Rating supplier risk on two axes: impact and likelihood

Most organizations do not suffer from a lack of supply chain data. They suffer from too many signals that nobody can compare. A lead-time warning from one supplier, a price spike in a commodity, a compliance question on a product family — each arrives in its own format, through its own channel, and lands on a different desk.

In my current advisory work on a large infrastructure program, one of the most useful things we built was not a new data source. It was a common language for risk.

Two questions, asked the same way every time

A dual-axis framework asks two questions about every supplier and product family: if this goes wrong, how much does it hurt (impact), and how likely is it to go wrong (likelihood)? Each axis is scored against defined criteria, and the combination produces a standardized Low, Medium, or High rating.

• Impact captures what is at stake: schedule, cost, compliance exposure, and how many projects depend on the item.
• Likelihood captures what the market is telling us: availability, lead times, concentration of supply, and emerging constraints.
• The rating is only the start — each level maps to a defined set of mitigation and sourcing considerations.

Why simple beats sophisticated here

It is tempting to build a scoring model with dozens of weighted variables. In practice, the people who need to act on a rating — program managers, procurement leads, executives — need to understand why something is rated High in one sentence. A transparent two-axis view earns trust, and trust is what gets a mitigation plan funded.

A risk rating is only useful if the person reading it can explain it to someone else.

Where AI fits

Once the framework is stable, AI-enabled and agentic approaches can help monitor suppliers and products continuously, flag when the inputs behind a rating change, and draft the first version of an assessment for a human to review. The framework stays the anchor; automation keeps it current.

If you are building supplier risk processes — for public programs with Build America, Buy America requirements or for private manufacturing networks — I am always glad to compare notes.