Procurement risk register for Chinese suppliers
Keep a live register linking each supplier risk to its cause, possible event and business impact. Record inherent risk, evidenced controls, residual risk, a named owner and escalation triggers. Update it when evidence or order conditions change. China-side checks can be coordinated by Cambridge China Bridge.
Adapt the principles to purchasing decisions
HM Treasury’s Orange Book describes risk through causes, potential events and consequences. The method below adapts that approach for purchasing from Chinese factories. Use it as an internal management tool, with your own approval rules and evidence requirements.
Start with the dependencies identified in our China supply-chain resilience guide. Give each distinct risk a register entry tied to the supplier, production site, product and affected orders. Record the purchasing objective at risk, such as meeting an agreed delivery commitment or receiving goods against an approved specification.
Write a cause, event and impact
Use this wording: because a stated condition exists, a possible event may occur, causing a stated business impact. For example: because the factory has not confirmed its coating subcontractor’s capacity, finishing may miss the agreed production slot, delaying delivery to our customer. This identifies what needs checking and why it matters.
Avoid entries such as ‘supplier risk’ or ‘late delivery’ without a cause. Separate risks where the controls or owners differ. Record assumptions and missing information explicitly. If the event has already happened, link the risk entry to an issue record containing containment actions, the recovery decision and outstanding exposure.
| Field | What to record |
|---|---|
| Scope and description | Supplier, site, product, orders, objective, cause, possible event and impact |
| Inherent assessment | Likelihood and impact before the listed controls, with reasons and assumptions |
| Controls and evidence | Control, person operating it, dated evidence, scope and effectiveness finding |
| Residual assessment | Likelihood and impact with evidenced controls operating, plus uncertainty |
| Ownership and actions | Named risk owner, action owners, due dates and next review |
| Escalation and decision | Trigger, person to notify, purchasing hold, acceptance authority and decision record |
Assess exposure before and after controls
For this register, define inherent risk as exposure before the listed controls and residual risk as exposure with evidenced controls operating. Use shared verbal likelihood and impact categories, with written descriptions tied to delivery, quality, cash exposure and customer consequences. Assess likelihood and impact separately, explain the judgement and record uncertainty.
Do not reduce a rating because an audit is booked or the factory promises corrective action. Keep planned controls separate from operating controls. Where evidence is missing, stale or outside the affected product or site, mark effectiveness as unverified and avoid assuming a reduction. Record a target assessment separately if proposed actions would improve the position.
Attach evidence and assign named owners
For each control, record what it prevents or detects, who performs it and where its evidence is stored. Include the evidence date, product or batch scope, reviewer and result. For the coating example, ask for subcontractor confirmation, material readiness and production progress evidence. A factory assurance without supporting records leaves an evidence gap.
Name an individual in the buying business who owns the risk and can obtain a decision. Assign separate action owners where needed, including China-side checks. Record their names and responsibilities rather than department labels. Use our corrective-action closure guide for evidence of completed remedies; completing an action does not automatically close the underlying risk.
Set triggers and keep decisions current
Agree escalation triggers before committing the order: residual exposure above the buyer’s accepted limit, an unapproved production-site change, failed control evidence, an overdue critical action or a threatened customer commitment. State who receives the escalation, when notification is due and which decision is held pending review. Record any accepted exposure with the approver’s name, reasons, conditions and review date.
Review the register at order approval, production changes and release decisions, and whenever new evidence changes the assessment. Preserve previous ratings and decision reasons. Reopen risks when controls fail; close them only when exposure has ended or responsibility has been formally transferred and accepted. Keep release authority explicit using our inspection, shipment and payment approval guide.
Frequently asked questions
What should a Chinese supplier risk register contain?
Record the supplier and order scope, cause-event-impact description, inherent assessment, controls and evidence, residual assessment, named owner, actions, review date and escalation triggers.
What is inherent versus residual procurement risk?
In this method, inherent risk is exposure before the listed controls. Residual risk is exposure with evidenced controls operating. Keep proposed improvements in a separate target assessment.
Who should own a supplier procurement risk?
Name someone in the buying business who can obtain a decision and follow up actions. Factory contacts and China-side staff can own checks, while the buyer retains the risk acceptance decision.
When should we escalate a supplier risk?
Escalate when an agreed trigger is met, such as exposure exceeding the accepted limit, failed evidence or a threatened delivery commitment. State who decides and which purchasing step is held.