Vendor and Supplier Risks in Projects

What counts as a vendor risk?

vendor and supplier risks is a key topic in modern project management and teamwork. Vendor risk is the chance a third party fails to deliver the agreed scope at the agreed quality, time, and cost, plus the damage that failure causes. It is broader than “the supplier goes bust.” It includes slow delivery, hidden subcontracting, quality that drifts after the honeymoon period, and the commercial trap of depending on one company for something you cannot easily buy elsewhere.

It is also not procurement risk. Procurement covers how you select and contract; vendor risk covers what happens after signature, including the day the relationship ends badly.

Which supplier risks actually damage projects?

Five categories account for most of the damage, and they interact. A single weak supplier can produce a compound failure.

Insolvency and financial distress

A supplier can be technically excellent and still disappear. Financial failure is under-estimated because sales conversations reward optimism and nobody asks for audited accounts.

The standard test is liquidity. The European Bank for Reconstruction and Development’s qualification guidance treats a current ratio below 1 as a warning of future liquidity problems, and a ratio between 1.2 and 2.0 as healthy. But a ratio is a snapshot. The harder question is whether the supplier can fund the work between invoice and payment, and that is where small suppliers die on large contracts.

Capacity overload

Capacity risk is the supplier who wins your project and two others in the same month. Nothing in the contract prevents it, and by the time slippage is visible the schedule has no float left. Capacity is not headcount; it is headcount minus existing commitments, plus the equipment and licenses needed for your work. Ask at prequalification: what is your committed volume for the next six months, and where does our work sit inside it?

Quality drift

Quality drift is the slow erosion of standards after the first good delivery — shortcuts in inspection, substituted materials, junior staff replacing the named team, thinner documentation each month. It is dangerous because the first delivery is usually excellent, which builds false confidence. The controls that work are unglamorous: acceptance criteria written before work starts, inspection at hold points, and retention tied to final acceptance.

Delivery slippage

Slippage is the most common risk and the one teams absorb silently. A two-week slip on a critical-path item is not a two-week delay if you have float; it is a disaster if you do not. That distinction belongs in the risk register as a schedule question.

Single-source dependence

Single sourcing is sometimes the only sensible option, or dual sourcing costs more than the risk. The problem is single sourcing nobody noticed. A supplier you cannot replace in less time than your maximum tolerable outage sets your price, your lead time, and your terms.

Concentration risk is the harder version: an organisation can look diversified at the application level while every critical system sits on the same cloud region, identity provider, or open-source library. When that shared layer fails, everything fails at once.

How do you prequalify a supplier before award?

Prequalification checks that a supplier can do the work, will still exist while doing it, and has done comparable work before. It runs before award, and it should be proportionate: commodity suppliers need a credit check and a reference, not a three-year audit trail.

1. Financial standing. Request two to three years of financial statements, bank references, liquidity and profitability trends, and note any ownership changes or refinancing pressure.
2. Technical capability. Verify comparable projects at similar scale and complexity. Ask for the actual delivery team, not the sales team, and confirm facility and equipment capacity.
3. Capacity and subcontracting. Compare committed workload against your required delivery rate, and establish how much work is subcontracted and to whom.
4. Conduct and compliance. Safety record, certifications, insurance, past disputes, and references you call yourself rather than the ones on the brochure.

One discipline matters more than the form: set the minimum score before you read the bids. Thresholds decided after proposals arrive drift toward the supplier you already prefer.

How much financial capacity does a supplier actually need?

This is the calculation most prequalification packs skip, and it predicts failure better than any ratio. You are not asking whether the supplier is profitable. You are asking whether it can carry the cash gap your payment terms create.

Add one month of administrative contingency, as the EBRD guidance recommends, and the requirement is roughly $750,000. That number belongs in the tender documents as a financial resource criterion: the supplier must show access to about $750,000 of liquid assets or committed credit, net of other known commitments.

If it cannot, the contract is not necessarily dead. It means you need milestone payments, an advance payment guarantee, or a shorter payment cycle — because the alternative is a supplier financing your project with its creditors’ money and failing when they call it in.

How do you score and rank vendor risk?

Score likelihood and impact separately, then add velocity: how fast the risk reaches full exposure. Two risks with identical likelihood-times-impact can need completely different responses if one unfolds over eighteen months and the other over a weekend.

Two rules keep a register honest. Do not collapse the three numbers into one average — sort by impact, then velocity, and let likelihood decide how much attention a row deserves. And publish your impact scale in the units your organisation argues in: “£250k–£1m, or a reportable data breach, or a critical service down beyond its tolerable outage,” not “major.” Unpublished scales produce registers where every risk is a 3.

