When a manufacturer implements a supplier risk assessment system, a company-wide supplier grade cannot show which production line might stop tomorrow. One supplier may provide both an easily substituted catalog item and a part made with a dedicated tool for one plant. This guide explains how a manufacturer in Thailand can map exposure by supplier, part and receiving plant, identify true single-source items, qualify alternatives, assign recovery actions and approve the revised risk assessment. For monthly delivery and quality scorecards, see our supplier performance evaluation guide. The decision here is how to protect a specific production plan when supply is disrupted.
Define the unit of disruption before scoring suppliers
Supplier A can have excellent on-time delivery and still present a serious risk if it is the only approved source and usable inventory covers two days. Supplier B can have weaker historic delivery performance but less impact on a particular line when another approved source, buffer stock and a different route are available. An average vendor score hides this difference.
The assessment record should distinguish supplier legal entity, actual manufacturing site, part number and revision, receiving plant, product application and effective dates. Two registered suppliers do not mean two usable sources: the second might be approved only for an older drawing revision or another factory. A change in material, process, tool or customer approval condition can make an apparent substitute unusable. Store those conditions as structured relationships rather than free-text notes.
Microsoft’s Dynamics 365 Supply Chain Management documentation describes a “Single sourced” view for planned-order items assigned to just one vendor. It also explains how historic delivery performance can be applied to planned purchases to express quantities or values at risk. Its published overview explicitly says the initial capability does not provide a holistic assessment of financial, compliance, security and other vendor risks. That distinction is useful when comparing a product demonstration with the scope of your RFP. Sources: overview and workspace.
Map exposure at supplier × part × plant level
Supply exposure means the likely effect on a plant’s requirements, not just the percentage purchased from one company. Compare scheduled demand, usable stock, confirmed orders, goods in transit and the time needed to activate an approved alternative. A useful screen should show when a shortage may begin and which products and customer orders could be affected. The exact calculation must reflect the company’s planning horizon and data quality. Today’s inventory balance alone can be misleading when production increases next week or another plant draws from the same pool.
Connect legal entity and manufacturing site; part and drawing revision; sourcing agreement; receiving plant; bill of materials; inventory location; confirmed and planned demand; alternative source; approval scope; and risk event. Keep the legal entity separate from its production sites. If customer approval or a designated source is required, record that condition too. These links make an incident traceable to affected orders instead of forcing staff to interpret several disconnected spreadsheets.
Consider a hypothetical power module P-100 used in a control cabinet at a Thai plant. The purchasing master lists suppliers A and B. B can make the old revision, but its new revision has not been approved for mass production at that plant. P-100 is currently single sourced for that application. The system must show the number of approved sources for the current revision and plant, plus the steps still needed to approve B, rather than simply showing “two registered vendors.”
Three checks for single-source risk
First, count genuinely qualified sources. A contract, quotation or first sample is not production approval. Link approval to the part revision, production site, process, tooling, receiving plant, customer conditions and effective date. Two companies may still share a critical subcontracted process, creating a common point of failure.
Second, compare time to switch with inventory coverage. A new source may require negotiation, sample inspection, process audit, capacity validation, tool transfer, customer approval and first-lot shipment. There is no responsible universal lead-time number: use records from your own qualification projects and capture best-case, expected and delayed scenarios. A candidate source does not remove the exposure if qualification takes longer than the stock lasts.
Third, check correlated exposure across plants. One manufacturing site may feed three receiving plants. Flooding, utility failure, port disruption or a common raw-material shortage can affect nominally separate routes simultaneously. When tier-two information is unavailable, show the dependency as unknown, not “safe.”
Use risk scores to set the order of decisions
A score should help prioritise work, not claim to predict accidents precisely. Display likelihood signals, impact, time to recover and detection speed separately. Delivery history is one signal; capacity, quality, logistics, disaster exposure and financial information have different sources and update cycles. Show evidence, its owner and age. A stale questionnaire should not look like a current fact.
Set mandatory escalation rules before fine-tuning numeric weights. For example, a safety or regulatory issue, a sole approved source whose switch time exceeds stock coverage, or a reported failure of essential equipment should enter a joint procurement, production and quality review regardless of its aggregate score. Then rank the remaining cases. Test any weighting against your own stoppage costs and incident history; do not present one company’s weights as an industry standard.
