# Supplier Risk Scorecard: Rate Your Supply Base Across 11 Risk Dimensions > Source: https://netray.co/tools/supplier-risk-scorecard > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Score your supply base across financial, sourcing, quality, cyber, and continuity risk in eleven questions, and get a banded action plan for the gaps you find. ## Category manufacturing ## Tool **Kind:** assessment **Questions:** #### How much of your spend sits with single-source suppliers who have no qualified alternate? **Help:** Count parts where a second source would require requalification, first article inspection, or customer approval before you could switch. **Options:** ##### We have never quantified it **Score:** 0 ##### More than 40% of spend is effectively single-sourced **Score:** 1 ##### 15-40% of spend, and the list is documented **Score:** 2 ##### Under 15%, with alternates identified and a plan for the rest **Score:** 3 #### How do you monitor the financial health of critical suppliers? **Help:** Distress signals usually appear months before a supplier misses shipments: extended payment terms requests, staff departures, credit rating changes. **Options:** ##### We do not monitor supplier financials at all **Score:** 0 ##### We react when a supplier tells us there is a problem **Score:** 1 ##### Annual credit checks on major suppliers **Score:** 2 ##### Continuous financial monitoring with alerts on critical suppliers **Score:** 3 #### How concentrated is your supply base geographically? **Options:** ##### Unknown - we do not map supplier locations **Score:** 0 ##### Heavily concentrated in one region with no alternatives **Score:** 1 ##### Concentrated, but we know where and have contingency ideas **Score:** 2 ##### Deliberately diversified across regions for critical commodities **Score:** 3 #### How do you measure and act on supplier quality performance? **Options:** ##### No formal quality metrics by supplier **Score:** 0 ##### We track rejects informally; escalation is ad hoc **Score:** 1 ##### PPM and nonconformance tracked in ERP, reviewed periodically **Score:** 2 ##### Scorecarded PPM with corrective action workflow and sourcing consequences **Score:** 3 #### How is supplier on-time delivery measured? **Help:** Measuring against the supplier promise date rather than your original need date hides most delivery risk. **Options:** ##### We do not measure OTD by supplier **Score:** 0 ##### Measured against the most recently promised date **Score:** 1 ##### Measured against original need date for major suppliers **Score:** 2 ##### Measured against original need date for all suppliers, with variability tracked **Score:** 3 #### What contract coverage exists for critical purchased parts? **Options:** ##### Purchase orders only - no agreements in place **Score:** 0 ##### A few legacy agreements, most expired or unreviewed **Score:** 1 ##### Current agreements on top suppliers with pricing and lead time terms **Score:** 2 ##### Current agreements with capacity commitments, flex terms, and continuity clauses **Score:** 3 #### What visibility do you have into sub-tier suppliers? **Help:** Most disruptive shortages originate two or three tiers down, at a raw material mill or a single specialty processor. **Options:** ##### None - we only know our direct suppliers **Score:** 0 ##### Anecdotal knowledge held by individual buyers **Score:** 1 ##### Sub-tier mapped for our most critical commodities **Score:** 2 ##### Sub-tier mapped and monitored for all critical parts, with disclosure in contracts **Score:** 3 #### How do you assess supplier cybersecurity and information security posture? **Help:** For defense work this includes CMMC level requirements flowed down to suppliers handling controlled unclassified information. **Options:** ##### We do not assess supplier cyber posture **Score:** 0 ##### We ask about it during onboarding but do not verify **Score:** 1 ##### Questionnaire-based assessment with documented responses **Score:** 2 ##### Verified assessments with flow-down requirements and periodic reverification **Score:** 3 #### Do critical suppliers have documented business continuity plans on file with you? **Options:** ##### No continuity plans requested or held **Score:** 0 ##### Requested from some suppliers, rarely received **Score:** 1 ##### On file for most critical suppliers, reviewed at onboarding **Score:** 2 ##### On file, reviewed annually, and tested through tabletop exercises **Score:** 3 #### How ready are you to activate an alternate source under pressure? **Options:** ##### We would start from scratch during the disruption **Score:** 0 ##### We have names, but no qualification or tooling in place **Score:** 1 ##### Alternates identified and partially qualified on key parts **Score:** 2 ##### Alternates qualified, tooled, and exercised with periodic trial orders **Score:** 3 #### How do you control counterfeit parts and material traceability risk? **Help:** Critical for aerospace, defense, and electronics where broker-sourced components and undocumented material substitutions carry program-level consequences. **Options:** ##### No formal controls beyond trusting the supplier **Score:** 0 ##### Policy exists