Most supplier risk guides assume you have a dedicated procurement team, a risk committee, and enterprise software. This guide is for the operations manager at a growing business who needs to know: which of our suppliers could cause us a problem, and what do we do about it?
You don’t need to worry about every possible risk — but you do need to know which category each of your suppliers falls into. Here are the five that matter most for a growing business.
Your supplier goes bust mid-contract. Their key person leaves and the business collapses. They get acquired and the terms change overnight. For small businesses that rely on a single supplier for a critical input, financial risk can shut you down. Warning signs: late invoices, staff turnover, delayed deliveries, requests to renegotiate terms without explanation.
1 in 5 SMBs has experienced a critical supplier failureDeliveries are late. Quality drops. The promised SLA quietly becomes something else. Operational risk is the most common supplier risk — and the hardest to quantify. It compounds quietly until a customer notices. The fix is simple: defined SLAs in writing, tracked against actuals, with a review process that happens before the renewal date.
Your supplier handles personal data but doesn’t have a GDPR-compliant data processing agreement in place. Or they work with your clients directly but don’t carry the required insurance. Under GDPR, if your supplier has a data breach, you can be held liable if you didn’t do adequate due diligence. “We didn’t know” is not a defence.
A supplier with access to your systems, your data, or your clients’ data is a potential attack vector. 30% of data breaches involve a third-party supplier (industry research). This doesn’t require a major vendor — a small IT contractor with admin access to your CRM has the same attack surface as a large SaaS tool. The question is: do you know who has access to what?
30% of breaches involve a third partyYour supplier pays their staff below minimum wage. Their factory conditions are poor. They get sued for fraud. For enterprise customers, your supply chain practices are increasingly subject to due diligence questions. Modern slavery, ESG compliance, and subcontracting practices are now routinely asked about in enterprise procurement questionnaires — and if you can’t answer, you lose the deal.
Every supplier risk framework you’ll find online was built for a Fortune 500 procurement department. Here is what enterprise and SMB supplier risk actually look like — and why a simpler process is better than no process.
This is not a 12-month implementation. Done properly, you can complete steps 1–3 in a week and have a working supplier risk programme running within a month. Here is exactly what to do.
You cannot manage what you haven’t listed. Start by pulling every supplier from your accounts payable, your contracts folder, and your email. The goal is a single list of every company you pay money to — including one-off contractors, SaaS subscriptions, professional services firms, and physical goods suppliers.
Not every supplier needs the same level of scrutiny. Tier your suppliers into High, Medium, and Low risk based on three factors: how much you spend with them, whether they have access to your data or systems, and whether you have alternative suppliers available.
For Tier 1 and Tier 2 suppliers, send a short due diligence questionnaire. Ask for their insurance certificates. Check whether they have the compliance certifications relevant to your industry. You don’t need a legal team for this — a 5–10 question questionnaire covers the critical bases. Track expiry dates on any certificates they send back.
Supplier risk is not a one-time exercise. Insurance certificates expire. Suppliers change ownership. The company you onboarded three years ago may look very different today. Set a review cadence for each tier and stick to it — automated reminders mean this takes minutes per supplier per year, not days.
You don’t need a 150-question enterprise DDQ. These five questions cover the risks that actually matter for a growing business — and you should be able to ask them in a single email.
If a supplier has access to your systems or handles your data and they suffer a breach, your liability exposure depends partly on whether they carried adequate insurance. Ask for the certificate, note the policy limits, and set a reminder for the expiry date. A supplier who refuses to share this is a red flag.
Ask for the certificate, not just a yes/no answerA named person, not a department. If your supplier has access to personal data and cannot name the person responsible for data security, that tells you everything you need to know about their internal controls. This is especially important for SaaS tools and IT service providers.
A vague answer ("our IT team") is a yellow flagMany suppliers will say no and that may be true. But the question matters for two reasons: it signals that you take security seriously (which raises their standards), and it creates a written record that can be important in a regulatory investigation. If they say yes, ask what they did about it.
Document their answer in writing, whatever it isISO 27001, SOC 2, Cyber Essentials, GDPR — the right answer depends on your industry and the nature of the supplier relationship. The point is not to demand enterprise certification from a five-person agency. The point is to understand whether they have any systematic approach to security and compliance, or whether it’s entirely ad hoc.
For data processors: a signed DPA is non-negotiable under GDPRThis question reveals more about a supplier’s maturity than almost any other. A supplier who has thought about this will give you a clear answer. A supplier who has never considered it will stall. For single-source critical suppliers, business continuity planning is not optional — their failure could be your failure.
Single-source suppliers: ask for a written BCP summaryVendorAuditly lets you send these questions automatically, track responses, and store the documents suppliers send back — with expiry alerts built in.
Send your first questionnaire free →Import your supplier list, send due diligence questionnaires, track insurance certificates, and get expiry alerts automatically. Free forever on 3 suppliers.
Free forever on 3 suppliers · No credit card · No procurement team required