Supply Chain Risk Assessment Checklist Template

Decide which supply chain this run assesses, who does each part and how risks will be rated before anyone collects data. The questions in the first task add the tasks for a first assessment, a periodic review or a review after a disruption, and for cyber access, US imports and a modern slavery statement. Every due date counts in working days from the start date.

• Set up the assessment — the supply chain or product assessed, the start date the due dates count from, the type of run, whether suppliers can reach your systems or data, whether goods go into the US, whether you publish a modern slavery statement, and the people; later tasks are assigned from these fields
• Record the disruption or change that triggered this review — a review after a disruption or change only: what happened, which items and suppliers it affected, how long supply was interrupted and what was done at the time
• Define the scope and the boundary of the assessment — the products, categories, sites and business units covered, what is left out and why, and how far down the tiers the assessment will go
• Agree the risk criteria and the rating scale — the likelihood and impact scale, what makes an item or supplier critical, and the level of risk the business will accept without a mitigation
• Build the supplier list from purchase and payment data — a first assessment only: every supplier paid for the items in scope over the last 12 months, from purchase orders, accounts payable and contracts, so nothing is missed
• Review the last assessment and its open actions — a periodic review only: what the last assessment found, which mitigations were done, which are still open and what has changed since
• Collect the data the assessment needs — spend and volume by supplier, contracts and their end dates, lead times, current stock and any incidents or late deliveries in the last year

A risk you cannot see in the map cannot be rated. Map each item to its suppliers, then ask the important ones where their own inputs come from. Two suppliers that look independent may buy from the same plant or ship through the same port.

• Map the tier 1 suppliers for each item in scope — which supplier provides each item or service, the share each one supplies and the contract that covers it
• Ask key tier 1 suppliers for their own sources and sites — the tier 2 suppliers, raw materials and manufacturing sites behind each important item, as far as the agreed depth
• Record where each item is made and shipped from — the country and site of manufacture, the port or border crossing and the main transport route for each item
• Map the logistics providers and warehouses — carriers, freight forwarders, customs brokers and warehouses the chain depends on, including any third-party warehouse holding your stock
• Identify shared dependencies further down the chain — a tier 2 source, raw material, port or region that several of your suppliers rely on, so one failure would hit them all at once

Concentrate the effort where a failure would hurt most. Rank the items by impact, find those with one supplier or one country behind them, and compare how long your stock lasts with how long it would take to replace the supplier. Then record what each supplier holds or can reach and send the critical suppliers one questionnaire for Phases 5 and 6.

• Rank the items by their impact on operations and customers — revenue or production that stops without the item, safety or regulatory effects, and whether a substitute exists, using the criteria agreed in Phase 1
• Flag single-source and sole-source items — a single source is one supplier chosen although others exist; a sole source is the only supplier that can provide the item; each critical item gets one of the two labels or multiple
• Check concentration by country or region — the share of spend or volume for each critical item that comes from one country, region or port, and the events that could stop it there
• Check concentration on single suppliers — the share of a category bought from one supplier, and your share of that supplier's revenue, since dependence in either direction is a risk
• Identify what suppliers hold or can reach — your information they hold or handle, and their physical and logical access to your systems and premises
• Compare stock cover with the time to recover — how many weeks current and safety stock would last for each critical item, against how long it would take to qualify and switch to another source
• Send the assessment questionnaire to critical suppliers — one request covering continuity, cyber security and labour practices, with the evidence wanted and a reply date before the reviews start

A supplier that fails financially can stop supplying with little notice. These checks use public records and your own payment and delivery history, so they can start while suppliers answer the questionnaire.

• Check each critical supplier's financial health from public records — filed accounts, a credit report, late or missing filings and any insolvency notices
• Look for early warning signs — late or short deliveries, requests for early payment or changed bank details, key staff leaving, a change of owner or a lost major customer
• Check ownership and screen against sanctions lists — who owns and controls each critical supplier, and a screen of the supplier and its owners against the sanctions lists that apply to you
• Rate each critical supplier's financial risk — Low, Medium, High or Critical for each supplier on the agreed scale, with the reason

Review what the critical suppliers sent back on continuity and cyber security, against what Phase 3 recorded about what each one holds or can reach. A yes to the cyber question on the first task adds two tasks on sub-contractors and incidents.

