Supply chains are under the microscope like never before. Stakeholders, regulators, and customers are all demanding transparency, compliance, and resilience. Supply chain risk is no longer just a back-office issue—it’s a boardroom priority.
But here’s the challenge: with thousands of suppliers and complex global networks, identifying and understanding risk is complicated and in many cases too much to manage. Organizations need to create a supply chain risk management plan that is scalable and focused on suppliers that are high-risk or critical to your business. The challenge becomes more difficult because your risks can range from data privacy to human rights to corruption to the environment and beyond.
That’s where a well-crafted third-party risk assessment questionnaire becomes indispensable. More than a formality, a TPRM assessment is your first line of defense for uncovering vulnerabilities, ensuring compliance, and protecting your brand’s reputation.
The trick? Asking the right questions—questions that go beyond surface-level data and dig into the realities of your suppliers’ risk profiles. Yes/no questions aren’t going to get you what you need to prioritize what to do and take action.
Here are five essential topics to cover and example questions for your third-party risk assessment, crafted to help assess suppliers and uncover hidden vulnerabilities within your supply chain.
1. How Do You Manage ESG Risks in Your Operations? (Setting the Tone for Transparency)
Regulatory frameworks like the EU’s Corporate Sustainability Reporting Directive (CSRD), Uyghur Forced Labor Prevention Act in the U.S., and Germany’s Supply Chain Due Diligence Act require that companies demonstrate intentional ESG compliance by having management systems in place. Non-compliance isn’t just a regulatory risk—it’s a reputational crisis waiting to happen.
Ask your suppliers:
- Describe the process you used for assessing your compliance and ESG risk and how you used the results.
- What risk topics does your Code of Conduct cover and who was involved in developing it?
Verify their questionnaire responses with public ESG records, so you don’t rely solely on self-reported data. You can perform basic verification through a document review. Additionally, your internal teams who own the supplier relationship should be taught to catch glaring red flags. Independent verification by qualified experts may be used if the risk and the relationship warrant it. Remember, transparency is critical—both for regulatory compliance and stakeholder trust.
2. What Are Your Residual Risks, and How Are You Addressing Them?
Knowing the inherent risks a supplier poses based on where they are located and what they do is an important step. However, it is more important to gain visibility into whether a supplier has adequate controls in place. Residual risks—the risks that remain after controls and mitigation measures are applied—are where the real vulnerabilities lie. These hidden risks can lead to operational disruptions or regulatory penalties if left unchecked.
Ask your suppliers:
- Describe the status of your supply chain mapping, including direct supplier, sub-contractors and raw material suppliers.
- Which international regulations or standards are your ESG policies aligned with?
Getting a view beyond the inherent risks of your suppliers, and getting a good understanding of the often hidden residual risk will provide a more complete picture of how well your suppliers’ controls are working. Your ability to quantify residual risk sets a sophisticated supply chain risk management plan apart.
3. Can You Demonstrate Supplier Network Resilience?
Surviving disruptions is one thing, but resilience means that suppliers are prepared and able to adapt to them. Supplier resilience can be the difference between an operational hiccup and a full-scale crisis. Ensuring your suppliers can adapt to disruptions and maintain operational stability is essential.
Here’s what to ask:
- What are the elements of your business continuity plan?
- What risk topics are covered in your business continuity plan (e.g. cyber, social, corruption, environment, trade sanctions)?
By layering these insights with external benchmarks—like historical performance data and public records—you can identify patterns and prioritize remediation.
4. What Is Your Track Record with Regulatory Compliance? (Avoiding the Headline Risk)
Regulatory compliance isn’t optional—it’s required. But how do you separate vendors who are genuinely compliant from those who only say they are? Start with direct, specific questions:
- What certifications or regulatory standards does your organization comply with (e.g., ISO 14001, SA8000)?
- Have you faced any compliance violations in the past 3 years? If so, how were they resolved?
Supplement your findings with independent verification by qualified experts to ensure you’re not relying solely on self-reported data. A comprehensive, outside-in view of suppliers’ compliance histories is critical to understanding the full picture.
5. What Is Your Plan for Continual Improvement? (Moving Beyond Measurement)
Compliance isn’t a one-and-done achievement—it’s an ongoing journey. A supplier’s willingness to improve speaks volumes about their commitment to integrity and resilience.
Ask questions like:
- What steps are you taking to improve your risk management and ESG compliance practices over time?
- How do you incorporate feedback from risk assessments into your improvement plans?
With Ethisphere’s Supply Chain Risk Management solution, suppliers aren’t just measured—they’re empowered with personalized improvement steps. This approach mitigates risk and fosters collaboration across your supply chain.
Why These Questions Matter
Supply chain risk management goes beyond avoiding fines or keeping regulators happy. It requires creating a third-party risk assessment strategy where risks are identified, quantified, and acted upon proactively.
Ethisphere’s solutions go beyond checkboxes. By combining advanced digital tools with expert insights, we empower you to make informed decisions across your supplier network. From identifying high-risk suppliers to quantifying residual risks and guiding remediation, we deliver actionable insights that help you build a resilient, compliant, and trustworthy supply chain.
A Final Word on Accountability
The stakes have never been higher for supply chain due diligence. Customers, investors, and regulators are all paying attention. Asking the right questions in your third-party risk assessment questionnaire is the first step toward understanding your highest-risk suppliers and developing an effective supply chain risk management template.
Understanding and navigating the complexities of global supply chain regulations is more critical than ever. Our Supply Chain Due Diligence: Regulations & Guidance Comparison Guide will to help you understand these requirements. It highlights the key areas you need to address to ensure compliance when managing supply chains across multiple regulatory environments.
Ready to take action? Explore how our solution transforms supplier risk management into a scalable, strategic advantage.
