On this page
Key takeaways
- Procurement risk management is the practice of finding, scoring and acting on risks that arise from how and from whom an organization buys.
- Think at category level. A register that lists each supplier cannot be kept up to date. A register by category can.
- Score each risk on likelihood and impact, assign an owner and write a response. A risk without an owner is a worry, not a managed risk.
- McKinsey's 2025 survey of 100 companies found 95 percent have visibility into tier-one supplier risks but only 42 percent extend it to tier two or beyond.
- Review the register on a calendar, not when something breaks.
Free PDF: Procurement risk register template. Get it below
A food manufacturer buys a flavoring from one supplier. It has never been a problem, so it is not on anyone's list. One spring the supplier loses a key ingredient source, deliveries stop and two production lines idle for a week. The buyer finds the supplier was flagged as a concern in a conversation eight months earlier, but the concern lived in her head. Nothing was written down, nobody owned it, and nothing was done.
That example is invented. The shape is not: risk that exists but has no home in a register. Fixing that is what this guide covers.
Procurement risk management is the structured process of identifying, assessing, responding to and monitoring risks that come from an organization's purchasing and its supplier base, including supply, cost, quality, conduct and legal risks.
What kinds of risk does procurement carry?
| Risk type | Example | Who feels it first |
|---|---|---|
| Supply | Single supplier fails, port delay, raw material shortage | Operations |
| Cost | Price spike, currency swing, tariff change | Finance |
| Quality | Defective batch, failed inspection | Operations and customers |
| Conduct | Bribery, conflict of interest, fraud | Legal and audit |
| Legal and regulatory | New rule on sourcing, sanctions, data protection | Legal |
| Cyber and data | A vendor suffers a breach that exposes your data | IT and security |
| Reputation | A supplier is exposed for poor labor practices | Brand and leadership |
McKinsey's 2025 survey of 100 companies on supply chain risk found that 82 percent said new tariffs affect their supply chains, and 39 percent saw higher supplier and material costs. Cost risk of that kind needs a response written down before the notice arrives, not after.
How is this different from vendor risk management?
Our vendor risk management guide is about assessing individual third parties, usually software and service vendors, for security and compliance. Procurement risk management sits one level up. It looks at risk by category and across the buying process, including supply continuity, price exposure and conduct, and it uses vendor assessments as one input. Likewise, manual procurement risks covers the dangers of paper and spreadsheet processes, which is one source of risk inside the register described here.
How do you build the register?
- List your categories. Start with the top ten by spend and any category that feeds critical operations.
- Ask four questions of each. What happens if the main supplier stops? What if prices move 20 percent? What if the supplier breaks a law on our behalf? What if their data leaks?
- Write each risk as a sentence. "If supplier X cannot deliver for four weeks, line 2 stops." Specific sentences are scorable. Vague headings are not.
- Score likelihood and impact. A three point scale is enough: low, medium, high. Multiply or use a simple grid.
- Name an owner and a response. Accept, reduce, transfer or avoid, with a date for the next step.
- Set a review date. Monthly for the top risks, quarterly for the rest.
Free PDF
Procurement risk register template
A working register with category rows, likelihood and impact scoring, owners and responses, plus a review calendar and a tier two visibility starter.
- Register layout with scoring grid
- Four questions to ask of each category
- Response and owner columns
- Review calendar and tier two prompts
How should you score and respond?
| Likelihood | Impact low | Impact medium | Impact high |
|---|---|---|---|
| High | Monitor | Reduce now | Act immediately |
| Medium | Accept | Monitor | Reduce now |
| Low | Accept | Accept | Monitor and plan |
The grid is a simple version of what most risk teams use. Adjust the labels to match your company's own scale if one exists, because a procurement register that uses different words from the enterprise risk team will not be read.
Responses fall into four groups. Reduce means act to lower likelihood or impact, for example by qualifying a second supplier. Transfer means shift the cost, for example through insurance or contract terms. Avoid means stop the activity. Accept means record the risk and live with it knowingly.
What does visibility beyond tier one look like?
Most of the surprises in the McKinsey data sit past your direct suppliers. The survey found 95 percent of respondents see tier-one supplier risks, 58 percent have mapped tier-two suppliers, and fewer than half have regular direct contact with them. Start with your three most critical categories and ask each tier-one supplier who their critical suppliers are. You will not map the whole chain, and you do not need to. You need to know where a single failure upstream would stop you. The legal duties in this area are covered in supply chain due diligence.
What mistakes make registers useless?
- Too long. A register with 200 lines is read by no one. Keep the live list to what you will review.
- No owner. Each risk needs a named person, not a department.
- Scoring once. Risk changes. A register not reviewed in six months is history.
- Mixing risk with issues. A risk may happen. An issue has happened. Keep them in different lists.
- Ignoring conduct risk. Fraud and bribery belong in the register, and the guides on procurement fraud and procurement compliance cover them.
The procurement audit guide shows how an internal audit team tests whether the register and the responses work, and the procurement strategy pillar places risk among the other five questions a plan answers.
Sources
- McKinsey, supply chain risk survey: 100 companies, article dated December 2025.
- The register steps, scoring grid and response groups follow common risk practice and are our own presentation of it.
Frequently asked questions
What is procurement risk management?
It is the structured process of identifying, assessing, responding to and monitoring risks that come from an organization's purchasing and its supplier base, including supply, cost, quality, conduct and legal risks.
What are the main types of procurement risk?
The main types are supply, cost, quality, conduct, legal and regulatory, cyber and data, and reputation risk. Each has a different owner and a different early warning sign.
How do you create a procurement risk register?
List your top categories, ask what happens if the main supplier stops, prices move, the supplier breaks a law or its data leaks, write each risk as a specific sentence, score it, assign an owner and set a review date.
How often should a procurement risk register be reviewed?
Review the top risks monthly and the rest quarterly. Also review after any major event such as a supplier failure, a regulatory change or a large acquisition.
How is procurement risk different from vendor risk?
Vendor risk focuses on assessing individual third parties, often for security and compliance. Procurement risk works at category and process level, covering supply continuity, price exposure and conduct, and uses vendor assessments as an input.