• Review each critical supplier's continuity arrangements — their continuity plan, alternative sites or lines, how long they say recovery would take and when they last tested it
• Rate each critical supplier's continuity risk — Low, Medium, High or Critical for each supplier, weighing their recovery time against your stock cover from Phase 3
• Review the security evidence suppliers sent — certificates and reports such as Cyber Essentials, an ISO/IEC 27001 certificate or a SOC 2 report, questionnaire answers and any security incidents they disclosed
• Check how suppliers control their own sub-contractors' access — suppliers with access only: who their sub-contractors are, what of yours they can reach and what security they have been asked to provide
• Confirm incident notification and support terms — suppliers with access only: how quickly they will tell you about a security incident that affects you, who they will tell, and what help each side gives the other
• Rate each critical supplier's cyber risk — Low, Medium, High or Critical for each supplier, covering both a breach of your information and an attack that stops their supply

Look for the places where workers in the chain are most at risk, such as forced or child labour, recruitment fees, unsafe conditions and unpaid wages. Start with the country, the sector and the material, then check the supplier's own answers against them. A yes to the US question on the first task adds the forced labour import check.

• Screen for high-risk countries, sectors and materials — where the items, their raw materials and their labour come from, and which of those places, sectors or materials carry a known risk of forced or child labour
• Review supplier evidence on labour practices — a signed supplier code of conduct, recent social audit reports and their findings, how workers can raise a grievance and how agency workers are recruited
• Check goods against the US forced labour import presumption — goods going into the US only: whether any input was mined, produced or manufactured in Xinjiang, or by an entity on the UFLPA Entity List, and the tracing evidence that shows where the inputs came from
• Rate each critical supplier's labour and human rights risk — Low, Medium, High or Critical for each supplier, based on the screen and the evidence, with the reason

Bring the ratings together, then agree what will be done about each risk the business will not accept as it is: a second source, more stock, better contract terms or a plan to leave. Every mitigation gets an owner and a date. A High or Critical rating adds the tasks to escalate it before the approval.

• Consolidate the ratings into the supply chain risk register — one row per critical supplier with its financial, continuity, cyber and labour ratings and an overall rating, plus the single-source, concentration and stock-cover risks from Phase 3
• Brief the approver on High and Critical risks — High or Critical ratings only: each risk, what could happen and the mitigation proposed, so the approver is not hearing about it first at the approval
• Start interim actions for Critical risks now — Critical ratings only: actions that cannot wait for the approval, such as extra orders, moving stock or a call with the supplier, recorded with who agreed them
• Agree second sources or alternatives for critical single-source items — qualify another supplier, split the volume between two, approve an alternative material or design, or record why the single source stays
• Set safety stock or buffer levels for critical items — the stock to hold, where to hold it and what it costs, for items where the time to recover is longer than current cover
• Agree contract terms with critical suppliers — notice of disruption, continuity and recovery commitments, security requirements and incident notification, flow-down to sub-contractors, audit rights and labour standards
• Write exit plans for critical suppliers — how you would move away from each critical supplier if you had to, how long it would take and what you would need from them, such as tooling, data or stock
• Assign an owner and a date to every mitigation — the mitigation plan: each risk, its mitigation, the owner, the due date and the residual rating expected once it is done

The executive who owns the risk approves the assessment and the mitigation plan, including any risk accepted without a mitigation. Nothing after the approval can be completed until a decision is recorded. Approved with conditions and Not approved each add the task that follows from them.

• Prepare the assessment summary for approval — the scope, the top risks and their ratings, the risks proposed for acceptance, the mitigation plan with its owners and costs, and the next review date proposed
• Approve the assessment and the mitigation plan — the approver records Approved, Approved with conditions or Not approved, the conditions or reasons, and the risks they accept
• Record the conditions and who will meet them — Approved with conditions only: each condition, its owner and its date, added to the mitigation plan
• Rework the assessment and ask for a new decision — Not approved only: make the changes the approver asked for, then ask them to record a new decision on the approval task, or archive this checklist and start a new run

An assessment is a snapshot. Tell suppliers and the owners of each mitigation what was agreed, set up the signals that should trigger an early review, and put the next review in the diary before closing the run.

• Tell critical suppliers what you need from them — the requirements, contract changes and actions agreed with each supplier, and the dates
• Brief the owners of each mitigation — each owner knows their actions and dates, and how progress will be reported
• Set up monitoring and early review triggers — alerts for supplier financial changes, sanctions list changes, news from key countries and sites, security incidents and falling delivery performance, and the events that will start an early review
• Feed the findings into supplier onboarding and performance reviews — the checks new suppliers must pass and the risk measures added to the supplier scorecards
• Pass the labour findings to the modern slavery statement owner — statement publishers only: the parts of the chain at risk and the steps taken to assess and manage that risk, for the next statement
• Set the next review date — when this supply chain will be assessed again, earlier for chains with High or Critical risks, and a reminder or schedule for it
• Close the assessment and file the record — the final register, mitigation plan, approval and evidence stored where the next review will find them