— Procurement & Vendors

Supplier risk review

Assesses supplier evidence against procurement criteria to produce a rated review of operational, financial, information-security and dependency risks, with mitigations and proposed contract conditions.

  • Procurement & Vendors
  • Traceable reasoning
  • Runs anywhere
Preview methodology

2–3 weeks → ~25 minutes

For a typical multi-document review workflow

No coding required

Input
Supplier proposals and information packs
Output
Structured supplier profile
Runs in
Skillsize · ChatGPT · Claude · Copilot
Export
SKILL.md · MCP
Time saved
~2–3 weeks per run

— USE CASES

What people use Supplier risk review for

New supplier assessment

Provides a structured supplier profile and ratings against the organisation’s review criteria. Sets out material risks, evidence gaps and proposed safeguards to support an approval decision.

Critical supplier renewal

Assesses operational resilience, financial viability and dependency exposure at renewal. Identifies mitigations and contract conditions that address the risks of continued reliance.

Security-sensitive procurement review

Examines supplier policies, security questionnaire responses, certificates and incident history against information-security criteria. Documents concerns and proposed conditions for handling sensitive information.

Supplier concentration assessment

Evaluates concentration and dependency risks using the available supplier evidence and review criteria. Clarifies where reliance creates exposure and proposes measures to reduce it.

What it works from

  • Supplier proposals and information packs
  • Operational policies and security questionnaires
  • Certificates and supporting assurance evidence
  • Supplier accounts and financial information available for research purposes

What you get back

  • Structured supplier profile
  • Criterion-by-criterion risk ratings and supporting rationale
  • Financial viability, ownership and incident history findings
  • Overall supplier risk assessment and material evidence gaps for further review purposes

— HOW IT BEHAVES

How Supplier risk review produces its result

The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.

Scored against your criteria

Each risk is assessed against criteria you control and weight, so the same standard applies to every risk in the risk universe in scope.

Risk registers, controls and policy documents pulled into one schema

Every risk is captured in the same field structure, so records drawn from different documents and sources stay comparable.

Whole sets of risk registers, controls and policy documents at once

All of your risk registers, controls and policy documents is processed as one set, so patterns across documents surface instead of being read one file at a time.

Live research on the risk universe in scope

Current external sources on the risk universe in scope are researched during the run rather than recalled from training data, and every source travels with the output.

Composed as work product

Findings on the risk universe in scope are written up as a document that reads like professional output, with each claim tied back to a risk.

Why this is expensive by hand

Supplier decisions often depend on evidence spread across proposals, policies, accounts and security questionnaires. New supplier assessment is the typical trigger — provides a structured supplier profile and ratings against the organisation’s review criteria. Sets out material risks, evidence gaps and proposed safeguards to support an approval decision. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 2–3 weeks of manual work.

How this Skill produces it

As a Skill, the work is already sequenced. You bring the evidence, and the run produces structured supplier profile plus criterion-by-criterion risk ratings and supporting rationale. The judgement is built in — how items are broken up, what standard they are held to, and where the run stops for a human review. In effect, 2–3 weeks of senior time compresses into ~25 minutes — and the output is comparable across clients, quarters and colleagues instead of shaped by whoever ran it.

Who it's for

  • Procurement and category managers
  • Third-party risk and vendor management teams
  • Bid and proposal teams
  • Consultants running sourcing exercises

Run it in Skillsize — or export it anywhere

Supplier risk review exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.

ChatGPTClaudeCopilotAI Products (MCP)