Supplier risk management: identify, assess and reduce risks

Supplier risk management is the systematic identification, assessment and monitoring of the risks that arise from suppliers and their environment, together with the management of measures that limit these risks. A supplier risk exists wherever a failure, a bottleneck or misconduct on the part of a supplier puts your own supply at risk. The goal is a resilient supply chain that responds flexibly to disruptions without significantly affecting production or business.

For technical buyers, this means that the supply of CNC made-to-order parts must remain secure even if individual suppliers fail or entire regions are affected by disruptions. This includes regularly evaluating suppliers for quality, on-time delivery, certifications and creditworthiness, keeping an eye on their capacities and building up alternative sources of supply. Regulatory changes also count as supplier risks if they impose new requirements on suppliers. The obligations arising from the LkSG and the CSDDD are described in the article on > compliance risks in procurement.

Globalisation has made supply chains in the European manufacturing industry more complex. Technical buyers work with suppliers from different countries, which introduces numerous external risks into the sourcing of CNC made-to-order parts.

Supply chain disruptions are not the exception. According to a 2020 analysis by the McKinsey Global Institute, companies in the industries studied can expect a supply chain disruption lasting one month or longer every 3.7 years on average. A single production outage of 100 days would cost between 30 and 50 percent of one year's EBITDA in most industries. Over a decade, expected losses add up to almost 45 percent of one year's profits on average (McKinsey Global Institute, 2020).

Recent surveys confirm the scale of the problem. In the Allianz Risk Barometer 2026, business interruption including supply chain disruption ranks 2nd among the biggest business risks in Germany, as in the previous year, behind cyber incidents (Allianz Commercial, 2026). Only 3 percent of respondents worldwide rate their supply chains as "very resilient" (Allianz Commercial, 2026). In the Einkaufsbarometer Mittelstand 2025 by Onventis, BME and ESB Business School, more than 75 percent of the more than 350 procurement managers surveyed reported significant additional costs due to disrupted supply chains (BME, 2025).

Added to this is the risk of individual suppliers failing. The number of corporate insolvency filings in Germany rose by 10.3 percent to 24,064 in 2025 (Federal Statistical Office of Germany, 2026). The creditworthiness of critical suppliers should therefore be a fixed part of every risk assessment.

The starting point is the part, not the supplier. A made-to-order part is critical above all if only one qualified supplier manufactures it (single sourcing), if its absence stops assembly or delivery, if production requires a technology that only a few companies master, or if a change of supplier triggers a costly requalification with first article inspection. The list of critical parts results in the list of critical suppliers.

For each critical supplier, the relevant risks are recorded: external factors such as location and region, internal factors such as capacity utilisation, quality trends, on-time delivery and creditworthiness. Mutual dependency is added to this. If a contract manufacturer depends heavily on a single major customer, or if your own company relies on a single manufacturer, the risk increases on both sides.

Each risk is classified by probability of occurrence and potential impact, for example on a scale from low to medium to high. A simple risk matrix results in three fields of action: risks with high probability and high impact require immediate measures, risks in the medium range a scheduled action plan, and low risks regular observation.

Which measure is appropriate depends on the type of risk. The overview shows typical supplier risks for made-to-order parts:

Transparency in the supply chain is an indispensable tool for technical buyers to minimise risks and strengthen the resilience of their company. Technologies such as the Internet of Things (IoT) and real-time data monitoring make it possible to monitor supplier networks continuously.

Monitoring suppliers' production and delivery capacities offers considerable advantages for > bottleneck management. If a supplier has problems such as machine breakdowns or supply bottlenecks, this information can be passed on to the technical buyer at an early stage. Real-time data, however, requires suppliers to connect their systems or actively provide data. Where this is not possible, regular coordination, shared demand forecasts and agreed reporting obligations in the event of disruptions close part of this gap.

One of the biggest challenges is the lack of transparency in multi-tier supply chains. According to McKinsey's 2020 analysis, most large companies had only a hazy view beyond their direct suppliers and a few major sub-suppliers. This gap persists: in McKinsey's "Supply chain risk pulse 2025", 95 percent of the 100 companies surveyed said they had visibility at least into the risks of their direct suppliers (tier 1). Only 42 percent said this visibility extended to sub-suppliers (tier 2) or beyond (McKinsey, 2025).

Other typical weak points are single-source situations, insufficient capacity during demand peaks, geographic concentration of suppliers in unstable regions and a lack of communication channels with strategic suppliers. The role European suppliers play here and how to spread the supplier base in a targeted way are explained in the article > Supply chain resilience: Why European suppliers are essential.

Supplier risk management combines risk identification, supplier evaluation and alternative sources of supply into a system that cushions disruptions before they hit production. Transparency is the decisive factor here, and it is also the foundation for long-term partnerships. How transparency improves collaboration with suppliers and drives innovation is described in the article > Building long-term supplier relationships through innovation and transparency.

For implementation in your team: the > checklist for the strategic sourcing of made-to-order parts summarises 15 check points on supply chain, compliance and geopolitical risks. If you want to evaluate a second source for a critical part, you can > submit a RFQ with the technical drawing via Techpilot.