What is supply chain risk assessment?
Supply chain risk assessment is the systematic mapping, evaluation and mitigation of the risks threatening your supply chain, from sourcing at suppliers to delivery at customers. The goal is to make vulnerabilities visible before they lead to continuity issues, and to identify targeted mitigation measures proportionate to the risks.
After the pandemic and the geopolitical shocks of the years thereafter, supply chain risk has become a boardroom level discussion in virtually every sector. What used to be a checkbox in an audit is now a strategic core competency through which companies safeguard their continuity and prove their agility to investors, customers and regulators.
A good assessment is not just a list of risks with colors. It is a factual substantiation of where your chain is vulnerable, what it costs to accept that vulnerability, and what it costs to reduce it. On that basis management can make informed decisions, not react defensively to the next crisis.
When is an assessment relevant?
A structured assessment is sensible at multiple moments. With ESG or CSRD compliance requirements where due diligence of the chain is mandatory. With board questions about supply chain resilience, often triggered by incidents at competitors or in the sector. With geographic concentrations sensitive to geopolitical developments (China, Russia, conflict zones). With M&A processes where the target company's chain must be evaluated. Or with insurers and credit providers asking for factual substantiation of the risk profile.
For shippers with international operations and geographically concentrated suppliers or customer base, a periodic assessment is also a form of insurance against surprises that otherwise only become visible when they already cause problems.
Our approach
We map your supply chain fully: suppliers (tier 1 and where possible tier 2), production facilities, transport routes, distribution centers, and customers. Per node we record the critical dependencies.
Per risk category (geopolitical, supplier, transport, operational, regulatory, cyber) we inventory the relevant risks for your chain. This yields a longlist of potential vulnerabilities.
Per risk we assess probability and impact, weighted against your sector and company-specific context. The result is a heatmap that visually shows where the chain is most vulnerable.
Per prioritized risk we identify mitigation options (diversification, buffer inventory, alternative routes, contractual protection) and make a cost-benefit per option. Not every risk is worth fully eliminating.
We deliver a decision document with prioritized mitigation measures, an implementation timeline, and a governance model for periodic recalibration. Including board-ready presentation.
What you get
- Complete supply chain map with dependencies and critical nodes
- Risk register per category with scoring and substantiation
- Visual heatmap of risks, ready for communication
- Mitigation options matrix with cost-benefit per measure
- Prioritized action plan with timeline and ownership
- Governance model for periodic recalibration and monitoring
- Board-ready presentation for decision-making
Frequently asked questions
What is the difference with general business continuity planning?
Business continuity planning looks broadly at all business risks (IT, facility, personnel, customer concentration). Supply chain risk assessment looks specifically at risks in your sourcing, production and distribution chain. The approach is more structured and more detailed on the logistics aspects, and delivers concrete mitigation measures that for BCP often remain too superficial.
How often should this be repeated?
A full assessment is typically sensible every two to three years, with a light annual recalibration. With significant changes in geopolitics, your supplier portfolio or your product mix, an intermediate retest on the specific change is sensible. For some sectors (semiconductors, critical raw materials) a yearly full assessment is more realistic.
Which risks are included?
We work with six risk categories: geopolitical (sanctions, trade barriers), supplier concentration and financial stability, transport and routes, operational (capacity, quality), regulatory and compliance (ESG, customs, product safety), and cyber/IT risks in the chain. The depth per category depends on your sector and specific vulnerabilities.
How do you handle geopolitical uncertainty?
Geopolitical uncertainty does not predict itself but can be modeled. We work with scenarios (baseline, tense, escalation) per relevant region and test your supply chain against each scenario. The end goal is not exact prediction but a chain that is robust against a reasonable range of geopolitical outcomes.
What are typical outcomes of such an assessment?
The most common recommendations are diversification of single-source dependencies, revision of transport routes (alternative plan B per critical route), buffer inventory at specific SKUs, supplier audits and certification, and improved monitoring and early-warning indicators. It is rarely one big intervention, more often a set of prioritized measures with different horizons.
A risk assessment for your supply chain?
Schedule a call where we walk through which scope and which risk categories have priority in your situation.