Make every warning explainable. Users should see the late receipt, equipment notice, audit finding, expiring approval, inventory coverage or qualification stage behind a red flag. Treat missing evidence as “information needed” with an owner and due date. Microsoft describes reports that slice historical OTIF by product, supplier, shipping method and site and relate it to planned purchases. That is a useful design reference, but its delivery-based measure is not an all-purpose supplier risk score. Source: Microsoft risk reports.
If the company uses a simple “severity × likelihood” formula, do not hide part criticality, recovery feasibility and evidence freshness inside one unexplainable number. Keep the underlying evidence types distinct: delivery delay, site or equipment notice, audit finding, approval validity, stock coverage and alternate qualification. Show which facts are confirmed, self-reported or missing. An unknown field must trigger a verification task instead of silently becoming a low score.
Collect data according to decision, freshness and ownership
Trying to gather every possible field at launch creates an input burden. Start with parts whose shortage can stop production. Connect supplier and order data from ERP, consumption from MES, demand from planning, nonconformity and approval from quality systems, and arrival estimates from logistics. Plants with different item codes and units must first establish a controlled matching rule.
Update cadence should match each fact. Orders, stock and demand often need daily or event-based synchronization; audits and certificates are governed by review and expiry dates. Show the last update, source and missing fields. Calling a screen “real-time” does not make a weekly third-party feed current.
An ERP vendor code may represent the purchasing company but not the production site. The same company might also appear under different codes at different plants. Preserve legal entity, ordering entity, invoicing entity and manufacturing site separately. Record acquisitions, site moves and outsourced-process changes as history. If ERP allows purchasing while quality has suspended approval, the system must resolve that business conflict rather than blindly accepting the newest timestamp.
Track alternative supplier qualification to a usable state
The point of a supplier risk system is not to color cells red. It is to move a credible alternative from candidate to usable supply. Track confidentiality and drawing exchange, quotation, trial production, inspection, process and capacity review, customer approval, master-data setup and first production receipt by part and plant. Adapt the gates to the product and customer requirements.
“Approved by procurement for commercial dealings” and “approved by quality and engineering for production use” are different states. Record the site, material, process, tool, drawing revision, receiving plant and validity period covered by approval. Even an approved source may lack surge capacity; record the quantity it could actually supply and any allocation conditions.
AIAG describes MMOG/LE as a supplier self-assessment and continuous improvement tool for automotive materials and logistics management. Its public description refers to capacity planning, crisis management and cascading assessment to sub-suppliers. Automotive plants may reuse existing self-assessment evidence, while recognizing that a broad MMOG/LE assessment is not approval of a specific substitute part. Source: AIAG MMOG/LE.
Close the loop from warning to recovery and reapproval
Email alone cannot show who must do what by when. An incident record should identify the event, affected supplier site, part and plant, evidence source, confirmed or unconfirmed impact, immediate containment, owner, due date, status and approver. Keep the supplier’s statement separate from the company’s verified decision. If an alert proves false, close it with a reason rather than deleting it.
Compare more than one recovery action: buy from an approved alternate, transfer stock between plants, change freight mode, reschedule production, change design or agree delivery revisions with a customer. Assess quality conditions, cost and time. Emergency use of an unqualified source is a separate approval decision under company, customer and regulatory requirements; a software recommendation should not automatically place an order.
For each candidate action, record the conditions that make it executable instead of entering only a target date. A plant-to-plant transfer requires a quantity that will not create a shortage at the sending plant, transit time and any incoming inspection. Air freight requires suitable packaging, temperature conditions, customs documents and a freight quote. Rescheduling production may create changeover time and delay another customer’s order. An option with unverified conditions should not appear as a ready recovery plan. Distinguish candidate, checking conditions, approved, in progress and effectiveness verified, so the next owner knows exactly what remains to be done.
Do not simply add alerts together when incidents overlap. If two parts in the same product come from the same manufacturing site, its shutdown is one shared cause, not two independent events. One action may solve both shortages, or only one. Prioritizing scarce inventory for one product may shift the shortage to another customer order. The action view should trace incident, part, product and customer order together and show how each proposed allocation changes the affected set.
After supply resumes, confirm whether temporary freight or substitution became permanent, whether the provisional source received full approval and how stock policies or order shares should be restored. Compare the actual shortage duration with the forecast. Verify corrective actions and reapprove the risk status for the affected part and plant. Our supplier portal guide covers document exchange and day-to-day supplier responses. A self-reported portal response should not be confused with internally verified approval.
Set authority and language rules for Thai plants
Head-office sourcing, local receiving, quality approval and customer communication often belong to different teams. Define who receives alerts, calculates impact, authorizes alternative use and informs customers. When dual sourcing requires investment, the screen should assemble a decision record for management rather than leaving the local plant with an unresolved warning.
