A supply chain risk assessment identifies where suppliers, logistics, technology, regulations or market conditions could interrupt delivery, increase cost, damage quality or expose the organization to legal and reputational harm. It then ranks those risks so leaders can protect the products and services that matter most.
The goal is not simply to label suppliers. A useful assessment shows what the business depends on, how failure reaches customers and which response is affordable and credible.
In this article
What does supply chain risk include?
Supply chain risk extends beyond late shipments. It includes supplier uncertainty that can weaken performance, compliance or resilience.
- Operational risk: capacity shortages, equipment failure, poor quality or long lead times.
- Financial risk: supplier insolvency, currency movement, price shocks or unfavourable payment terms.
- Geographic and trade risk: severe weather, border delays, tariffs, sanctions, conflict or port disruption.
- Concentration risk: dependence on one supplier, region, route, technology or customer.
- Cyber risk: compromised software, vendor access, data loss or third-party service failure.
- Compliance and conduct risk: product safety, privacy, corruption, environmental harm, forced labour or child labour.
Statistics Canada reported that supplier shortages, carrying cost, labour, weather and delivery delays affected Canadian inventory levels in 2024. Procurement price alone is therefore an incomplete view.
8 steps for a strong supply chain risk assessment
Begin with business impact, trace dependencies, test evidence and direct action toward the largest exposure.
1. Define the scope and critical outcomes
Select a product, service or supplier group. Identify the customer promise it supports and the maximum interruption the business can tolerate. A narrow first assessment produces better evidence.
2. Map the end-to-end supply chain
Trace critical inputs through sub-suppliers, logistics routes, warehouses, platforms and service providers. Record locations, ownership and hand-offs. Tier-one visibility is insufficient when one hidden manufacturer supports several direct suppliers.
3. Identify failure modes and warning signals
Ask how each dependency could fail and what would appear first. Warning signals may include missed quality checks, longer lead times, staff turnover, late financial filings, declining service levels, regional instability or repeated cyber incidents.
4. Collect evidence from several sources
Use interviews, site visits, contracts, audits, financial information, certifications, incident history and third-party intelligence. Verify self-reported answers when exposure is material.
5. Score inherent risk consistently
Assess likelihood and impact before considering current controls. Impact should cover revenue, margin, safety, customer service, regulation and reputation. Add velocity, meaning how fast the damage develops, and recoverability, meaning how difficult it would be to switch or restore supply.
6. Test controls and recovery options
Confirm that insurance, inventory, alternate suppliers, backups and contract clauses work in practice. Review substitute specifications, tooling ownership, data portability and the time required to qualify another source. Praevion’s business continuity plan guide explains how recovery arrangements should be documented and exercised.
7. Prioritize treatment and accountability
Choose whether to avoid, reduce, transfer or accept each major risk. Actions may include dual sourcing, revised safety stock, supplier development, stronger security requirements, shorter renewal periods or an exit plan. Name an owner, deadline, budget and residual-risk decision.
8. Monitor and reassess
Track a small set of indicators for critical suppliers and review them at a defined frequency. Reassess after incidents, acquisitions, contract changes, geopolitical events, new regulations or a major shift in demand. Supplier risk is dynamic, so an annual spreadsheet alone is not enough.
How should supplier risk be scored?
Use a transparent scale that separates the seriousness of exposure from confidence in the controls.
A practical model can score likelihood and impact from one to five, then consider velocity, recoverability and concentration. Show the assumptions and evidence, especially where data is incomplete.
Classify suppliers by criticality as well as spend. A low-spend provider may control a unique component, licence or cloud platform. A high-spend supplier with tested alternatives may be easier to replace. Executive attention should follow business impact.
Canadian supply chain due diligence considerations
Canadian organizations must consider operational resilience alongside trade, cyber security and responsible-business obligations.
Canada’s Fighting Against Forced Labour and Child Labour in Supply Chains Act came into force in 2024. Reporting applies only to entities meeting the Act’s tests and activities, so organizations should obtain legal advice where applicability is uncertain. Even when an SME is outside the reporting threshold, larger customers may request evidence from suppliers.
The OECD due diligence framework recommends identifying and assessing adverse impacts, preventing or mitigating them, tracking results and communicating how they are addressed. The Canadian Centre for Cyber Security also advises organizations to research software suppliers, define incident roles and monitor supplier relationships.
An illustrative assessment example
The highest risk is often a dependency the purchasing report does not make visible.
Consider an illustrative Ontario manufacturer buying a low-cost sensor through two distributors. Mapping reveals that both distributors source the same overseas factory and use the same port. A six-week disruption would stop the company’s highest-margin product, while an alternative sensor would require engineering approval.
The appropriate actions could include qualifying a second design, holding limited buffer stock, monitoring factory lead time and defining customer-allocation rules. These are examples, not universal solutions. The right treatment depends on interruption cost, cash capacity and switching time.
Common supply chain risk assessment mistakes
Weak assessments create a false sense of control because they measure suppliers without understanding dependencies.
- Reviewing only direct suppliers and missing shared sub-suppliers.
- Using spend as the only measure of criticality.
- Accepting certifications or questionnaires without checking scope and evidence.
- Scoring risk without defining action thresholds and owners.
- Adding inventory without considering obsolescence, cash and storage cost.
Frequently asked questions about supply chain risk
These answers clarify the first decisions in a practical assessment.
How often should supply chain risk be assessed?
Review critical suppliers continuously through indicators and conduct a formal reassessment at least annually or after a material change or incident.
What information should suppliers provide?
Request ownership, locations, key dependencies, financial health, continuity arrangements, cyber controls, certifications, incident history and relevant environmental or labour practices.
Should every critical input have two suppliers?
No. Dual sourcing may be costly or impossible. Leaders can also use approved substitutes, strategic inventory, transferable tooling, contract protection or tested recovery arrangements.
Turn supplier data into risk decisions
A strong assessment gives leaders a clear view of which dependencies threaten customer value and which actions reduce exposure most.
Praevion Consulting Inc helps Canadian organizations map critical supply chains, assess suppliers, set risk priorities and build practical treatment plans. To strengthen supply chain resilience, contact Praevion Consulting Inc.
Sources
Official Canadian and international guidance informed this article.
Photo credits: Venti Views, Geraldine Lewa, Element5 Digital and Cova Software on Unsplash.
