The Supplier Risk Assessment Matrix (AQL-C02) rates each supplier on eight plain factors, each from 1 to 3. Four describe impact (what a failure would do to the product, whether you can verify the output at receiving, whether there are other sources, how much you depend on the supplier) and four describe likelihood (track record, the state of its approvals, capacity and continuity, and exposure through sub-tiers or brokers). Impact and likelihood are weighted averages with equal default weights you can change; the risk score multiplies them, from 1 to 9, and bands you set turn it into High, Medium or Low. A person can override the result with a written reason.
The rating is only useful if it changes what you do. These are our starting points; adjust them to your products and your customers.
| Control | High | Medium | Low |
|---|---|---|---|
| Rating reviewed | Every 3 months, and at any event | Every 6 months | Every 12 months |
| Approval re-evaluated | Every 6 months | Every 12 months | Every 24 months |
| Receiving | Every lot, for the failure modes that matter | Sample every lot | Reduced or skip-lot, once the history supports it |
| On-site audit (C06, C07) | Yearly at least | Every 1 to 2 years | On a trigger |
| Scorecard and review (C04, C05) | Monthly figures; quarterly review | Quarterly; review twice a year | Quarterly; yearly review |
| Second source | Plan one, or record why not | Know who it would be | Not needed |
Two related tools look across the base rather than at one supplier. The Supplier Concentration Risk Assessment (AQL-C15) shows where too much of your output depends on one source, one region or one process. The Supplier Business Continuity Assessment (AQL-C13) asks what a key supplier would do if it lost a building, a tank line or its two key people, and how long you could ship without it. Run both once a year and whenever a sole source becomes High risk. The Supplier Risk Escalation Matrix (AQL-C10) sets out, in advance, who acts at each level as a supplier problem grows.
Need more than one resource, or not sure where to start? Book a complimentary 30-minute Aegis Quality Guidance Call. We'll find the tools that fit your situation and a sensible place to start. No sales pressure, no obligation.
A management aid, not certification or a registrar audit. Using it does not by itself show conformity to AS9100D or any other standard, and your customers' requirements may add to it.
Clause numbers refer to AS9100D (SAE AS9100 Rev D) unless another document is named. The standards' text is not reproduced here: use your own licensed copy.
Aegis Insights are our own guidance, labeled wherever they appear: how we approach this work, not a requirement of any standard or customer.