A simple scoring model that survives a management meeting weights the things that create dependence:

Two suppliers make the logic visible. Supplier A: 40% of category spend, single-sourced, high criticality, all spend in one country, complete data — 16 + 20 + 20 + 10 + 0 = 66. Supplier B: 5% of spend, three alternatives, medium criticality, spread across two countries, single-source field missing — 2 + 0 + 10 + 5 + 2.5 = 19.5. The model is crude on purpose: it is auditable in a meeting, and it forces the missing-data conversation.

Which contract terms actually reduce supplier risk?

A clause reduces risk only when a remedy is attached. A promise without a consequence is a preference.

• Milestone-linked payments. Pay against accepted deliverables, not progress claims.
• Tiered SLA remedies. Define metrics precisely, scale credits with duration, and allow termination if performance stays below threshold for two consecutive periods.
• Retention. Hold 5–10% until final acceptance on delivery and implementation work; it funds your remedy without litigation.
• Exit assistance. A 90–180 day transition window with defined scope, named roles, pre-agreed rates, and export in a usable format. Negotiate it at signature; at termination you have no leverage.
• Named key personnel. Protects against the A-team-to-B-team swap after signing.
• Audit and reporting rights, at a defined cadence, covering performance data and financial warning indicators.
• Termination for insolvency or material adverse change, with short notice and step-in rights.

Where does escrow help, and where is it theatre?

Escrow helps when the software is self-hosted, the source code builds, and you have or can hire people to maintain it. It is close to theatre for multitenant cloud services: even with the source released, you usually lack the hosting environment, licenses, deployment pipeline, and specialist staff to run a production instance.

For cloud, spend the escrow budget on portability instead — documented export formats, API access guarantees, dry-run exports before you need them, configuration runbooks, and a transition agreement with fixed rates. Escrow is a sound control for bespoke installed systems. Elsewhere it is a comfort blanket.

How do you monitor a supplier after signature?

Monitoring is a short list of triggers, each with a named owner and a required response. A dashboard nobody reads is not monitoring.

• Financial: late filings, credit changes, ownership change, restructuring, missed subcontractor payments, requests to alter terms.
• Delivery: any milestone slip beyond tolerance, rising open defects, or a backlog that grows two reviews running.
• Relationship: losing the named account team, unresolved disputes, or a sudden drop in responsiveness.
• Concentration: a new critical system added to the same provider, or a regional event where most of your spend sits.

Cadence follows criticality: quarterly for strategic suppliers, annually for the rest, and immediately on any trigger. Record the review, the decision, and the next date, so an absent decision is visible rather than implied.

What are the trade-offs of adding supplier controls?

More control costs money and speed, and the cost lands first.

Controls are worth their cost when the failure mode is expensive and slow to reverse. Spend effort on the critical path; leave commodity suppliers alone.

Which mistakes show up again and again?

• Treating prequalification as paperwork. A form collected and filed is not a check. Someone must read the accounts and call the references.
• Confusing price with total cost. The cheapest quote with a 16-week lead time and no second source is usually the most expensive option in the room.
• Assuming the contract prevents failure. It allocates cost after failure. It does not keep the supplier solvent.
• No named owner. Risk that belongs to everyone is monitored by nobody.
• Designing the exit during the exit. Every clause you negotiate at termination is worse than the one you could have had at signature.

How do you manage supplier risk without a procurement department?

Small teams rarely have a vendor management office, so the work has to live somewhere practical. The minimum viable system is a register with one row per critical supplier: risk score, named owner, next review date, and the contract controls in force, each linked to the milestone it protects.

Doitify can hold that — suppliers and contracts as project documents, risks and constraints as tracked items, milestones with owners and due dates, and work reports that show whether a promised date is still credible. To be transparent, Doitify is our product and it is not a procurement suite; it will not run a tender or score financial statements. What it does is keep the risk, the owner, and the delivery date beside the work they affect, which is where small teams usually lose track.

Conclusion

Supplier risk is not a legal problem solved by a longer contract, and not a procurement problem solved by a stricter form. It is a delivery problem. The suppliers that hurt you are the ones whose failure you cannot absorb quickly, and the only reliable defence is knowing which ones those are before they fail.

Three moves this month: list every supplier on your critical path, calculate the cash gap your payment terms create, and write one sentence per supplier describing what you would do if they stopped answering email tomorrow. If that sentence is vague, you have found your next piece of work.

If this post on vendor and supplier risks was helpful, you might also enjoy Free Project Budget Template and Project Management Statistics for 2026: The Data You Need.