Supplier risk management

Supplier risk management, sometimes called third-party risk management, is the practice of understanding how suppliers could harm the business and acting to reduce that exposure. As companies rely more on outside providers, a problem at a supplier increasingly becomes a problem for its customers.

Types of supplier risk

• Financial: the supplier goes bankrupt or can't fund its operations.
• Operational: delays, quality failures or capacity problems.
• Cybersecurity and privacy: a breach at a supplier that holds the company's data or has access to its systems.
• Compliance: the supplier breaks laws on privacy, labour, sanctions or anti-corruption.
• Concentration: too much depends on a single supplier or location.
• Reputational: the supplier's conduct reflects badly on the business.

A practical approach

1. Tier suppliers by how critical they are and what data or access they have.
2. Assess the higher tiers: questionnaires, financial checks, security reports such as SOC 2 or ISO 27001 certificates.
3. Mitigate through contract terms, backup suppliers, data minimization and access limits.
4. Monitor over time, with periodic reviews and alerts on financial or news events.

Privacy law adds weight to this work. Under Quebec's Law 25, for example, an organization that shares personal information with a service provider must ensure it is adequately protected by contract.