Use part numbers and revisions as matching keys, not translated item names. If staff write an abnormality in Thai and it is summarized in English or Japanese, keep the original and translated record together. Restrict access by plant, team and case. A supplier portal user should update that supplier’s answers and attachments, not internal risk scores or another supplier’s information. An audit trail should show who changed approval and on which evidence.
Separate authority to raise an alert, confirm the production impact, approve emergency use, authorize spending and notify the customer. Define an alternate approver for night shifts and absences. Where a dual-source qualification needs investment, the decision record should include the expected downtime exposure, validation cost and owner of the final approval. Keep supplier self-declarations visibly separate from verified engineering and quality decisions so a commercial registration cannot override a production-use hold.
Minimum data set for the first release
Choose a high-impact product family and one plant before rolling out across all items. Measure missing values as a launch metric. The following data lets a team make the first useful decisions.
| Data | Minimum fields | Critical check |
|---|---|---|
| Supplier and site | Legal ID, site ID, contact, process | Separate order recipient from actual maker |
| Part and specification | Part ID, revision, material, criticality | Do not count an old-revision source as current |
| Plant and demand | Receiving plant, BOM, planned demand, customer rule | Avoid double counting demand |
| Supply and stock | Confirmed orders, in-transit, usable stock, allocation | Exclude blocked inventory |
| Qualification | Approved scope, expiry, capacity, approver | Do not call a quotation production approval |
| Event and action | Incident, impact, owner, due date, reapproval | Update assessment after recovery |
Identify a system of record and responsible department for each field. A supplier declaration, ERP record and quality decision are different types of evidence. Define which wins when they conflict. Data integration does not replace an approval rule.
What to put in the RFP
Ask vendors to demonstrate a real decision scenario, not simply a colorful dashboard. For example: the only approved maker of a Thai plant part reports equipment failure; stock covers three days; another site’s sample passed but mass-production approval remains open. Ask the vendor to show affected products and customer orders, remaining approval gates, notification, action ownership and closure evidence in one flow.
Functional requirements should cover part/site/revision relationships, single-source detection, shortage timing using demand and usable stock, alternative qualification, evidence-backed approvals, overdue alerts and incident-to-reapproval history. Technical requirements should cover ERP, MES and quality interfaces, retry after synchronization failure, permissions, audit logs, multilingual screens and data export. For outside risk feeds, ask about source, rights, update frequency and outage handling.
Compare total implementation cost, not only license fees. Separate the work of cleaning supplier–part mappings, migrating approval history, licensing outside data, modifying existing systems, training the Thai plant and maintaining data after launch. A demonstration that looks automated may still require someone to upload a spreadsheet every week. Conversely, real-time integration of everything can increase initial cost and support effort without improving the decisions that matter. State which feed refreshes at what interval, who is notified when a transfer fails and how missing records are replayed after recovery.
Give every prospective vendor the same scenario and dataset. Include inconsistent item codes, expired approvals, partial deliveries and quality-blocked stock. Ask the vendor to identify any manual correction made during the demonstration. Require each capability to be marked as available in the standard product, achievable by configuration, requiring custom development or unavailable. This exposes cost and lead-time differences that a generic proposal may conceal. It also prevents the critical single-source check or approval history from becoming an unplanned late development task.
Require explainable scores. Check whether “single source” means just one vendor code, whether two sites of one company are distinguished, and what happens when a new supplier has no delivery history. An administrator should be able to change thresholds with a change log.
FAT and SAT acceptance tests
For factory acceptance testing (FAT), load cases with two fully approved sources, two sites of one legal entity, an alternative approved only for the prior revision, an alternative with insufficient capacity and quality-blocked stock. Define expected results before the test. Check the single-source flag, exposure, notification and approval path, rather than accepting a polished demo dataset.
For site acceptance testing (SAT), use real Thai plant data and the staff who will run the process. Test local item codes, inventory status, Thai text, connectivity, night-shift escalation and delegated approvals. Time the sequence from alert to affected-order identification, action assignment, quality decision and reassessment. Acceptance means that staff have the evidence to act and can complete the next step, not merely that a page opens.
Keep test data, screenshots, discrepancies and fixes. Repeat the important scenarios after item-code changes, workflow changes, upgrades and rollout to another plant.
