Supplier risk assessment: score your top 5 suppliers before they slip

A supplier risk assessment is a structured look at which of your suppliers could hurt you, how badly, and how likely — done before the delay, not during it. Most small stores discover their risk profile by living through it: one factory runs two months late, one category goes dark, and only then does the owner learn that 60% of revenue ran through a single contact with no backup. This article gives you a five-factor framework, a fill-in worksheet for scoring your top five suppliers, and the reading rules for what the scores mean. It deliberately doesn't cover the two adjacent disciplines: how to fix a high-risk supplier (that's the mitigation decision in dual sourcing) and how to measure ongoing performance (that's the supplier scorecard). Risk is the map; those are the responses.

The five factors

Score each supplier 1 (safe) to 5 (exposed) on five factors. The point isn't precision — it's making implicit worry explicit and comparable across suppliers.

1. Concentration — how much of your revenue rides on this supplier? What share of your units sold (or revenue) comes from products only they supply? 1 = under 5% and easily substituted from stock you already carry elsewhere. 5 = over a third of your catalog, or a whole category, has no other source. This is the impact factor: it sizes the blast radius of everything else.

2. Geography and lane risk — how exposed is the route? Single-country sourcing with long ocean lanes, lanes crossing chokepoints or tariff-volatile corridors, or a supplier whose inputs themselves come from one distant region. 1 = domestic or short-lane. 5 = one overseas region, 40+ day lane, and a headline-sensitive route (as of October 2026, tariff and freight volatility on some corridors is real and changes fast — assess your lane's current state, don't assume last year's).

3. Financial and operational fragility — could they just stop? Signals: one factory, one production line, single-person dependence (your contact is the company), shrinking communication quality, sudden demands for different payment terms, late deliveries to you with thin explanations. 1 = established operation, multiple production options, clean payment history. 5 = any two of the signals above.

4. Compliance and quality exposure — what could a failure cost you beyond the delay? Goods with regulatory exposure (food-contact, children's products, cosmetics), IP or tooling you don't own, or a supplier whose quality history means a failed batch is plausible. 1 = simple goods, clean record, you own the tooling. 5 = regulated category plus a quality variance history plus tooling that lives in their factory.

5. Replaceability — how fast could you switch? How long to stand up an alternative: samples, qualification, first production order, freight? 1 = another qualified supplier already shipping you similar goods. 5 = no second source exists, samples would take a season, and your product depends on their specific capability. Note the trap in this factor: it measures switching cost, and suppliers who know you can't switch behave accordingly.

The worksheet: score your top 5

Fill one row per supplier. Use your PO history for the lead-time column — quoted lead times flatter everyone (measure arrivals, not promises).

Worked example, three suppliers from a fresh catalog (pet treats and aquarium supplies store):

• Kettle & Coast Pet Foods (treats line): concentration 5 (bestseller), geography 2 (domestic co-packer), fragility 2, compliance 4 (edible, lot-sensitive), replaceability 3 → 16. The score says: high impact, moderate probability, and the exposure that matters is compliance and continuity, not freight.
• Tidepool Aquaria Ltd. (aquarium equipment): concentration 4, geography 5 (single overseas region, 52-day measured p80), fragility 3, compliance 1, replaceability 5 → 18. Highest total. The dominant factors are lane and lock-in.
• Northgate Print Works (packaging inserts): concentration 2, geography 1, fragility 1, compliance 1, replaceability 1 → 6. Ignore it. Don't spend mitigation attention where the score says the downside is a week's delay on paper goods.

Reading the scores

• 18+, any supplier: your single point of failure. Everything else in inventory management is secondary to this row — a two-month slip here strands more revenue than a quarter of ordinary carrying cost. The response menu (second source, buffer sizing, redesign around the dependency) is the dual-sourcing decision; take the score there and work it.
• Any single factor = 5, even at a low total: the factor is the finding. A replaceability 5 on a low-concentration supplier is a constraint you've accepted for that product; a compliance 5 is a claim you should investigate this week, not a ranking entry.
• Total 13–17: monitor, don't panic. These go on the scorecard — the point where risk assessment hands off to performance measurement — and get re-scored if a factor moves (a lead time that drifts from 38 to 55 days is a fragility upgrade).
• Under 13: re-score annually. That's it.

