Suppliers Assessment

Supplier risk assessment is essential for several key reasons: 

• Suppliers can introduce a range of risks, including security vulnerabilities, operational disruptions, and compliance issues. By assessing supplier risks regularly, organizations can identify potential threats before they escalate and take proactive measures to mitigate them. 

•  Many suppliers may have access to sensitive data or critical infrastructure. Regular assessments ensure that suppliers continue to adhere to necessary regulations and contractual obligations, reducing the risk of non-compliance. 

• Suppliers play a crucial role in the smooth operation of many business functions. By assessing the risk of supplier relationships, organizations can ensure that suppliers are capable of meeting their service level agreements and will not cause operational disruptions. 

• If a supplier’s actions lead to a security breach or service failure, it can damage the organization’s reputation. Regular supplier assessments help prevent these incidents and ensure that suppliers meet the required standards of performance and security. 

•  Supplier relationships and their associated risks can evolve over time. By regularly reviewing supplier performance and contractual terms, organizations can adapt their risk management strategies to account for changes in the supplier’s practices, technology, or business environment. 

The foundation of supplier management processes lies in the Supplier Overview and the associated Risk Profile, as well as the Supplier Management Procedure that outlines the governance framework for engaging, managing, and offboarding suppliers. For suppliers classified as high-risk, as well as for any other supplier deemed to require additional assessment based on factors such as the services provided, the scope of data shared, and other pertinent considerations, it is essential to conduct additional risk assessment. The designated Supplier Owner is responsible for executing these assessments. However, multiple owners may be involved depending on the information they manage. It is essential that each owner reviews the relevant guidelines and follows the prescribed steps to ensure a consistent and effective assessment process. 

STEP 1: Supplier Overview and Profiling: Ensure that all relevant supplier information has been added to the Supplier Overview and that the suppliers have been profiled according to security, quality and business continuity criteria (low, medium, or high). Once all required information is populated, Compleye Online will automatically select suppliers marked as High Risk in their profile. These suppliers will be visible in the section, but additional suppliers can be added if deemed important for assessment by selecting ‘Add New’ from the dropdown list of all suppliers from the Supplier Overview

STEP 2: Supplier Assessment: To start the supplier assessment, click the Edit button (yellow, top-right corner) after selecting a supplier. The first decision to make is whether the supplier is ISO 27001 certified. Based on your selection, you will be prompted with different assessment questions. Note: For High-Risk Suppliers, it is advisable to work exclusively with ISO 27001 certified companies. If the supplier is not ISO 27001 certified, additional checks and controls will be required. However, if you have a strong, established relationship with a supplier and know them well, you may have more flexibility in managing the relationship. All relevant supplier information from the Supplier Overview will be available on the top-right section, making it easier to complete the assessment. 

STEP 3: Conduct the Assessment: Begin by filling in the necessary information. Helper buttons are available to guide you through the process. You will perform various checks and, at the end of the assessment, define the residual risk and identify any required improvements. Ensure that you address all High-Risk Suppliers assigned to you as the Supplier Owner. 

STEP 4: Risk Evaluation and Approval: After completing the assessment and assigning the residual risk, ensure that C-level management reviews and evaluates the findings. They will then approve the residual risk either as is or with recommended improvements and sign off using the ‘Reviews & Approval of Residual Risk Tab’ 

STEP 5: Finalize the Assessment: Congratulations! You have successfully completed the supplier assessment. As a final step, make sure to document any identified improvements in the ‘Improvements Section’ 

Select Domain Scope