Managing Risk in Procurement and Supply
Managing risk in procurement and supply tests risk identification, assessment, treatment and monitoring across suppliers, contracts and supply chains. Questions often ask how to score a risk, choose a treatment, or build continuity into sourcing and contract terms.
Core rules and concepts
- Risk is uncertainty that could affect objectives. Risk appetite is the level an organisation is willing to accept; risk tolerance is the acceptable variation around that level.
- The risk management process is identify, assess, treat, monitor and review. Assessment typically uses likelihood and impact, often in a 5×5 matrix.
- Treatment options include avoid or terminate, reduce or treat, transfer and accept or tolerate. Opportunities may be exploited rather than treated.
- A risk register records the risk, cause, effect, owner, score, treatment, residual score and review date. Every risk needs an owner.
- Supplier risk categories include financial, quality, capacity, operational, compliance, reputational, cyber, geopolitical, currency and ESG risk.
- Business continuity planning, dual sourcing, buffer stock, contractual indemnities, insurance, service credits and exit plans are common mitigations.
- Contract terms can allocate risk through liability caps, indemnities, insurance requirements, force majeure and disaster recovery obligations.
Worked example
A critical component is single-sourced from a supplier in a politically volatile region. Spend is £1.2 million a year. The team scores likelihood as 4 and impact as 5, giving a score of 20: high risk. Treatment options are: qualify a second source in a stable region (reduce), hold buffer stock (reduce), require a documented business continuity plan and contractual continuity clause (reduce and transfer some consequences), or accept the risk with board approval. A second source may cost 4% more, but it reduces the residual score to 8. The reasoning is to compare the cost of mitigation with the expected cost of disruption, not to assume insurance or a contract clause removes the risk.
Traps that cost marks
- Treating the risk register as a static list with no owners or review dates.
- Believing risk transfer eliminates reputational risk.
- Ignoring sub-tier and geopolitical exposure.
- Accepting a high risk without authority or a documented rationale.