How to Build a Supplier Risk Register
A structure for spotting supply chain problems before they become outages.
Most businesses only think about supplier risk after a disruption already happened — a key supplier goes under, a shipment gets stuck, a sole-source part suddenly isn't available. A supplier risk register turns that reactive scramble into something you can see coming and plan around.
1. List every supplier that matters
Start with anyone whose failure would actually disrupt your business — not every vendor you've ever used. A supplier of a commodity part with five alternatives is a different risk category than your single source for something critical.
2. Score likelihood and impact separately
For each supplier, rate how likely a disruption is (financial instability, geographic risk, single point of failure) and how severe the impact would be if it happened. A low-likelihood, high-impact supplier deserves attention just as much as a high-likelihood, low-impact one — treating risk as one blended score hides this.
3. Flag single points of failure explicitly
Any supplier with no qualified backup is a single point of failure, regardless of how reliable they've been so far. These deserve their own column and their own mitigation plan — reliability history doesn't protect you from a supplier going out of business overnight.
4. Write down a mitigation action for each high-risk supplier
A risk register that just lists risks without actions attached is a list, not a management tool. For your highest-risk suppliers, note the specific step — qualify a backup supplier, increase safety stock, renegotiate terms — and who owns it.
5. Review it on a set schedule, not just after something breaks
Supplier risk changes — a supplier's financial position shifts, a region becomes less stable, a new alternative becomes available. Revisit the register quarterly so it reflects your current exposure, not the snapshot from when you first built it.
Skip the setup work
Our Supply Chain Templates collection includes a ready-built supplier risk register with likelihood/impact scoring already structured in, so you can start populating it with your own suppliers today.