| 1 | Risk-Based Supplier Segmentation | Country risk, product criticality, operational dependency, financial exposure, and human-rights vulnerability. | Supplier location, ownership structure, annual spend, supply-chain tier, product classification, substitutability, and prior incident history. | At onboarding, after major business changes, and at least annually for active suppliers. | 100% of active suppliers assigned to a documented risk tier; high-risk suppliers reviewed before contract award. | Missing risk classification, critical single-source dependency, or material change in country or product risk. |
| 2 | Supplier Identity and Ownership Verification | Fraud, undisclosed conflicts of interest, beneficial-ownership opacity, and dealings with restricted parties. | Legal registration, registered address, tax information, directors, beneficial owners, authorized representatives, and payment-account details. | Before onboarding; refresh at least every 24 months and whenever ownership or banking information changes. | 100% of suppliers have verified legal-entity records and documented ownership checks. | Inconsistent registration data, unexplained intermediary involvement, or payment to an unrelated account. |
| 3 | Sanctions, Export-Control, and Adverse-Media Screening | Sanctions exposure, restricted trade, forced-labor allegations, corruption concerns, and regulatory enforcement. | Supplier and owner names, operating countries, shipping routes, end-use information, screening results, source records, and case disposition. | Before onboarding, before shipment to sensitive destinations, and continuously or at least quarterly for high-risk suppliers. | 100% of high-risk suppliers screened before approval; potential matches resolved before transactions proceed. | Unresolved screening alert, prohibited end use, or credible adverse information requiring investigation. |
| 4 | Contractual Standards and Flow-Down Controls | Non-compliance involving labor rights, anti-bribery, data protection, environmental duties, quality, and subcontracting. | Signed supplier code, audit rights, reporting duties, records-retention terms, remediation obligations, termination rights, and approved subcontractor list. | At contract award and renewal; review clauses whenever laws, products, or sourcing locations materially change. | 100% of new contracts contain mandatory compliance clauses; subcontracting changes are pre-approved. | Refusal of audit rights, unauthorized subcontracting, or missing flow-down obligations in a multi-tier supply chain. |
| 5 | Human-Rights and Responsible-Sourcing Verification | Child labor, forced labor, unsafe working conditions, excessive working hours, discrimination, and raw-material sourcing risks. | Workforce profile, age-verification controls, wage and hour records, health-and-safety data, grievance channels, labor-agency use, and source-country information. | Annual self-assessment; independent review or on-site verification for high-risk facilities and after serious allegations. | Corrective actions closed by due date; zero unresolved critical findings involving forced or child labor. | Credible allegation of forced labor, falsified records, blocked worker interviews, or imminent safety danger. |
| 6 | Continuous Monitoring and Incident Reporting | Operational disruption, cyber incidents, quality failures, regulatory changes, environmental events, and reputational damage. | Delivery performance, quality defects, financial stress indicators, incident logs, insurance status, legal notices, cyber controls, and corrective-action progress. | Monthly operational monitoring; quarterly risk review; immediate notification for material incidents. | Material incidents reported within 24 hours; corrective actions tracked to verified closure. | Repeated late delivery, major quality deterioration, cyber breach, insolvency warning, or regulatory notice. |
| 7 | Audit, Remediation, and Exit Governance | Persistent non-compliance, ineffective corrective action, supply interruption, and uncontrolled termination risk. | Audit scope, findings, root-cause analysis, remediation owner, deadlines, evidence of closure, transition plan, and retained records. | Risk-based audits annually or as needed; remediation reviews monthly until closure; exit plans reviewed at least annually for critical suppliers. | Critical findings have approved action plans within 30 days and verified closure within the agreed deadline. | Missed remediation deadlines, repeated findings, audit obstruction, or inability to maintain supply during transition. |