Supplier risk management: due diligence that outlives the onboarding form

Four risk families, assessed separately

Supplier exposure divides usefully into four families. Financial risk asks whether the supplier can keep trading and whether its failure would strand goods or unpaid subcontractors. Operational risk asks whether it can perform to the specification at the volumes required. Compliance risk covers licensing, sanctions and export controls, tax and employment obligations, and sector-specific authorisations. Conduct risk covers labour practices, environmental performance, corruption and the treatment of workers deeper in the chain. Collapsing these into a single score hides the one that matters. A financially robust carrier can present serious conduct risk, and an impeccable small operator can be financially fragile. Scoring each family separately keeps the mitigation aimed at the right problem.

Due diligence proportionate to what is at stake

International guidance on responsible business conduct promotes a risk-based approach: identify where the most severe adverse impacts are likely, and concentrate effort there rather than distributing questionnaires evenly. For a logistics buyer that usually means deeper work on suppliers handling high-value or hazardous goods, operating in higher-risk jurisdictions, holding regulated authorisations or employing large numbers of workers through agencies. Proportionate diligence draws on corporate registry data, financial information, licence and authorisation verification, sanctions and adverse media screening, insurance evidence, certification under the relevant management standards, references from comparable customers, and a site visit where the risk justifies it. A questionnaire alone verifies willingness to answer questions, nothing more.

Contract terms that make monitoring possible

Diligence findings are only useful if the contract lets you act on them. Practical terms include obligations to maintain specified insurance and to evidence it on request, restrictions on subcontracting without consent, audit and inspection rights extending to sites and to subcontractors, incident and breach notification within defined periods, compliance with a supplier code, cooperation with recalls and investigations, and defined termination rights for compliance failures. Continuity terms deserve equal attention: what happens to goods, data and equipment on termination or insolvency, how a transition is run, and whether the buyer can access records afterwards. Companies discover the value of these clauses at the worst possible moment.

Monitoring, triggers and concentration

Between formal reviews, monitoring should be event-driven. Useful triggers include a change of ownership or directors, a credit downgrade or filing delay, a lapsed authorisation, a serious service failure, an incident notification, adverse media, or a sudden change in the sites or subcontractors being used. Each should prompt a defined response rather than an ad hoc discussion. Concentration is a separate question and often the more consequential one. A buyer may hold a dozen well-assessed suppliers that all depend on one terminal, one customs broker or one region, so the register should record dependencies as well as counterparties. Mapping those single points is what turns a supplier list into a risk picture.

Exit, remediation and the cost of the decision

When a finding is serious, the choice is between remediation with a defined plan and deadline, and exit. Guidance on responsible conduct generally favours using leverage to improve conditions rather than disengaging immediately, since abrupt exit can worsen the harm for the workers concerned, while reserving disengagement for cases where improvement is not achievable. Whichever route is taken, document the reasoning. The record of what was found, what was decided and why is what demonstrates a functioning process, both to customers auditing the buyer and to authorities where a duty applies. Legal obligations in this area vary considerably by jurisdiction and sector, so take advice on what binds your organisation.

Frequently asked questions

Is a completed supplier questionnaire adequate diligence?

It is a starting point that records what the supplier asserts. Verification against registries, licence records, financial data, insurance evidence, screening results and, where the risk justifies it, a site visit is what turns assertions into an assessment.

Should a serious finding always mean termination?

Not necessarily. Responsible conduct guidance generally favours using leverage to remediate, with a defined plan and deadline, and reserves disengagement for situations where improvement cannot be achieved. Either way, the reasoning should be documented.

How do we handle concentration across separately assessed suppliers?

Record dependencies as well as counterparties, so that shared reliance on one terminal, broker, corridor or subcontractor becomes visible. Several independently sound suppliers can still represent a single point of failure.