Supplier Risk Classification: How to Set Risk Levels and Controls
A supplier with a small annual contract can still create a major risk if it controls access to your systems or provides a component you cannot easily replace. Supplier risk classification helps finance and procurement teams decide where deeper checks, stronger controls and closer follow-up are needed.
The starting point is to understand what could go wrong in each supplier relationship, how likely it is, and what the consequences would be.
What Is Supplier Risk Classification?
Supplier risk classification is the process of assigning suppliers or individual supplier relationships to risk levels using defined criteria. The level should guide the checks performed, who approves the relationship and how it is monitored.
The Swedish National Agency for Public Procurement, Upphandlingsmyndigheten, describes risk analysis in terms of identifying possible events, their consequences and their likelihood. Its guidance also emphasizes ongoing risk management and follow-up. Although written for public procurement, these principles provide a useful starting point for an internal supplier assessment.
Start with reliable information about the legal entity and the service being purchased. Our guide to supplier master data management explains how to establish that foundation.
Assess Five Areas of Supplier Risk
Use the same core questions across your supplier base, then investigate further where the answers indicate greater exposure. The following assessment areas are a practical starting point.
1. Operational Dependency
Consider what would happen if the supplier could no longer deliver. Could a failure interrupt production or an essential service? How quickly could the supplier be replaced? Does delivery depend on critical subcontractors?
A supplier that is difficult to replace may require closer oversight even when annual purchasing spend is relatively low.
2. Financial and Payment Exposure
Review the financial information available and the nature of your payment arrangements. Are advance payments or large outstanding commitments involved? Have payment instructions changed? Is there evidence that the supplier’s financial position could affect its ability to deliver?
The assessment should reflect both the supplier’s circumstances and your organization’s exposure.
3. Identity and Compliance
Confirm which legal entity your organization is doing business with. Are company registration details and relevant ownership information verified? Do the supplier record, contract and invoice identify the same entity? Are there unresolved findings from sanctions screening or other checks?
Record discrepancies and assign responsibility for investigating them.
4. Systems and Data Access
Assess what the supplier can access within your organization. Can it access sensitive information, payment workflows or critical systems? Does it have administrator privileges? Could an incident at the supplier affect your operations or information security?
The UK National Cyber Security Centre recommends mapping supplier dependencies, the importance of supplied services and information flows. This helps explain why a supplier’s access and role can matter as much as its contract value.
5. Sector and Supply Chain Exposure
Consider where and how the product or service is delivered, including the activities performed by subcontractors. What labour, environmental or other risks arise from the work involved? Does the organization have sufficient visibility into the relevant parts of the supply chain?
Keep risks to people and the environment visible alongside business risks. The OECD Due Diligence Guidance for Responsible Business Conduct calls for prioritizing adverse impacts according to severity and likelihood. For human rights impacts, severity takes precedence in prioritization.
Low purchasing spend should not obscure a severe potential impact on affected people or the environment.
Use Three Risk Levels With Defined Controls
A simple model can use low, medium and high risk. Use the exposure before additional controls to set the review level, then record the remaining risk separately.
Define what triggers each level and what staff must do as a result.
The framework and review intervals below are illustrative internal policy choices, to be adapted to your operations and applicable requirements.
Low Risk
A low-risk relationship might involve readily replaceable supplies, limited system access and financial exposure, verified information and no material unresolved concerns.
Appropriate controls could include:
Basic identity and relevant registry checks.
Independent verification of payment information.
A named internal owner.
A scheduled review every 12 months, with additional checks when material changes occur.
Medium Risk
A medium-risk relationship might involve meaningful operational or financial exposure, limited alternatives, or issues requiring additional evidence.
Appropriate controls could include:
Additional financial or delivery checks.
Targeted questions about identified risks.
Documented approval of the relationship.
Assigned actions for unresolved issues.
A scheduled review every six months and after material changes.
High Risk
A high-risk relationship might involve a critical dependency, sensitive system access, substantial potential adverse impacts or serious unresolved findings.
Appropriate controls could include:
Review by relevant specialists.
Approval by the designated risk owner.
A documented plan to reduce identified risks.
Assessment of business continuity arrangements or alternative suppliers.
Quarterly reviews and prompt investigation of material alerts.
All levels still need basic identity and payment controls. A high classification calls for closer assessment; it does not by itself establish misconduct.
Keep the underlying findings visible so a single overall label does not hide the reason for concern.
Classify the Relationship Beyond Its Contract Value
Consider two illustrative suppliers, each costing €24,000 a year. One of them provides standard office supplies that can be replaced within days. The other maintains a production system and has remote administrator access.
Their annual spend is identical, but the second relationship may warrant a higher risk level because disruption or compromised access could have wider consequences.
Document what drives the classification. The same supplier may also require different controls for different services.
Escalate Critical Findings Separately
Define escalation rules alongside the levels. An unverified bank account change should pause the account update until it has been independently checked. A potential sanctions match should receive appropriate compliance review before the relevant approval. As UK OFSI guidance explains, matching a name is different from confirming a sanctions target.
Missing evidence should remain an open issue with an owner and a deadline. Avoid allowing a favourable average score to cancel out a finding that requires a separate decision.
Reassess When the Relationship Changes
A scheduled review is one checkpoint. Reassess sooner when there is:
A change in legal entity, ownership or company status.
A request to change payment instructions.
Evidence of financial deterioration or repeated delivery failures.
Expanded system access, a new service or a critical subcontractor change.
A new screening alert or other material risk finding.
UK government guidance on suppliers’ economic and financial standing links assessment depth to contract criticality and recommends monitoring after contract award. It also cautions against relying on credit scores as the sole measure for more critical procurements.
For each assessment, record:
The evidence reviewed and the assessment date.
The reasons for the assigned risk level.
Required controls and outstanding actions.
The responsible internal owner.
The next review date.
Distinguish the exposure before additional controls from the risk that remains after those controls have been implemented and checked.
How Svenry Supports Ongoing Supplier Monitoring
Svenry’s Counterparty Risk solution connects counterparty information from ERP or master data systems with relevant company registries and sanctions lists.
Monitoring changes in company status, ownership and screening information helps teams identify supplier relationships that need attention. These signals can support your organization’s classification process. Procurement, finance and relevant specialists still need to assess operational dependency, agree controls and decide how to handle the remaining risk.
A useful risk classification gives each team a clear next action and a reason to revisit the decision when circumstances change.
