Supplier risk operations
Supplier risk management is the continuous process of deciding how much exposure a supplier represents, treating what is unacceptable, and keeping that judgement current as the relationship changes. It fails at the handoffs rather than inside the stages. This page sets out the seven stages, who owns each, and which three transitions account for most of the failures.
A risk score alone does not reduce exposure. Teams need to know which supplier, contract, facility, product, inventory position, or customer commitment is affected—and who has authority to accept, mitigate, transfer, or avoid the risk.
Qeluntra connects authorized supplier, contract, procurement, finance, logistics, inventory, and operating context. AI-assisted recommendations remain explainable and consequential actions remain subject to human approval.
SAP publishes supplier lifecycle, performance, collaboration, due diligence, and proactive risk-monitoring capabilities.
Official SAP sourceIvalua publishes supplier information, performance, and risk capabilities within its source-to-pay platform.
Official Ivalua sourceQeluntra connects risk signals to supplier, contract, facility, inventory, owner, treatment, approval, and operating evidence. Test the actual workflow; do not infer parity from category labels.
Published Qeluntra pricingMost descriptions of this process list activities. Activities do not tell you where a programme is stuck. Stages with entry conditions do, because a supplier sitting between two stages with nobody owning the transition is the thing you are actually looking for.
| # | Stage | Entry condition | Owner |
|---|---|---|---|
| 1 | Intake | Someone wants to buy something | Business requester |
| 2 | Screening and tiering | Supplier identity established | Procurement |
| 3 | Assessment | Tier assigned | Security / compliance |
| 4 | Treatment | Findings exist | Named risk owner |
| 5 | Contracting | Residual risk accepted or mitigated | Legal |
| 6 | Monitoring | Contract signed | Risk owner |
| 7 | Exit | Termination, expiry or replacement | Procurement |
Stage 2 is the one that determines the cost of everything downstream, and it is usually the most rushed. Tier on consequence, not spend: a £4,000 monitoring tool with an API key into production carries more exposure than a £400,000 facilities contract.
Programmes rarely fail inside a stage. The assessment gets done; the contract gets signed. They fail in the gaps, and three gaps account for most of it.
The single most common failure in the whole process. An assessment returns eleven findings. Six are noted in the report. None becomes a row with an owner and a date. Six months later nobody can say whether any were addressed, and the honest answer is that they were noticed rather than managed.
The fix is mechanical: a finding cannot be closed at assessment. It is either treated, accepted with an expiry date, or it blocks contracting. Three options, no fourth.
Everything you can require of a supplier is easiest to require before they are chosen. Once the business has picked them and the timeline is set, a request for 72-hour breach notification becomes a negotiation you are likely to lose.
Findings that need contractual remedy must reach Legal before terms are agreed, not as a note to revisit at renewal — and "we'll cover it at renewal" is where obligations go to be forgotten.
Effort is enormous up to signature and close to zero afterwards. Yet almost everything that goes wrong with a supplier goes wrong after signing: the breach, the acquisition, the certificate that lapses, the sub-processor added without notice.
The test: if a tier 1 supplier were acquired by a competitor tomorrow, what in your process would notice? If the answer is "someone might read about it", stage 6 does not exist in practice.
A stage that produces a document rather than a decision has not finished. Written as artefacts, because this is what an auditor asks to see:
| Stage | Artefact | Test it has to pass |
|---|---|---|
| Intake | A request with the three screening answers | Data? Access? Dependency? Answered before a tier is assigned |
| Screening | Tier, with the trigger recorded | Someone can say why this is tier 2 |
| Assessment | Completed question set plus evidence, with expiry dates | Certificate scope recorded, not just its existence |
| Treatment | Register rows with owners and dates | Every finding maps to a row. No orphans |
| Contracting | Executed terms covering the findings | Required clauses traceable to a specific finding |
| Monitoring | Review log plus event triggers | A defined trigger exists for breach, ownership change, sanctions |
| Exit | Tested exit plan; data return and deletion confirmed | Someone has established the data is exportable in a usable format |
The certificate-scope row catches more real problems than any other line in this table. A supplier holds ISO 27001. The scope statement excludes the hosting of the system you are buying. Recording "ISO 27001: yes" as a boolean makes that undetectable, and it is one of the most common findings in supplier assurance.
Worth separating, because supplier risk management software is frequently bought to fix problems that are not software problems.
Do the organisational work first. Tier the population, name risk owners, put expiry dates on evidence, and start recording decisions. That costs nothing, takes weeks, and determines whether a platform amplifies a working process or automates a broken one.
Most supplier risk programmes report on volume — assessments completed, suppliers onboarded. Volume measures how busy the team is, not whether exposure is being managed. Five that measure the latter:
| Measure | Why it is the right one |
|---|---|
| Register staleness — open risks whose review date has passed | The single best indicator of whether the register is a control or a document |
| Findings without owners | Directly measures the assessment→treatment failure |
| Expired evidence in force | Suppliers assured on certificates that lapsed |
| Time from request to tier | If this is long, the business routes around the process, and then you have shadow suppliers |
| Tier 1 concentration — critical suppliers sharing a fourth party | The exposure no per-supplier view can show |
The fourth deserves emphasis. A supplier risk process that takes six weeks to clear a low-risk vendor does not reduce risk — it produces suppliers engaged outside the process entirely, which is strictly worse than a fast assessment.
Obligations sit across several instruments rather than in one place:
| Instrument | Provision | Effect on the workflow |
|---|---|---|
| UK / EU GDPR | Article 28 | Processors must be able to demonstrate they meet the Regulation's requirements; prescribed contract terms; sub-processor authorisation — binds stages 3 and 5 |
| DORA (EU) 2022/2554 | Articles 28–30 | Register of information on ICT arrangements; specified terms; exit strategies for critical functions — makes stage 7 mandatory |
| NIS2 | Article 21(2)(d) | Supply chain security as a named risk-management measure |
| ISO/IEC 27001:2022 | Annex A 5.19–5.23 | Supplier relationships, agreements, ICT supply chain, monitoring — 5.22 is stage 6 |
| EU AI Act | Article 26 | Deployer duties where a supplier's product contains a high-risk AI system — adds a question to stage 3 that most question sets lack |
Applicability varies by sector, establishment and service. Treat this as a map of where to look rather than a determination.
Supplier risk management is the continuous process of establishing how much exposure each supplier represents, treating what is unacceptable, and keeping that judgement current as the relationship changes. It runs as seven stages from intake through to exit, each with an entry condition and a named owner.
Intake, screening and tiering, assessment, treatment, contracting, monitoring, and exit. Each has an entry condition that must be met before a supplier moves into it, which is what makes it possible to see where a supplier is stuck.
At three handoffs: assessment to treatment, where findings are noted but never become owned rows; treatment to contracting, where contractual leverage is spent before the requirements are known; and contracting to monitoring, where effort collapses after signature even though most supplier failures occur afterwards.
No — by consequence. Spend correlates weakly with exposure: a small monitoring tool holding credentials into production carries more risk than a large facilities contract. Tier on whether the supplier processes personal data, holds system access, or supports a service you could not sustain without them.
With the handoffs, expiry tracking, reconciliation between systems and portfolio-level concentration views, yes. It does not supply tiering criteria, the organisational willingness to reject a supplier, or assessment quality — and automating a process with those problems produces a faster version of the same result.
By register staleness, findings without owners, expired evidence still being relied on, time from request to tier, and tier 1 concentration against shared fourth parties — not by assessments completed, which measures activity rather than exposure.