A score is a starting point for a conversation, not a verdict. What goes into it, and the three cases where you should look past it.
A risk score squeezes a lot into one number: how critical the supplier is to you, what they told you in their answers, and what public sources say about them.
That makes it useful for sorting a long list. It also makes it easy to over-trust.
What goes into the score
- Criticality: the tier you gave the supplier
- Answers: gaps and weak controls in their questionnaire
- External signals: sanctions, adverse media and financial health
Three times to look past it
1. The answers are old
A good score based on last year's questionnaire says little about today. Check the date before you rely on it.
2. The supplier is new
New suppliers have little history, so the score leans on a few data points. Treat it as provisional.
3. Something changed that the score can't see
A merger, a new subcontractor, a key person leaving. If you know something the data doesn't, trust what you know.
The score tells you where to look first. It doesn't tell you what you'll find.