Supplier performance and resilience for manufacturers: KPIs, scorecards and single-source risk

Supplier performance management for a manufacturer measures how each supplier delivers (OTIF, lead time and its variance), the quality of what arrives (PPM or rejection rate, nonconformances and 8D closure), what it costs against what was agreed (price variance) and how fast the supplier responds.
The KPIs come from records the ERP and quality system already hold: purchase order lines with confirmed dates, goods receipts, inspection results, nonconformance reports and invoices. The work is joining them per supplier and per part, every period, with the same definitions.
A scorecard is useful when it leads to a decision: a corrective action plan, a change in volume, a second source qualified, or the supplier delisted. Those decisions belong to the buyer or category manager, with quality for anything that touches the part.
Resilience is measured separately from performance: which parts depend on one qualified supplier, one site or one region, and which alternatives are already qualified or could be.
Traza calculates the KPIs from your ERP and quality records, prepares the scorecard and the review pack, chases suppliers by email for corrective actions, flags single-source dependencies with alternatives, and alerts the buyer in Microsoft Teams or Slack. The buyer decides what happens next.

What does supplier performance management cover in manufacturing?

It answers four questions about each supplier, every period, with the same definitions: does it deliver what was ordered when it was agreed, is what arrives right, does it cost what was agreed, and does it respond when something goes wrong. For direct materials those answers decide whether a production line runs, so the review ends in a decision: keep the supplier as is, agree a corrective action, move volume, qualify a second source, or delist.

Resilience is the other half. A supplier can score well and still be a risk if it is the only qualified source for a part, or if several of your suppliers depend on the same site or the same raw material. ISO 9001 (clause 8.4) asks you to define criteria for the evaluation, monitoring of performance and re-evaluation of external providers, and IATF 16949 adds specific supplier monitoring indicators for automotive, such as delivered part quality, disruptions at your plant and delivery schedule performance. Your customers' requirements usually come on top.

Which KPIs belong on a supplier scorecard?

Few, defined precisely, and calculated from records rather than impressions. Each KPI below lists where the data comes from and the definition choice that causes most disputes with suppliers.

KPI	What it measures	Data source	Definition to agree first
OTIF (on time, in full)	Share of PO lines received in full quantity on or before the agreed date.	PO lines with confirmed delivery dates; goods receipts.	Decide whether 'on time' is against the requested or the confirmed date, and whether early deliveries count as on time. Keep that definition fixed across suppliers and periods.
Lead time and its variance	Days from PO (or release) to goods receipt, and how much that number moves from one order to the next.	PO or schedule release dates; goods receipt dates.	The average hides the problem. Safety stock and planning depend on the spread, so report the variance or a range, not only the mean.
PPM or rejection rate	Rejected quantity per million received (PPM), or rejected lots over lots received.	Incoming inspection results, quality notifications, returns to supplier.	Agree what counts: rejections at incoming inspection only, or also defects found on the line and at your customer.
Nonconformances and 8D closure	Number of NCs per period, days each stays open, and whether the 8D reached a verified corrective action.	Nonconformance log or QMS; 8D reports from the supplier.	An 8D closed on paper is not closed. Track containment, root cause, corrective action and the verification of its effect as separate steps.
Price variance	Invoiced price against the PO or contract price, and paid price against standard cost.	Invoices, PO prices, contract price lists and index clauses.	Separate agreed changes (an index adjustment, a new price list) from drift. Only drift is a performance issue.
Responsiveness	Time to confirm a PO, answer an RFQ, respond to an NC or a request for documents.	PO confirmations, email threads, RFQ replies.	Easy to feel, rarely measured. It is often the earliest signal that a supplier is overloaded.
Compliance status	Certificates current (ISO 9001, IATF 16949, AS9100), insurance and declarations valid.	Supplier file and qualification records.	Not a score on its own; an expired certificate is a gate that overrides the score.

Price variance overlaps with price management: separating an agreed index adjustment from drift needs the contract's clause. The guide to price adjustment clauses covers how those clauses are written, and the three-way match guide how invoice price and quantity differences are caught line by line.

How do you build a scorecard suppliers accept?

Segment first. Strategic and critical suppliers get the full scorecard and a periodic review; the long tail gets a short one and an exception alert.
Set targets per category, not one target for everyone. A castings supplier and a packaging supplier do not share a lead time target.
Weight the KPIs to reflect what hurts your plant. Delivery and quality usually carry most of the weight for direct materials.
Show the evidence. Every figure should open to the PO lines, receipts or NCs behind it, so the supplier can check it.
Keep gates out of the score. An expired certificate or an open containment is not offset by good delivery.
Share the scorecard with the supplier in the same format every period, so the trend is visible to both sides.