but purchasing from brokers happens under schedule pressure **Score:** 1 ##### Approved supplier list enforced, certifications collected and filed **Score:** 2 ##### Enforced AVL, full lot traceability in ERP, and inspection protocols for high-risk parts **Score:** 3 **Bands:** #### High Risk - Largely Unmanaged **Min:** 0 **Max:** 29 **Verdict:** Your supply base risk is essentially unmeasured, which means the next disruption will be discovered when a shipment fails to arrive rather than in advance. Institutional knowledge lives with individual buyers instead of in systems. A single supplier failure could stop production for weeks with no rehearsed response. **Recommendations:** - Build a spend-ranked supplier list this month and flag every part with no qualified alternate source. - Start measuring on-time delivery against original need date rather than promised date; the gap will be revealing. - Request current business continuity plans and financial statements from your top 20 suppliers by spend. - Stand up a basic supplier quality record in ERP so nonconformances are attributable rather than anecdotal. - Pick your single highest-risk part and qualify one alternate source as a proof of concept within the quarter. #### Elevated Risk - Reactive Management **Min:** 30 **Max:** 54 **Verdict:** You have partial visibility and some documented controls, but risk management is triggered by events rather than by monitoring. The suppliers you watch closely are usually the ones that already failed you. Gaps in sub-tier visibility and alternate source readiness mean recovery times remain long. **Recommendations:** - Formalize a supplier scorecard covering quality PPM, delivery to need date, and responsiveness, reviewed quarterly. - Map sub-tier dependencies for your top five critical commodities and identify shared upstream chokepoints. - Put current agreements in place on critical parts, including capacity commitments and lead time flex terms. - Add continuous financial monitoring for suppliers representing more than 2% of spend. - Define what qualifies a supplier as critical, then apply consistent controls to that population rather than case by case. #### Managed Risk - Solid Foundations **Min:** 55 **Max:** 79 **Verdict:** The core disciplines are in place: you measure supplier performance, know where your exposure sits, and have contracts and alternates on the parts that matter most. Remaining risk concentrates in sub-tier blind spots, cyber flow-down verification, and the gap between having an alternate identified and being able to switch quickly. **Recommendations:** - Move alternates from identified to qualified and tooled, and place periodic trial orders to keep them warm. - Verify supplier cybersecurity claims rather than accepting questionnaires, especially for CMMC flow-down obligations. - Run an annual tabletop exercise simulating the loss of your highest-exposure supplier. - Instrument lead time variability by supplier and feed it directly into safety stock recalculation. - Extend sub-tier mapping beyond critical commodities to any single point of failure in the raw material chain. #### Resilient - Proactive and Instrumented **Min:** 80 **Max:** 100 **Verdict:** Your supply base is genuinely instrumented: exposure is quantified, alternates are exercised, and supplier performance drives sourcing decisions rather than just reporting. At this level the opportunity shifts from building controls to making them faster and more predictive, and to pulling risk signals into planning decisions automatically. **Recommendations:** - Automate risk signal ingestion so financial, delivery, and quality deterioration triggers planner alerts without manual review. - Feed supplier lead time variability into automated safety stock and reorder point recalculation on a scheduled cadence. - Use scenario modeling to pre-compute the inventory and schedule impact of losing each critical supplier. - Share forward schedules and flex fences with your top suppliers to convert your visibility into their capacity readiness. - Extend the same risk discipline to service parts and aftermarket suppliers, which are often governed far more loosely. ## Content **Intro:** This free supplier risk scorecard helps procurement leaders, supply chain managers, and operations executives in discrete manufacturing rate their supply base across the eleven dimensions that actually predict disruption. It covers single-source exposure, financial health monitoring, geographic concentration, quality and delivery performance, contract coverage, sub-tier visibility, cybersecurity flow-down, continuity planning, alternate source readiness, and counterfeit parts control. Answer eleven questions honestly and you get a banded risk profile with specific, sequenced recommendations rather than a generic maturity label. **Sections:** #### How the scorecard is scored **Body:** Each of the eleven questions offers four options scored from zero to three, where zero represents no capability and three represents a mature, verified practice. Your total is converted to a percentage of the 33-point maximum and mapped to one of four risk bands. The questions are deliberately weighted toward