Written and maintained by CASRAI Editorial Board
Last updated
A supplier risk assessment is a documented judgement of how much a supplier could harm your work, and what level of checking that justifies. It sits before the supplier audit: the result tells a lab or clinic whether a questionnaire is enough, whether an audit or quality agreement is warranted, and whether a backup source is needed. The same exercise is often called a vendor risk assessment. This page is general information for procurement and quality staff, not legal, regulatory or medical advice.
Short answer
Rank each supplier by how critical it is, assess the risks it brings, choose a control that matches the risk, then keep monitoring. ICH Q9(R1) says the level of formality “should be commensurate with the level of risk”, and that oversight of suppliers is “informed by risk assessments” plus a monitoring strategy.
Definition and scope
The word “supplier” usually points at goods and services (reagents, consumables, instruments, calibration, contract testing), while “vendor” often points at software and IT services. The method is the same. Two sourced frameworks show the two readings:
- Quality-system reading. ICH Q9(R1) is a pharmaceutical quality risk management guideline. It describes risk analysis as “the estimation of the risk associated with the identified hazards” and risk evaluation as comparing that risk “against given risk criteria”. It is a model to borrow from, not a rule that binds a research lab.
- IT and cyber reading. NIST SP 800-161 Rev. 1 covers cybersecurity supply chain risk management. It says the review of bids “should also include any procurement-specific supplier risk assessment”, which is the vendor risk assessment most software buyers mean.
How it works in practice: four steps
1. Classify the supplier by criticality
NIST SP 800-161 Rev. 1 includes a criticality analysis control (RA-9) and points to NIST IR 8179 for the method. In a lab this means asking which items would stop work, compromise results or affect patients if they failed or changed. A supplier of a single-source reagent sits in a different tier from a supplier of office paper.
2. Assess the risks
Follow the ICH Q9(R1) sequence: identify hazards, analyse the risk of each, then evaluate it against criteria you have written down. NIST adds a caution for early screening, which can use requests for information or due diligence questionnaires: the initial due diligence risk assessment should not be treated as exhaustive.
3. Choose the control
ICH Q9(R1) Annex II.5 names “auditing” and “supplier quality agreements” as ways to evaluate suppliers and contract manufacturers. Section 6.1(c) adds that where substantial variability appears in supplied materials or services, “enhanced review and monitoring activities are justified”, and that it may be necessary to identify a new supply chain entity, “e.g., a pre-qualified alternative option”.
4. Monitor and reassess
NIST says that once a contract is executed the enterprise should monitor for changes that alter its exposure, including supplier operational or structural changes and product updates. Treat such a change as a trigger to reassess.
Template fields: what a supplier or vendor risk assessment template should capture
Search results for “supplier risk assessment template” are mostly downloadable spreadsheets. A template is only a container; the fields below map to the sources above, so a template that lacks them is missing a step.
| Field | Why it is there | Source |
|---|---|---|
| What the supplier provides and what depends on it | Supports the criticality classification | NIST SP 800-161 Rev. 1, RA-9 criticality analysis |
| Identified hazards and the estimated risk of each | Risk identification and analysis | ICH Q9(R1), section 4 |
| Risk criteria used and the evaluation result | Risk evaluation against stated criteria | ICH Q9(R1), section 4 |
| Control chosen (questionnaire, audit, quality agreement) | Formality matches the level of risk | ICH Q9(R1), section 6.1 and Annex II.5 |
| Pre-qualified alternative source, if any | Fallback when variability is found | ICH Q9(R1), section 6.1(c) |
| Monitoring triggers (supplier structural change, product update) | Reassessment after contract signature | NIST SP 800-161 Rev. 1, procurement discussion |
Supplier risk assessment template versus vendor risk assessment template
The fields are the same; a vendor template for software adds the cybersecurity criteria that NIST describes (information about the enterprise, its security processes and its security track record). A supplier template for consumables and equipment leans on quality-system evidence instead.
Supplier versus vendor risk assessment
Neither source draws a hard line between the two terms. Use “supplier” when the concern is material or service quality and “vendor” when the concern is data and system security. A lab instrument with network connectivity needs both views.
Where it matters for labs and clinics
For device makers, 21 CFR 820.10 requires a quality management system that complies with the applicable requirements of ISO 13485, incorporated by reference. Read the standard itself for what it requires of supplier control; this page does not describe its clauses. Related CASRAI guides: supplier audits (the deeper check a high-risk result may call for), the vendor qualification process, ISO 13485 certification, contract manufacturing for medical devices, assessing third-party AI vendor risk and the ICH Q9 quality risk management term.
Common misunderstandings
- “A score is the assessment.” A likelihood-times-impact number is one way to record a result. The sources above ask for identified hazards, analysis and evaluation against stated criteria; they do not prescribe a numeric scale.
- “One screening questionnaire is enough.” NIST says not to treat the initial screen as exhaustive.
- “Assess once, at onboarding.” Both frameworks tie the assessment to monitoring over the relationship.
- “ICH Q9 applies to every lab.” It is a pharmaceutical guideline; use it as a reference model.
FAQ
What is a supplier risk assessment?
A documented evaluation of the hazards a supplier brings, judged against stated criteria, used to decide how closely to check and monitor it.
Is a vendor risk assessment the same thing?
The method is the same. “Vendor” is the common term for software and IT providers, where NIST SP 800-161 Rev. 1 applies.
Does a supplier risk assessment replace a supplier audit?
No. ICH Q9(R1) lists auditing as one control the risk result can justify; the assessment decides whether it is needed.
How often should it be repeated?
The sources set no fixed interval. They call for ongoing monitoring and enhanced review when variability or supplier changes appear.
Sources
- ICH Q9(R1) Quality Risk Management, Step 4, December 2022: https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Guideline_Step4_2022_1219.pdf (checked 1 November 2026).
- NIST SP 800-161 Rev. 1 (updated), Cybersecurity Supply Chain Risk Management Practices: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf (checked 1 November 2026).
- 21 CFR 820.10, Requirements for a quality management system: https://www.law.cornell.edu/cfr/text/21/820.10 (checked 1 November 2026).
