Supplier Risk Assessment: How to Score a Supplier
Last updated: 2026-08-31
Quick answer
Supplier risk assessment scores a supplier across weighted dimensions, usually company stability, quality, compliance, production, supply chain and documentation. The score is only as good as the evidence behind it, so the useful output is not the number but the list of what is missing. Act on that list: close the evidence gaps, or price the risk into the order.
Definition
Supplier risk assessment is a structured way to estimate the chance that a supplier will cause you a problem, and how bad that problem would be. It converts answers about company stability, quality control, compliance, production capacity, supply chain exposure and documentation into a single score with a dimension breakdown. A good assessment is deterministic: the same inputs always produce the same score.
Key points
- · A score without a breakdown is not actionable. You need to know which dimension is driving it.
- · Missing evidence is a finding. "We don't know" should raise the score, not leave it unchanged.
- · Deterministic scoring beats AI-generated scoring. If you cannot reproduce the number, you cannot defend it internally.
- · Risk is not the same as quality. A well-run factory in an unstable region can still be a high-risk supplier.
- · The point of the score is the decision it supports: order, renegotiate, verify, audit, or walk away.
Step by step
- 1. Answer the questions with what you actually know
Guessing inflates or deflates the score in both directions. Where you do not know, answer as unknown rather than assuming the best case. Unknown is information.
- 2. Read the dimension breakdown, not just the total
A score of 45 driven by documentation gaps is a very different problem from a score of 45 driven by production risk. The first is a paperwork exercise. The second may mean you need a second source.
- 3. List what is missing
Every gap on the list is a request you can send to the supplier. Most suppliers will produce a document they forgot to send. The ones who will not are telling you something.
- 4. Decide the action, not just the rating
Low risk: proceed with normal terms. Medium: close evidence gaps before the deposit. High: verification or an audit before any payment. Critical: do not place the order until something changes.
- 5. Re-score after the gaps are closed
The score should move. If it does not, the assessment is not tracking reality and the inputs need revisiting.
Examples
A Vietnamese garment supplier scored 44, with most of the weight in documentation: no recent audit on file and an expired ISO certificate. Two documents later the score dropped to 28 with no change to the factory itself.
A Thai automotive parts supplier scored 21 and looked clean. The dimension breakdown showed all its capacity in one plant in a flood-prone province. The buyer added a second-source requirement rather than an audit.
A Chinese electronics supplier scored 68. Production risk carried most of it: 40% of assembly was subcontracted during peak season and the subcontractor had never been audited. The action was an audit of the subcontractor, not of the main plant.
An audit found four major findings. After the corrective action period and a re-audit, the supplier's reassessment dropped 19 points. The score tracked the work rather than the promise.
Checklist
- ☐ Company identity confirmed against the business registration
- ☐ Years in business and ownership structure known
- ☐ Quality system documented and certified where claimed
- ☐ Product test reports current and in scope
- ☐ Social compliance audit history available
- ☐ Capacity stated and compared with your order volume
- ☐ Key processes identified as in-house or subcontracted
- ☐ Subcontractors named and audited where material
- ☐ Single-source dependencies identified
- ☐ Payment terms and bank account checked against the contracting entity
- ☐ Score recorded with the date and the inputs used
- ☐ Reassessment scheduled after corrective actions
Frequently asked questions
How is the risk score calculated?
Each answer contributes to one of six weighted dimensions: company, quality, compliance, production, supply chain and documentation. The weights are fixed and published, and the calculation is deterministic, so the same inputs always give the same result. Our methodology page lists the weights in full.
Does the AI decide the score?
No. The score comes from a rules engine. Language models are used only to explain the result in plain language, and they cannot change the number. This matters because a score you cannot reproduce is a score you cannot defend.
What is a good risk score?
It depends on what you are buying and how much you are spending. Under 30 with no critical gaps is usually fine for a repeat order. Between 30 and 60 means close the evidence gaps before you pay a deposit. Above 60 means verify or audit before committing.
How often should I re-score a supplier?
At minimum once a year, and after any change that matters: a new production site, a change of ownership, a lapsed certificate, a quality incident, or a large increase in order volume.
Sources
- ISO 31000 risk management guidelinesGeneral framework for identifying, analysing and evaluating risk, applied here at supplier level.
- ISO 9001 clause 8.4 control of externally provided processesThe basis for evaluating and re-evaluating suppliers within a quality management system.
- FactoryAuditB2B risk methodologyOur own published weights and dimension definitions, used by the Supplier Risk Calculator.
Related guides
Have a supplier already?
Send us the company name and address. We will tell you what we can confirm, what we cannot, and what it costs.