practices that shorten recovery time rather than practices that merely document risk. Knowing you have single-source exposure is worth something; having a qualified, tooled alternate you have actually exercised is worth far more. If a question is hard to answer, that ambiguity is itself a finding - in most manufacturers, nobody owns the consolidated answer, which is why disruption response starts from a standing stop. #### What the benchmark bands reflect **Body:** The band thresholds come from patterns we see across Infor SyteLine, CloudSuite Industrial, Infor LN, and Baan customers in aerospace, defense, and electronics manufacturing. Most organizations that have never run a formal supplier risk program land in the elevated band, because experienced buyers do several things well by instinct even where no process exists. That is precisely the risk: the capability is personal rather than institutional, and it walks out the door with the buyer. The bands below therefore reward practices that are documented, verified, and repeatable over practices that merely happen to work today because the right person happens to be in the seat. **Bullets:** - Under 30%: risk is unmeasured and disruption response begins only after a shipment fails to arrive. - 30-54%: partial controls exist but are triggered by events rather than by continuous monitoring. - 55-79%: core disciplines are in place, with sub-tier and switching speed as the remaining gaps. - 80% and above: risk signals are instrumented and feed sourcing and planning decisions proactively. #### Acting on your result **Body:** Work the recommendations in order rather than picking the easiest. Almost every organization gets the most immediate value from two moves: measuring on-time delivery against original need date instead of promised date, and quantifying what share of spend is truly single-sourced. The first exposes delivery risk that promise-date reporting hides, often revealing that a supplier you consider reliable has quietly reset expectations. The second turns an abstract worry into a ranked list you can fund. From there, the highest-leverage work is converting identified alternates into qualified ones, because the difference between a name on a list and a tooled, approved source is usually eight to twenty weeks of recovery time. #### How Netray helps you close the gaps **Body:** Most of the data you need for supplier risk already exists in your ERP, scattered across receipt history, nonconformance records, and purchase order revisions where nobody has assembled it. Netray builds supplier intelligence directly against Infor SyteLine, CloudSuite Industrial, Infor LN, and Baan: real delivery variability from receipt timestamps, quality trends from inspection records, and spend concentration by commodity and region. We add on-prem AI that reads supplier communications and market signals to flag deterioration early, running entirely inside your firewall so ITAR and CMMC obligations are met. A typical engagement delivers a scored supply base and an exposure-ranked action list in six to eight weeks. **Cta:** Get a personalized supplier risk profile built from your own ERP data and a sequenced mitigation roadmap from Netray's supply chain specialists. **Faq:** #### How many suppliers should this scorecard cover? **Answer:** Answer the questions for your critical supplier population rather than your entire vendor master. In most discrete manufacturers, fifty to two hundred suppliers account for the overwhelming majority of both spend and disruption risk, while the long tail of office supplies and one-off vendors adds noise. Define critical as any supplier whose failure would stop a production line or delay a customer commitment, then score against that group consistently. #### What is the difference between an identified and a qualified alternate source? **Answer:** An identified alternate is a name someone believes could make the part. A qualified alternate has passed first article inspection, holds any required certifications, has tooling available, and is approved on your AVL and, where applicable, by your customer. That difference is typically eight to twenty weeks of recovery time during an actual disruption. Scorecards that credit identification alone consistently overstate resilience, which is why this tool separates the two. #### How often should supplier risk be reassessed? **Answer:** Reassess the full scorecard annually and refresh the underlying performance data continuously. Delivery, quality, and financial signals change on a monthly timescale, while structural factors like sourcing strategy and contract coverage change slowly. The practical pattern is a quarterly supplier performance review that surfaces deterioration, plus one annual structured risk assessment that revisits single-source exposure, sub-tier mapping, and continuity plans across the critical supplier population. ## Search terms supplier risk assessment, supplier risk scorecard, supply base risk evaluation, single source supplier risk, supplier qualification checklist, vendor risk management manufacturing, supply chain risk assessment tool --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json