An illustrative scorecard for one supplier, with sample data, not a customer record. Targets, weights and values are examples:

KPI (illustrative)	Target	This quarter	Last quarter	Weight	Comment
OTIF	95%	91%	88%	30%	Below target, worse than last quarter
Lead time (days, range)	21 to 28	24 to 39	22 to 30	15%	Spread widened on two part numbers
PPM	500	320	610	25%	Within target
Open 8Ds older than 30 days	0	1	0	10%	One 8D waiting for verification
Price variance vs contract	0%	+1.8%	+0.2%	10%	Increase not covered by the index clause
Response to NC (business days)	2	4	2	10%	Slower since a contact changed

Illustrative example with sample data. On this card the conversation is OTIF and the lead time spread on two part numbers, plus a price increase that the contract's index clause does not cover. PPM is within target and needs no action.

How do you run a periodic supplier review?

Quarterly business reviews (QBRs) with strategic suppliers work when the figures are settled before the meeting and the meeting is spent on actions and decisions.

Fix the period and the data cut
Use the same period for every supplier in the category, usually the last quarter, and freeze the data on one date so the supplier and your team discuss the same numbers.
Send the scorecard before the meeting
The supplier should see the figures and the PO lines behind them in advance. Disputes about a delivery date or a rejected lot are resolved by email before the review, not during it.
Review the trend, not one number
Compare with the previous periods and with the target. A supplier slightly below target and improving needs a different conversation from one above target and getting worse.
Agree actions with owners and dates
Each gap gets a corrective action, a named owner on the supplier's side and a date. Quality issues follow the 8D; delivery issues usually need a capacity or scheduling plan.
Decide on volume and sourcing
The buyer or category manager decides whether volume stays, moves to a second source, or whether a new supplier is qualified. Quality signs off any change that touches the part.
Follow up until the action is verified
Track each action to its date and check the effect in the next period's data. An action without a follow-up is the main reason the same issue comes back at the next review.

How do you find single-source and concentration risk?

Start from the part, not the supplier. For each part number with recent demand, count the suppliers qualified to make it and the suppliers you actually bought it from. Then look at where those suppliers make it.

Dependency	What it means	How to detect it
Single source	Only one supplier is qualified for a part, although others could make it.	Part numbers with one approved supplier in the approved manufacturer or supplier list and in the last 12 months of POs.
Sole source	Only one supplier can make the part (patent, tooling, specification, customer-directed).	Same as above, plus the reason recorded. The response is a contract and stock strategy, not a second source.
Spend concentration	A large share of a category's spend with one supplier.	Spend by supplier per category from POs and invoices.
Site or region concentration	Several suppliers that depend on one site, one region or one logistics route.	Supplier sites in the vendor master and the origin on receipts.
Shared sub-tier	Different direct suppliers that rely on the same raw material or component supplier.	Declarations and bills of material requested from the direct suppliers for the parts in scope.

A dependency matters when it combines with a signal: a single-source part whose supplier's OTIF is falling, whose certificate is about to expire, or whose external risk data changes. Sub-tier dependencies need evidence from your direct suppliers; the Tier 2 and Tier 3 due diligence guide describes how to request it by email, part by part.

How do you find qualified alternatives before you need them?

Qualifying a second source for a direct part takes the documents, the risk checks and, in automotive and similar sectors, a PPAP or first article inspection signed off by quality. That is why alternatives are found before the crisis, in three groups:

Alternative	Where it comes from	Next step
Already qualified for the part	Approved, sometimes with low or no current volume.	Shift volume, after the buyer decides and planning confirms capacity.
Qualified for a similar part or process	Approved in the same commodity, process or material, at another site or for another program.	Request a quote and, for a direct part, a PPAP for this part number.
Known but not qualified	Quoted before, or found in an RFQ or market search.	Run the qualification: documents, certificates, risk checks, then PPAP or first article inspection.

The qualification itself follows the same steps as any new supplier; the supplier qualification guide for manufacturers lists the documents and checks, and the quote comparison guide how to compare the alternatives' offers on a like-for-like basis.

What Traza does, and where people decide

Supplier performance is part of Traza's source-to-pay suite, run by AI agents. Traza calculates each KPI from the records in your ERP and quality system: PO lines and confirmed dates, goods receipts, inspection results and nonconformances, and invoices. It prepares the scorecard and the review pack per supplier, with the evidence behind each figure, and keeps the trend across periods.

