Supplier risk monitoring: external risk intelligence and continuous monitoring for manufacturers

What is supplier risk monitoring?

Qualification tells you a supplier was acceptable on the day you approved it. Monitoring tells you whether it still is. It means watching approved suppliers for changes that affect your supply or your compliance, deciding which changes matter given what you buy from each one, and getting each change to the person who owns the supplier with enough context to act.

For a manufacturer, the question behind every alert is the same: what happens to my production if this supplier fails, is sanctioned or has to be replaced? That is why external risk data has to be read together with your own data on spend, quality, delivery and alternative sources.

Which external risks should a manufacturer monitor?

Not every supplier needs every dimension. Cyber matters for suppliers connected to your systems or holding your data; for in-scope entities, the EU NIS2 directive lists supply chain security among the risk-management measures in article 21. Forced-labour exposure and sub-tier evidence are covered in the guide to due diligence beyond Tier 1 and the supplier regulation library.

Where does supplier risk data come from?

Four places. Licensed providers: credit and business information (D&B, Creditsafe, Moody's), ESG ratings (EcoVadis), security ratings. Public sources: sanctions lists, company registries, court and insolvency records, news. The supplier itself: accounts, certificates, questionnaires and audit evidence. And your own systems: spend, POs, receipts, quality records and delivery performance in the ERP and the quality system.

Many teams already license a provider and hold the internal data, but keep them apart: the rating lives in one tool, the spend in the ERP, the 8Ds in the quality system. The value is in reading them together, per supplier.

How should sanctions and PEP screening work after approval?

Screen the entity, its beneficial owners and its directors at onboarding, then again whenever the lists change and whenever ownership changes. For US persons the core list is OFAC's SDN list; entities owned 50% or more, individually or in aggregate, by blocked persons are blocked too. The Consolidated Screening List adds the export-control lists. If you sell into or source from Europe, add the EU and UK lists.

A possible match goes to a person with the evidence: the listed name, the matching fields, and the differences. Politically exposed persons are handled differently: a PEP is not a sanctioned person, but FATF guidance treats PEPs as higher risk and calls for enhanced due diligence. Compliance decides in both cases.

How do you combine external and internal data into one score?

Apply the gates first: a confirmed sanctions match is not averaged away by a good delivery record. Then score each dimension on your own scale, with your own weights, and show the reason behind every point. The internal side usually includes:

The same credit score means different things on a sole-source casting supplier and on an office supplies vendor. Exposure is what turns a signal into a priority. How quality and PPAP status feed the record is covered in the guide to technical and quality supplier qualification.

What does continuous monitoring look like in practice?

1. Decide which suppliers are monitored, and how closely

   Tier the supplier base by exposure: sole-source and high-spend suppliers of production material get every signal; low-risk indirect suppliers may only need sanctions and expiries.

2. Set what counts as a change

   For each dimension, write down the threshold that should reach a person: a score falling below a value on your scale, any new sanctions match, adverse media in defined categories, a rating downgrade.

3. Watch the sources continuously

   Re-screen against sanctions lists when they change, refresh financial and ESG data when the provider updates it, and read the news and filings linked to the entity and its owners.

4. Send the change to the owner with context

   The alert names the supplier, what changed, the source, the date, the previous value, and what is exposed on your side: spend, open POs, parts with no second source.

5. A person decides

   The category manager or supplier owner decides: no action, watch, ask the supplier for information, start qualifying an alternative, put new orders on hold, or escalate to compliance or legal. The decision and its reason go on the supplier's record.

6. Follow through with the supplier

   If the supplier needs to explain a filing, send updated accounts or provide evidence for an allegation, the request goes by email and is followed up until it is answered.

This is what one alert carries. Illustrative example with sample data, not a customer record.

How do you find single-source and concentration risk?

From your own data, not from an external feed. List every part number or material with the suppliers approved to supply it, then cross that list with POs and spend. The result shows parts with one qualified source, categories where one supplier holds most of the spend, and suppliers for which you are a large share of their business. For each single-source part with high exposure, a person decides whether to accept the risk, hold safety stock or qualify an alternative, and the qualification of that alternative starts like any other.

Common mistakes

• Screening suppliers once at onboarding and never again.
• Screening the entity but not its owners and directors.
• Buying a rating feed that nobody reads, or that alerts on every supplier the same way regardless of exposure.
• Scoring external data without your own: a weak score on a supplier you spend little with is not the same as on a sole source.
• Alerts that reach a shared inbox with no owner, no context and no record of the decision.
• Contacting suppliers through channels that leave no record. Requests and replies belong on the supplier's file.

What does Traza do in supplier risk, and where does a person decide?

Traza is a source-to-pay suite run by AI agents. It runs as your suite and system of record, or on top of the SAP, Ariba, Coupa or Oracle you keep. In supplier risk, Nora works on the same supplier record she builds during qualification:

• Data: Traza's own risk data feed, plus the providers you already license, such as D&B, Creditsafe, Moody's and EcoVadis. Which feeds are connected is agreed when the pilot is scoped.
• Score: external data combined with your spend, quality, delivery, compliance and dependency data into one score on your scale, with your gates and the reason behind every point.
• Monitoring: approved suppliers watched continuously, re-screened against sanctions and PEP lists, with financial, ESG and adverse media changes picked up as they are published.
• Alerts: each change sent to the supplier owner in Microsoft Teams or Slack, with the source, the previous value and your exposure.
• Follow-up: when the supplier needs to explain or provide evidence, Nora asks by email and follows up until it answers.

A person decides what each change means: keep, watch, ask for information, qualify an alternative, hold new orders or escalate. Sanctions matches go to compliance. Nothing is changed in the supplier's status in your ERP until that person approves. For the approval at the start of the relationship, see the supplier qualification guide; for how suppliers are handled without a portal, the guide to supplier management without a supplier portal.

To see your supplier base scored with your own data, book a call.

Frequently asked questions

This article is for information and is not legal advice. Practices and references are for the United States; check what applies to your contracts and your state.