Two reading rules that override the arithmetic:

• Concentration caps everything. A supplier scoring 14 but carrying 40% of revenue deserves the treatment you'd give an 18. The total averages away the fact that impact and probability multiply, and impact is the one you can't insure with speed.
• Replaceability is the factor that changes behavior. High scores on other factors are information; a high replaceability score is a position you've put yourself in — which means it's reversible with work, and it's the factor to move first.

What the assessment changes (and what it doesn't)

The output of this exercise is a ranked list and three honest numbers per supplier: measured lead time, revenue concentration, and switching time. What it doesn't do is fix anything by itself — a scored risk is still a risk. The typical follow-through, in order of cost:

1. Re-time the exposure: if you can't change the supplier this quarter, at least size buffers against their measured worst case, not their quote (the safety stock method applied with eyes open). Cheap, immediate, buys time.
2. Start the second-source clock: budget a few hundred dollars and a few weeks for samples from an alternative as a planning assumption — then get a real quote, because category norms vary widely. Whether to split orders 80/20 or fully qualify the backup is the dual-sourcing decision with its own math.
3. Redesign around the dependency: where the fragile factor is a specific capability (a custom component, a co-packer's certification), product or recipe changes can remove the dependency entirely. Slowest, most permanent.

One boundary worth stating: risk assessment is a snapshot of exposure; it will not tell you whether a supplier is currently performing well. A supplier can be low-risk and mediocre, or high-risk and excellent. Ongoing delivery and quality trends are the scorecard's job — run both, and you'll notice the two overlapping signals that precede most small-supplier collapses: rising lead-time variance plus slipping communication quality — quotes and commitments that arrive later, and a growing gap between what was promised and what arrived.

One tool note: this is a judgment exercise your spreadsheet handles fine. What tooling can add is the factual layer — InventoryX (in development, no published price) shows which suppliers' products actually ran dark and for how long, which turns "concentration" from a guess into a ranked dollar figure. The scoring itself stays operator work.

Common questions

What is a supplier risk assessment? A structured evaluation of how much damage each supplier could do to your business and how likely it is — typically scoring concentration (revenue exposure), geography and lane risk, financial fragility, compliance exposure, and how hard they'd be to replace. Run before a disruption, it converts vague worry into a ranked list you can act on.

How do I assess risk with my top suppliers? Score each 1–5 on the five factors, using measured data where it exists: revenue share from your Shopify exports, lead-time spread from your own PO history, and fragility signals from your communications. Total 5–25. Anything 18+ is a single point of failure; any single 5 is a finding on its own; and concentration always overrides the average.

What's the difference between supplier risk assessment and a supplier scorecard? Risk assessment is a snapshot of exposure — what could hurt you. A scorecard tracks ongoing performance — what is happening: delivery timeliness, quality, responsiveness. You need both, because a supplier can be safe but slow, or fragile but excellent. The scorecard detects drift; the risk assessment frames what drift would cost.

How often should I review supplier risk? Re-score top suppliers quarterly if any sit at 13+, annually for the rest — plus immediately after trigger events: a lead time that slips materially, a change in ownership or contact, new tariffs or freight disruption on the lane, or a compliance-relevant change to the product. The factors move; the score is only as fresh as its inputs.

My supplier scores 18 — what do I do first? Start with the cheapest protection: size your buffers against their measured worst-case lead time rather than their quote, which you can do today. Then start the second-source clock — request samples from an alternative, which costs weeks not months. Whether to split orders or fully qualify the backup is the dual-sourcing decision, and it should be made with this score in hand, not before.

Next step

Score your top five suppliers this week — it's an hour with your PO history and Shopify revenue export open. Whatever lands at 18 or above (or carries a concentration of 4–5), pull its real lead-time spread from the last three arrivals and size the next buy against that, then book sample requests from two alternatives. A scored risk with samples inbound is a different situation than the same risk on a sticky note.