Phased rollout and useful measures
First, map single-source items for one product family and plant. Success at this stage is discovering hidden dependencies and missing data, not making every red flag disappear. Count sources approved for real production, not names on a candidate list. Next, attach qualification and recovery actions to the highest-impact items and test whether procurement and quality see the same state. Then expand ERP, MES, quality and portal integration and look for shared dependencies across plants.
Do not select only suppliers with a recent problem for the pilot. Include a part whose deliveries have been stable but whose only tool or material creates a hidden dependency; this reveals the difference from a traditional scorecard. Include both an item with a relatively straightforward alternative qualification and one that needs lengthy customer approval, to test workflow branches. Fix the pilot’s item population and exclusion criteria at the start, then record newly discovered dependencies separately. Changing the denominator during the pilot can make improvement percentages misleading.
Useful leading measures include the share of critical items with a known maker and site; the share with a documented alternative approval stage; time from a major alert to identification of affected products; overdue corrective actions; and incidents fully reapproved. Track actual shortages and stoppages separately. A short period without a disruption is not proof that the system works.
Keep metric definitions consistent. “Alternative available” might mean a candidate was found, a sample passed or mass-production approval is complete; those definitions produce very different percentages. In this guide, a usable alternate has completed approval for production use, while earlier stages are reported separately. Likewise, distinguish the day an action owner marks work done from the day procurement or quality verifies its effect. Fixed definitions are necessary before comparing plants or measuring change from the pre-launch baseline.
Record examples where an alert actually changed a decision. More alerts are not a benefit if staff become overloaded and ignore them. Conversely, finding an unapproved source for a critical part and bringing its qualification forward has value even if few alerts were generated. At the monthly review, inspect false alarms, missed issues and delayed responses, then decide whether the data, thresholds or ownership needs adjustment. Feed those changes into the next plant rollout so the system becomes an operating process rather than a one-time inventory exercise.
Calculate your own business case from possible stoppage losses, test and qualification costs, buffer stock, dual-source price differences and operating effort. AIAG’s public examples of reported benefits should not be treated as a guarantee for your deployment. Record assumptions and actual outcomes separately and revisit them periodically.
How to use ISO 9001 and industry guidance
ISO’s public explanation of ISO 9001:2026 says the revision gives clearer attention to risks and opportunities and links quality management more closely with business decisions. The evidence-based, action-and-review workflow described here is consistent with that direction. We do not claim that a particular clause mandates this software or our scoring model. Confirm certification obligations using the official standard and your certification body. Source: ISO explanation.
For automotive operations, reuse relevant MMOG/LE materials-management assessments rather than duplicating forms. Still distinguish supplier self-assessment, monthly performance, part-specific production approval and emergency-use authorization. Each answers a different question and has a different owner and expiry.
Frequently asked questions
Can we begin supplier risk assessment in Excel?
Yes, for a limited product family and plant. Record part, revision, plant, approved maker, qualification stage, stock coverage and next action. When several plants frequently update orders, stock and approval, file-version conflicts can become a risk. Decide on software from update frequency, permissions, evidence and response time, not just the number of rows.
Does every single-source item need an immediate second supplier?
No. Tooling, testing, audits and split volumes cost money. Strategic stock, design changes, redundant equipment or a priority-supply agreement may be more suitable. Document the reason for single sourcing, the recovery route and its relation to potential loss. A registered candidate is not a qualified second source.
Should financial information be part of the risk score?
It can matter for high-impact suppliers, if rights, availability, refresh and false-positive handling are clear. Missing financial data is “not assessed,” not “safe.” The Microsoft feature discussed above is explicitly limited in scope; verify each product’s actual coverage.
What matters most in RFP, FAT and SAT?
Test your exceptions: an old-revision substitute, common equipment across sites, blocked inventory and a night-shift incident. Verify the full path from exposure identification to action, approval and reassessment.
What if head office and a Thai plant use different item numbers?
Build a controlled cross-reference with revisions and approval history. Do not match by translated name alone. Keep a common ID alongside local codes and verify specification, maker site and customer conditions before merging records.
Conclusion: turn risk assessment into a recovery plan
A manufacturing supplier risk assessment system should show dependency by supplier, part and plant; identify true single sourcing; track alternatives to usable approval; connect events to owners and recovery actions; and record reapproval after corrective work. Start with critical items, put concrete decisions in the RFP, and test exceptions through FAT and SAT.
If you are mapping supplier, part and production-planning data at a Thai plant, or defining the approvals for alternate sources, you can talk with TOMAS TECH while still at the planning stage. A small, focused pilot is a practical starting point.
