Methodology
Our supplier risk assessment methodology covers the following aspects:
Financial
Covers financial performance and stability of a supplier on the basis of profitability, solvency, liquidity, size and scale, and sponsor/key investor type
- Profitability risk is measured on the basis of parameters such as revenue growth, operating margin and return on assets
- Solvency risk is assessed on the basis of parameters such as capital structure, debt leverage and interest coverage ratios
- Liquidity risk is based on acid test (or quick ratio), which is considered a stringent measure of liquidity
- Sponsor risk is based on the type of parent/key investor to assess the extent of financial backing
- Scale risk is assessed on the basis of revenue and headcount; the underlying assumption is that small businesses have high business risk due to a lack of resources and low influence on their own suppliers, customers, partners, creditors, etc.
Operational
Covers operational challenges arising from factors such as business concentration, competition, management quality, security, Quality, geographic dependencies, supply and demand, and impact of technology
- Concentration risk is based on the spread of revenue and geographic footprint, which helps us assess dependency on customers and key geographic markets
- Competition risk is based on an assessment of the nature of competition in the supplier’s industry and its own competitive advantages
- Management risk is based on senior leadership’s tenure and experience
- Security risk is based on information regarding physical and IT security systems/controls, certifications and reported data or security breaches
- Quality risk is evaluated on the basis of quality standards, certifications and programmes, and reported product recalls
- Geographic risk is assessed on the basis of key political, economic, social, technological, legal and environmental indicators (further details below)
- Supply risk is based on the stability of key supply markets and spread of the industry supply chain (local vs. regional vs. global)
- Demand risk is based on the stability of key demand markets
- Technology risk is based on the speed and impact of disruption driven by new innovations and technologies
The geographic risk indicators are explained below:
- Political: Covers people’s participation in electing their government, freedom of expression and association, overall political stability and effectiveness of governance
- Economic: Covers economic stability based on indicators such as per capita income, growth pattern, unemployment, inflation, productivity, public debt, poverty, etc.
- Social: Evaluates level of social welfare in terms of life expectancy, labour skills and knowledge, and standard of living
- Technological: Covers adequacy and availability of economic infrastructure and IT technology adoption
- Legal: Covers adequacy of policies and regulations for private sector development, adherence to laws and quality of enforcement, and controls in place to check corruption and bribery
- Environmental: Evaluates how a country protects its population from environmental health risks, and the suitability and availability of natural resources such as land, water, climate, food, energy and mineral resources
Environmental & social
Covers reputational and other risks related to Health and safety, labour compensation, labour rights, sustainability of operations (or production) and product safety
- Social commitment risk is based on the supplier’s engagement with local communities and support to its own suppliers that are either small business enterprises or are majority-owned and operated by ethnic minorities, women and other groups (such as LGBTQ, veterans or the differently abled)
- Health and safety risk is based on measures in place to ensure the health and safety of the workforce
- Wages and benefits risk is based on the adequacy of wages vs. industry standards or as mandated by law
- Rights, diversity and inclusion risk assesses issues related to child or forced labour, labour union and collective bargaining and gender-based discrimination
- Environment risk evaluates adequacy of measures for protection of the environment and judicious usage of natural resources
- Product safety risk assesses adequacy of initiatives to ensure safety during transit and usage by customers
Governance & control
Includes ethical and governance challenges and overall business conduct
- Business ethics risk is based on instances of money laundering or corruption by the company or its senior executives and their political and legal exposure
- Corporate governance risk is based on independence of the board of directors, code of ethics and ESG policy/program, succession plan, internal audit, etc.
- Licenses and approvals risk assesses challenges with relevant trade licenses/permits and checks for sanctions/restrictions in the client’s country
Performance
Covers internal risk signals based on the proposed indicators below (to be finalised in consultation with the client).
- Delivery: On-time delivery %, change requests completed on time, average lead time, and supplier availability for emergency purchases
- Quality and Service: Product defect rates, system uptime, resolutions vs. issues, NPS or customer satisfaction score, and PO and invoice accuracy
- Security: Renewal or lapse of certifications, number of data leakage and network breaches, and existence of BCP protocols
Overall, our risk assessment covers 49 external and 25 internal risk parameters. The top 4 risk types (Financial, Operational, Environmental & social and Governance & control) cover topics that are relevant in today’s world and meet the needs of leading companies globally.
The Governance & control and Environmental & social risk types in particular cover all relevant topics for ESG risk assessment and management; these 2 risk types and the underlying parameters are aligned with globally recognised standards, such as the United Nations Global Compact, World Federation of Exchanges, Global Reporting Initiative and Sustainability Accounting Standards Board.
The illustration below captures our risk assessment and scoring process.
The first step is to collate risk event feeds from different sources. We cover +100,000 news media sources, top social media platforms, regulatory websites, company registrars and exchange commissions, and all major national and global statistics organisations.
Next, we use advanced analytics and machine learning algorithms to filter, classify and rate risk event feeds. Sentence-BERT and LightGBM algorithms are used to filter junk/non-relevant information feeds, while deep learning models are used to classify and score events. Our machine learning models are regularly trained to sharpen risk classification and identification.
To support the risk scoring process, we also analyse supplier financial information and key country indicators, which are then fed into the system. Our clients have the option to include licensed third-party data and internal supplier SLAs/KPIs to get a more holistic view of their suppliers’ risk.
Our robust risk scoring model generates risk scores that provide a holistic view of risk associated with suppliers. The model comprises the following elements:
- Base risk score is the starting point calculated for each sub-risk and risk type using underlying risk parameters. It is based on predefined scoring ranges, which determine what scores to assign for a given value/situation pertaining to a risk parameter
- Risk event score is the rating assigned to each risk event feed depending on its criticality. Risk event feeds can come from varied sources, such as news media, social media or regulators’ websites
- Adjusted risk score is a combination of base risk score and risk event score, and changes whenever there are new risk event feeds for a supplier. It captures the changing risk profile of a supplier over a period of time
The overall risk score is a dynamically weighted average of adjusted risk scores for all sub-risks and risk types. Our risk scoring formula is ‘dynamic’ in the sense that it automatically adjusts weights to show ‘real’ risk when a singular risk event (e.g., reported criminal investigations or labour rights violations) has a material implication for the supplier’s business. This adjustment is required to ensure that the impact of disruptive events is properly captured and projected, and not subdued due to use of weights across multiple parameters.
Our risk specialists are experienced analysts who have been trained to validate risk signals, assess their impact and provide a brief summary of risks associated with a supplier. The succinct risk summary helps clients quickly make sense of different risk indicators and event feeds, thus ensuring meaningful insights.
- If any information pertaining to a supplier is not available, we may leverage parent company information or industry benchmarks
- While we endeavour to cover all risk events reported across the public domain within 24 hours, it may not always be possible due to non-reporting/delayed reporting
- Our solution relies on information disclosed by suppliers or made available by third parties and clients (presuming such information has been lawfully acquired). We will make no attempt to gather information through unlawful or unethical means
- If our solution requires information from or performance of a service by a client, their suppliers and third parties, it will be the primary responsibility of such parties to provide us relevant information or timely service for solution delivery
- While we will take all measures to get information on publicly listed and privately held companies from different sources, we cannot guarantee that the relevant information will always be available and up-to-date
- The category heatmap depicts the category risk profile based on aggregation of supplier risk scores and associated spend by category. It does not reflect risks associated with external aspects, such as market price volatility, supply–demand imbalances and competition among suppliers