| 1 | Risk-Based Supplier Segmentation | Classify suppliers according to spend, supply continuity impact, product criticality, geographic exposure, regulatory sensitivity, and substitution difficulty. | Approved segmentation model, documented risk assessment, criticality score, country-risk review, and a defined list of strategic or high-risk suppliers. | Qualification rule: Critical suppliers require enhanced due diligence and executive approval before onboarding. | Review at onboarding and at least annually. Owned by procurement and supply chain risk teams. |
| 2 | Financial and Business Viability Screening | Evaluate financial stability, operating history, ownership structure, insurance coverage, production capacity, and dependence on major customers. | Recent financial statements, credit assessment, bank or trade references, ownership disclosure, business continuity information, and capacity profile. | Decision rule: Suppliers with material financial concerns require mitigation, such as reduced exposure, payment controls, or an approved backup source. | Before approval and annually thereafter; quarterly for financially stressed or critical suppliers. |
| 3 | Quality Management Qualification | Require a documented quality management system proportionate to product risk, including process control, inspection, traceability, and corrective action. | Quality certificates where relevant, process maps, inspection plans, calibration records, nonconformance logs, and completed supplier audits. | Minimum expectation: No unresolved critical findings; corrective actions must have an owner, deadline, and effectiveness check. | Initial qualification, periodic audit, and performance review after significant process changes. |
| 4 | Environmental and Social Due Diligence | Screen suppliers for labor rights, health and safety, environmental permits, waste management, emissions controls, and responsible sourcing risks. | Supplier code of conduct acceptance, self-assessment, audit results, permits, incident records, training evidence, and remediation plans. | Escalation rule: Forced labor, child labor, serious safety violations, or illegal environmental practices require immediate investigation and suspension consideration. | At onboarding and risk-based intervals; incidents reported immediately to compliance leadership. |
| 5 | Legal, Regulatory, and Sanctions Screening | Confirm that suppliers can meet applicable product, trade, anti-bribery, data protection, export-control, and sanctions requirements. | Legal entity verification, beneficial ownership information, licenses, regulatory declarations, conflict-of-interest disclosures, and screening records. | Approval condition: No unresolved sanctions match, material bribery concern, falsified document, or prohibited ownership connection. | Before onboarding, upon ownership changes, and through continuous or periodic screening. |
| 6 | Capacity, Capability, and Scalability Assessment | Verify production capability, qualified personnel, equipment, lead times, maintenance controls, capacity headroom, and ability to support demand changes. | Site assessment, capacity model, production records, equipment list, staffing plan, maintenance schedule, and evidence of comparable work. | Qualification rule: Confirmed capacity should cover forecast demand plus an agreed contingency margin for critical items. | Before award, during demand changes, and after major equipment or location changes. |
| 7 | Business Continuity and Resilience Testing | Require documented plans for disruptions involving facilities, utilities, labor, transport, information systems, natural hazards, and key sub-suppliers. | Business continuity plan, recovery priorities, emergency contacts, alternate production arrangements, backup utilities, and test results. | Readiness rule: Critical suppliers must demonstrate recovery objectives and complete a documented continuity test or tabletop exercise. | Plan review at least annually; testing frequency based on supplier criticality and disruption exposure. |
| 8 | Cybersecurity and Data Protection Controls | Assess controls for access management, incident response, vulnerability management, encryption, employee awareness, and protection of buyer information. | Security questionnaire, policy documents, access review, incident-response plan, penetration-test summary where applicable, and data-processing agreements. | Risk rule: Suppliers handling sensitive data or connected systems require enhanced controls and documented remediation of high-risk findings. | Before access is granted, annually, and after a material security incident or system change. |
| 9 | Transparent Sub-Tier and Material Traceability | Require disclosure and governance of significant sub-suppliers, production locations, critical materials, and chain-of-custody information. | Approved sub-tier list, country-of-origin records, lot or batch traceability, change-notification process, and mapping of critical inputs. | Control rule: No undisclosed change to a critical sub-tier, material, or manufacturing location without buyer approval. | At qualification and whenever a material, process, site, or sub-tier changes. |
| 10 | Performance Governance and Continuous Improvement | Use a consistent scorecard covering quality, delivery, responsiveness, cost management, compliance, resilience, and corrective-action effectiveness. | Documented service levels, scorecard definitions, audit trail, corrective-action workflow, review minutes, and improvement projects. | Performance rule: Repeated failure against agreed targets triggers a corrective-action plan, escalation, probation, or requalification decision. | Monthly or quarterly reviews according to supplier criticality; annual requalification for key suppliers. |