Unusable Supplier Risk Register at a Medical Device Manufacturer
A medical-device manufacturer has 2,400 suppliers. Its risk register uses a 5×5 matrix, but business units multiply likelihood and impact and then add a “management judgment” score. As a result, 62% of supplier risks are rated high. The board cut the third-party risk budget by 30%. Internal audit found 14 critical suppliers that had never been assessed, including the sole sterilization contractor. That contractor has had two quality deviations in six months and no tested disaster recovery plan. A ransomware incident at a logistics provider caused a four-day shipment delay last quarter. The chief procurement officer wants to reduce the number of suppliers from 2,400 to 1,600 and says the risk register is “unusable.” You lead a risk refresh.
1. Diagnose the flaws in the scoring and prioritization approach, and explain why the register has become unusable.
Read the worked answer
The scoring method conflates likelihood and impact through multiplication and then adds an uncalibrated “management judgment” score. Multiplication produces a wide numeric range but no shared meaning: a 5×5 score of 20 could arise from a rare catastrophic event or a frequent minor one, yet both look the same. Adding judgment after the calculation lets business units adjust scores without definitions or evidence, so the final number cannot be compared across units. When 62% of risks are high, the label stops prioritizing anything; it becomes a political signal rather than a decision tool.
The register also lacks criticality criteria tied to patient safety, regulatory status, and business continuity. A sole sterilization contractor with quality deviations should rank above a large number of low-spend suppliers even if the spend-based score is lower. The 14 unassessed critical suppliers show that the inventory and tiering process, not just the matrix, is failing. The four-day logistics delay is a real consequence that should calibrate impact, but the current method does not use it. The refresh should separate inherent risk, control effectiveness, and residual risk; define impact in patient, regulatory, financial, and continuity terms; and require evidence for any override. Then rank by tier, not by a single composite score.
2. Propose a treatment plan for the sole-source sterilization contractor, including what would justify accepting residual risk.
Read the worked answer
Treat the contractor as a critical supplier with a dedicated plan. Immediate actions: obtain the two deviation root-cause reports and corrective-action status; conduct an on-site or remote quality audit; require a tested disaster recovery plan with recovery time and recovery point objectives; verify sterilization capacity and alternate-site options; and review the contract for audit, continuity, and termination rights. Because the supplier is sole-source, qualify a second source or secure a documented capacity reservation with a credible alternate. Build a buffer inventory based on demand variability and the recovery time, and test the logistics plan.
Residual risk acceptance should be time-bound and condition-based, not a blanket sign-off. The business owner should quantify the patient-safety and supply impact, state the controls in place, and identify the trigger that would reopen the decision, such as a third quality deviation or a failed recovery test. The board or risk committee should accept residual risk only if: the deviations are under an approved corrective action; a recovery test has passed; alternate capacity or buffer inventory covers the agreed maximum outage; and a named executive owns the plan. The 30% budget cut does not justify skipping the audit or recovery test; it should force prioritization of the 14 unassessed critical suppliers over lower-tier assessments.
3. Define key risk indicators and board reporting that would show whether third-party risk is improving.
Read the worked answer
Use a small set of indicators that are leading and actionable. Examples: number and percentage of critical suppliers assessed; number of critical suppliers with no tested disaster recovery plan; sole-source critical suppliers without a qualified alternate; open quality deviations at critical suppliers; average days to close supplier corrective actions; supplier-caused shipment delay days; and number of critical suppliers with overdue audit rights. Add a ransomware-specific indicator: percentage of critical logistics and sterilization providers that have tested recovery from backup within the contracted recovery time.
Board reporting should show the top ten critical suppliers by patient-safety and continuity impact, not just by spend. Each entry should include inherent risk, control status, treatment action, owner, due date, and trend. Report the 14 previously unassessed suppliers as a closure metric, with a target date. Include a calibration note explaining any change in scoring methodology so the board can compare periods. Use thresholds that trigger escalation: any critical supplier with two deviations in six months, any failed recovery test, or any sole-source supplier without a continuity plan. The report should end with decisions requested, such as approving a second-source qualification or accepting a time-bound residual risk. This makes the register a decision tool rather than a ranking exercise.