Supplier risk assessment: how to score a supplier's geopolitical risk

A supply chain risk assessment maps the whole network: every tier, route and node, and where they concentrate. A supplier risk assessment goes deep on one company. It answers a narrower question: if this supplier fails, how likely is it, what would cause it, and what would it cost us?

Most companies need both. The network view shows where the concentration sits, and the supplier view tells you which specific relationships need a second source, more inventory or tighter contract terms.

Financial health: liquidity, debt, payment behavior and dependence on a few customers. Operations: capacity, single site dependence, quality record and the supplier's own key suppliers. Compliance: sanctions, export controls, forced labour, anti corruption and environmental rules. Cyber: access to your systems and data, and the supplier's own resilience.

Geography: the country risk of every site that makes, stores or ships your goods, not just the head office. Routes: the ports, sea lanes and chokepoints the goods pass through. A supplier with excellent financials can still fail you if its only plant sits in a country sliding into conflict or its cargo moves through a strait that closes.

Where are the actual factories, and where are their inputs made? Many suppliers headquartered in stable countries make components in places with very different risk. Who owns the supplier? US sanctions treat a company owned 50% or more by blocked persons as blocked itself, and a US export control rule with a similar 50% test is scheduled to take effect on Nov 10, 2026 unless its suspension is extended.

Which route does your cargo take, and what is the fallback? In 2026, closures in the Strait of Hormuz and attacks near the Red Sea turned routing into a supplier risk in its own right. Does any part of the product come from Xinjiang? Since June 21, 2022, US law has presumed that such goods are made with forced labour, and importers must prove otherwise with clear and convincing evidence.

Not every supplier needs the same depth of review. Rank them by how hard they are to replace and how much revenue depends on them. A sole source supplier of a regulated component deserves a full assessment, site visits and quarterly monitoring. A supplier of commodity office goods needs a basic screen.

Set triggers for reassessment rather than relying only on the calendar. A country moving into a higher risk band, a new sanctions designation, a strike, a cyber incident, a chokepoint closure or a change of ownership should each prompt a fresh look at the suppliers it touches.

In Canada, entities covered by the Fighting Against Forced Labour and Child Labour in Supply Chains Act must report each year by May 31 on the steps they took to prevent forced and child labour in their supply chains. The act covers listed companies and those that meet size thresholds, and the report needs board approval and a signed attestation. Federally regulated financial institutions also follow OSFI Guideline B 10 on third party risk, in effect since May 1, 2024.

In the US, the Uyghur Forced Labor Prevention Act presumption shifts the burden of proof to importers, and export controls and sanctions can apply to a supplier's owners as well as the supplier itself. A documented supplier risk assessment is now the evidence regulators, customers and auditors expect to see.

Energy and petrochemical inputs from the Gulf, fertilizer, aluminum and LNG all became supplier risks when the Strait of Hormuz closed. Critical minerals did the same when China tightened export licensing, and those controls remain a pressure point even under the current US and China truce.

The suppliers that coped best had alternative sites, buffer stock and contracts that set out who pays when routes change. Those features can be scored, which is why they belong in every assessment.