A sourcing risk register prevents important concerns from disappearing into email threads. It should track evidence and decisions, not only label a supplier “high risk.”
Recommended fields
| Field | Purpose |
|---|---|
| Risk statement | Cause, event, and consequence in one sentence |
| Category | Identity, quality, capacity, compliance, logistics, commercial, or continuity |
| Evidence | Source, date, document, interview, test, or observation |
| Likelihood and impact | Defined scoring scale |
| Existing controls | What currently reduces the risk |
| Required action | Evidence or control needed next |
| Owner and due date | Accountability |
| Trigger | Event that requires escalation or a stop |
| Residual decision | Accept, reduce, transfer, avoid, or monitor |
Example risk statement
“Because the proposed coating process is subcontracted to an unidentified facility, an unapproved chemical or color change could cause test failure and shipment delay.”
The action is then specific: identify the subcontractor, approve the coating specification, verify restricted-substance evidence, audit change control, and inspect production lots.
Review points
Review the register before deposit, sample approval, production release, balance payment, shipment, and repeat order. Add triggers for bank-account changes, factory relocation, material substitutions, major staff turnover, repeated inspection failure, new destination rules, and significant freight disruption.
Keep closed risks with their evidence and decision history. They explain why the order was approved and which assumptions must be retested later.