Dynamic Risk Engine

How It Works

The 5-Pillar Risk Engine scores every supplier in your system across five distinct risk categories: Financial, Compliance, Operational, Cyber, and ESG. This is not a single traffic light or a vague high-medium-low rating. Each pillar produces its own score, and those scores are combined using configurable weightings to produce an overall supplier risk rating.

Financial Risk draws on credit check data, payment behaviour history, and financial indicators like CCJs, filed accounts, and credit score changes. If you connect a credit check provider, scores update automatically when new data is available.

Compliance Risk is calculated from the results of your compliance questionnaires, document status (are key documents current or expired?), and the supplier's response rate to requests. A supplier who has not completed their Modern Slavery assessment and has an expired insurance certificate will carry a higher compliance risk score than one with everything up to date.

Operational Risk factors in performance scorecard results, helpdesk ticket volumes and resolution times, and delivery or service quality metrics from your Quarterly Business Reviews.

Cyber Risk captures the supplier's responses to cyber security questions in compliance packs, including data handling practices, incident response plans, and certifications like Cyber Essentials or ISO 27001.

ESG Risk is drawn from the supplier's ESG questionnaire responses, carbon reporting data, and alignment with PPN 06/21 Carbon Reduction Plan requirements where applicable.

Each pillar's weighting is configurable at the organisation level. A financial services firm might weight Compliance and Cyber risk heavily, while a construction company might prioritise Operational and Financial risk. You set the model to match your risk appetite, and the scores adjust accordingly.

Risk scores recalculate automatically when underlying data changes. A new compliance questionnaire submission, an expired document, a poor performance scorecard, or a credit check update will all trigger a recalculation. You do not need to wait for an annual review cycle to spot a problem.

When a supplier's score crosses a threshold you define, the system raises an alert. You can set different thresholds for different actions: a warning notification at one level, a mandatory review at another, and automatic restrictions on new purchase orders at a third.

Risk overrides allow authorised users to manually adjust a score when they have context that the automated model cannot capture, such as knowledge that a low credit score is due to a planned restructuring rather than financial distress. Every override is logged with a reason and an expiry date, so they do not become permanent exceptions that nobody reviews.