When a supplier falls below a threshold you set, or a nonconformance is raised, Traza requests the 8D or corrective action plan from the supplier by email and follows up until it arrives; the supplier replies to the email, with no portal account. It checks each step of the 8D for content and dates and tracks the actions to their deadlines. It flags parts that depend on one qualified supplier, one site or one region, and lists the alternatives already qualified or that could be. Nora runs the qualification of a new source and Leo the RFQ. The buyer is alerted in Microsoft Teams or Slack, with the scorecard and the proposed next step.

Step	Who does it	Who decides
Calculate the KPIs and prepare the scorecard	Traza	The category manager reviews the scorecard before it goes to the supplier.
Send the scorecard and evidence to the supplier	Traza drafts, the buyer sends or approves the send	The buyer.
Request and chase the 8D or corrective action plan by email	Traza	Quality accepts the root cause and verifies the corrective action.
Flag a single-source part and list alternatives	Traza	The buyer decides whether to qualify a second source.
Run the RFQ and qualification for an alternative	Leo for the RFQ, Nora for the supplier qualification	The buyer awards; the quality engineer signs off the part (PPAP or first article).
Shift volume, put a supplier on probation or delist it	Person	The buyer or category manager, with quality and planning.

Every action is logged with the data it used and the person who approved it. How the rest of the suite compares with other source-to-pay options is in how to choose source-to-pay software for a manufacturer.

What data it needs, and from which systems

From the ERP: PO lines with requested and confirmed dates, goods receipts, invoices and the vendor master. Traza connects to SAP, Oracle, NetSuite, Microsoft Dynamics and Workday, among others, and to SAP Ariba, Coupa, Ivalua or Jaggaer when they hold the POs or invoices.
From quality: inspection results, nonconformances and 8D reports, from the QMS or from the log your team keeps, including a spreadsheet.
From contracts: price lists and index clauses, to separate agreed changes from drift.
From the supplier file: certificates and their expiry dates, and the qualification status per part.
External risk: Traza's own risk data feed, plus the D&B, Creditsafe, Moody's or EcoVadis data you already license.

Which fields Traza reads and writes in each system is agreed when the pilot is scoped. It reads where the data lives and writes back, for example a supplier status or a blocked part, only after a person approves. Traza can also run as your supplier record and source-to-pay suite if you prefer not to keep those records elsewhere. How suppliers are managed by email end to end is in supplier management without a new supplier portal.

Frequently asked questions

What KPIs should a manufacturer track for supplier performance?

OTIF, lead time and its variance, PPM or rejection rate, the number of nonconformances and how long their 8D takes to reach a verified corrective action, price variance against the PO or contract, and responsiveness to POs, RFQs and NCs. Certificates and declarations are tracked as a gate rather than as part of the score.

How is OTIF calculated?

OTIF is the share of PO lines received in full quantity on or before the agreed date. Before you calculate it, decide whether the agreed date is the requested or the confirmed one, whether early deliveries count as on time, and whether partial deliveries count per line or per shipment. Keep the definition fixed across suppliers and periods.

How often should supplier performance reviews take place?

A usual cadence is a quarterly review for strategic and critical suppliers and a yearly or half-yearly one for the rest, plus an ad hoc review whenever a serious quality or delivery issue occurs. ISO 9001 and IATF 16949 ask you to monitor and re-evaluate external providers against your own criteria, not on a fixed calendar.

What is the difference between single-source and sole-source?

A single-source part has one qualified supplier although others could make it, so the response is to qualify a second source. A sole-source part can only come from one supplier, because of tooling, a patent, a specification or a customer directive, so the response is a contract, stock and monitoring strategy.

Can supplier performance be measured without a supplier portal?

Yes. The KPIs come from your own ERP and quality records: POs, goods receipts, inspections, nonconformances and invoices. Suppliers receive the scorecard and the requests for corrective action by email and reply to it, with no account to create.

What does Traza do in supplier performance management?

Traza calculates the KPIs from your ERP POs, goods receipts, nonconformances and invoices, prepares the scorecard and the review pack, chases suppliers by email for 8D and corrective action plans, flags parts that depend on one supplier with alternatives already qualified or to qualify, and alerts the buyer in Microsoft Teams or Slack. The buyer or category manager decides on actions, volume shifts and delisting, and quality signs off anything that touches the part.

Keep reading

Sources

This guide describes common practice for supplier performance management in manufacturing as of November 10, 2026. KPI definitions, targets and review cycles depend on your industry, your customers' requirements and your quality system. The scorecard shown is illustrative.