A supplier risk assessment is the structured evaluation of a supplier's financial, operational, compliance and fraud exposure, carried out before onboarding and repeated during the relationship, to decide whether and on what terms the company can depend on that supplier.
A supplier risk assessment covers five dimensions:
- Financial health: credit rating, payment incidents and dependency on a single customer
- Operational continuity: single-source items, concentration and delivery performance
- Compliance: registration, tax and social security certificates, sanctions lists
- Fraud exposure: bank detail changes, identity inconsistencies and shell company indicators
- ESG and reputation: environmental, social and governance risks carried by the supplier
Regulation frames the assessment in several countries. In France, a buyer contracting for 5,000 euros or more excluding VAT must obtain the supplier's social security vigilance certificate at signature and every six months (Labour Code, article L. 8222-1), and the Sapin II law requires companies with at least 500 employees and 100 million euros of revenue to assess their suppliers for corruption risk.
Assessment at onboarding is necessary but not sufficient. Risk moves during the relationship: bank details change, invoices start arriving from a new address, prices drift away from the contract. Continuous monitoring of transactional signals, a detective layer on top of the preventive onboarding check described in preventive vs detective control, catches what an annual questionnaire cannot, particularly in construction, where subcontractor billing control adds its own requirements.
Phacet monitors those transactional signals. The agent that can clean and enrich your supplier database keeps supplier master data reliable, the agent that can detect fake IBAN fraud checks every bank detail change, and supplier price variance is tracked invoice by invoice.
