Supplier risk scoring without the quarterly spreadsheet argument

Most supplier risk programmes fail the same way: the questionnaire is 180
questions long, it goes out once a year, and by the time it comes back nobody
remembers why they asked.

Score four things, not forty

1. Access — what of ours can they reach?
2. Concentration — what stops if they stop?
3. Posture — do they have the basics, evidenced?
4. History — have they had an incident, and how did they behave?

Re-score on events, not on the calendar

A supplier who changes hands, moves their hosting, or has an incident should be
re-scored that week. One who has done none of those things does not need
re-scoring because a quarter has ended.