meet your requirements, what could interrupt supply and which evidence you still need. Start with identity, product quality, delivery, financial exposure and continuity. Record each finding, its source and the action required before approving an order.

For an importer or a small procurement team, the useful outcome is a sourcing decision: proceed, proceed with conditions, pause for evidence or choose an alternative. This guide gives you a checklist, a repeatable process and a fictional example you can adapt to your next supplier review.

What is a supplier risk assessment?

It is a structured review of the ways a supplier relationship could affect your business. A low quote is one input; so are delivery reliability, replacement difficulty, product requirements, payment exposure and evidence about the business you are dealing with.

Supplier evaluation asks whether a supplier fits your requirements. Risk assessment asks what could go wrong, how serious the impact would be and what you will do about it. The two belong in the same sourcing conversation, but a supplier can perform well today and still create a dependency that deserves a contingency plan.

Keep the review proportionate. A replaceable office-supply vendor needs a different level of scrutiny from the sole producer of a component that stops your production line. The EcoVadis supplier risk assessment guide provides broader context on operational, financial and sustainability categories. Use your own product, market and exposure to decide which categories require specialist review.

Supplier risk assessment checklist: what to verify

Use this checklist as a starting point, not a universal certification. For each row, record the evidence date, reviewer and unresolved questions. “No information” means unverified; it does not mean low risk.

For a deeper identity check, use the business identity checks for trade partners guide. Keep the entity you verify consistent with the entity used in your contract and payment process.

How to assess supplier risk in five steps

1. Define the purchase and its business impact

Record the product, specification, expected volume, delivery window and internal owner. Ask how long your business could operate without this supply. Identify whether another qualified supplier could substitute immediately or would need tooling, testing or customer approval.

This establishes the depth of review. A supplier's size alone does not determine your exposure: a small source of a hard-to-replace part can be more critical than a large source of a standard item.

2. Gather evidence and separate statements from facts

Use supplier documents, independent records and your own transaction history. Note who provided each item, what period it covers and whether it applies to the correct entity, product and site.

A supplier's statement that it has “many international customers” is a claim to check. A shipment record is an observation within a dataset. Neither proves current production capacity, cash flow or compliance with your particular requirements.

3. Prioritize risks without hiding unknowns in a score

For each risk, describe the potential impact, the evidence that makes it plausible and the effectiveness of existing controls. Keep an evidence-confidence field separate from the risk rating.

A practical review can use low, medium, high and unverified labels, with definitions agreed by your team. Do not average an unresolved identity or mandatory product check into a reassuring overall score. If you use numerical scoring, document the weights and escalation rules; the worksheet here is not a validated scoring model.

4. Decide the action and who owns it

Choose a supported decision: proceed, proceed with conditions, hold pending evidence or seek an alternative. Make each condition measurable, give it an owner and record a due date. “Monitor supplier” is less useful than “procurement confirms backup capacity before approving the production order.”

5. Set review dates and change triggers

Review critical relationships at an interval appropriate to your business. Also reopen the assessment after material changes such as a new factory, revised bank details, repeated late deliveries, a change of ownership or a different product specification.

A previous approval covers the evidence and scope assessed at that time. It does not automatically cover a new entity, plant or supply arrangement.

What trading relationships can tell you—and what they cannot

Company and trade records help you frame better questions. Review entity matches, recorded products, counterparties, shipment dates and the direction of observed activity. These can highlight an apparent dependency or a change worth discussing with the supplier.

EximAgent's company intelligence for trade partners guide documents entity resolution, trade profiles, trajectories, relationship mapping and shipment evidence. These are research inputs; they are not a complete supplier approval or financial-risk assessment.

• Observed concentration: one counterparty may dominate the records you can see. Ask whether that reflects the business or the dataset's coverage.
• Activity changes: fewer recorded shipments may reflect seasonality, routing changes, reporting delay or incomplete coverage. Investigate before interpreting the change as distress.
• Continuity: previous shipments demonstrate recorded activity, not a guarantee that the next order will arrive on time.

For your own dependency, calculate supplier share from your purchasing records using a consistent basis: units, spend or a specific product's requirements over a defined period. Do not mix those denominators. Customs shipment counts are not automatically equivalent to revenue, capacity or your spend share.

The company data provider evaluation checklist helps you assess source quality, identity matches and coverage before using a company profile in the review.

Practical example: assessing a packaging supplier

Fictional example: Harbor Imports is considering Meridian Packaging for printed cartons. All names, figures and findings below are invented to illustrate the process, not an EximAgent customer result.

Meridian would supply 70% of Harbor's planned carton units next quarter. An alternative would need six weeks for artwork approval and testing. Harbor's purchase plan establishes the dependency; a trade profile alone would not establish either figure.

The result is a conditional assessment, not a “safe supplier” badge. Harbor first resolves identity and required checks. It can then decide whether a limited initial order, inspection and a backup plan sufficiently reduce its exposure.

Copy this supplier review worksheet

Create one row for each finding. Reuse this structure in a spreadsheet or your procurement system:

Frequently asked questions

When should you assess a supplier?

Before committing to a new relationship, when a material change occurs and during periodic reviews of critical suppliers. The review depth should reflect the purchase and potential interruption.

What if the supplier will not provide information?

Record the gap and its consequence. Seek an alternative source of evidence where appropriate. If the missing information is necessary for your approval, pause that decision rather than treating the absence as a pass.

Can shipment records prove a supplier is reliable?

No. They can support observations about recorded trade activity and counterparties. Delivery performance for your orders, production quality, financial capacity and applicable compliance require additional evidence.

Is a checklist enough to approve a supplier?

A checklist organizes the review. Approval depends on the findings, the controls, your organization's requirements and the people authorized to make the decision.

Research the supplier before the next sourcing decision

Start by confirming the entity and reviewing available trade activity and relationships. Use the EximAgent Company Intelligence workflow to organize those research inputs, then use the worksheet above to document missing evidence, actions and ownership before approving the next step.