CSQP: Supplier Risk Management

What this domain tests

Supplier Risk Management tests a repeatable process for identifying, assessing, mitigating, and monitoring supplier-related risk. CSQP items cover risk categories, likelihood-impact matrices, financial health, sub-tier visibility, business continuity, dual sourcing, contractual protections, and risk review cadence. The exam expects risk to be managed as a portfolio, with owners and triggers, not as an annual checklist.

Core rules and concepts

• The process is cyclical: identify, assess, prioritize, mitigate, monitor, and review. Assign a risk owner and a review frequency based on exposure.
• Risk categories include quality, delivery, capacity, financial, geopolitical, cyber, regulatory/compliance, ESG, obsolescence, single-source, and sub-tier concentration.
• Score risk with calibrated likelihood and impact scales, often 1-5 each. A 5x5 matrix yields low, medium, high, and critical bands with defined escalation.
• Financial screening uses current ratio, quick ratio, debt-to-equity, cash flow, profitability, and credit reports. A deteriorating trend matters more than one ratio.
• Mitigation options include dual sourcing, buffer stock, capacity reservation, supplier audits, business continuity plans, contractual right-to-audit and termination clauses, insurance, and an exit strategy.
• Map tier-n suppliers for critical parts. A direct supplier can be healthy while its sub-tier is insolvent or sole-sourced.
• KRIs and trigger points turn monitoring into action.

Worked example

A sole-source casting supplier scores likelihood 4 and impact 5, giving 20 (critical). Mitigation options: qualify a second source, which reduces likelihood to 2 and impact to 3, giving 6 (medium), at a cost of $80k. Expected annual loss from disruption is estimated at $500k x 30% = $150k. The mitigation cost is justified because it is below expected loss and also protects revenue. Reasoning: use calibrated scales, state assumptions, and re-score after mitigation. Do not treat the mitigated score as permanent; review it when volumes or the supplier's financial health change.

Traps that cost marks

• Confusing a risk with an issue that has already occurred.
• Ignoring sub-tier and single-source exposure.
• Relying only on ISO certification as a risk control.
• Using a risk matrix without calibrated scales or owners.
• Setting mitigations with no trigger, budget, or review date.
• Assuming a business continuity plan exists because the supplier says so.