One register, every supplier
A due-diligence file proves you checked one supplier once. A risk register proves you're managing all of them, continuously. This is the schema, a worked example, and a blank template to start your own.
Every stage of the Third-Party Risk, End to End framework produces a document: an intake record, a due-diligence file, a monitoring alert, a remediation tracker entry. Taken individually, none of them answer the question a risk committee actually asks, which is usually some version of "which of our Critical suppliers have an open finding right now, and who owns fixing it?"
That question can only be answered quickly if there's one document that rolls all of it up: a register, not a filing cabinet. A good register lets you answer it without opening a single supplier file. A bad one just tells you a file exists somewhere.
What follows is the schema I'd build that register around, a worked example with invented suppliers across all four risk tiers, and a blank version you can copy and start populating with your own.
The Schema
Thirteen columns, each earning its placeEvery column exists to answer a specific question a risk owner will actually ask. A column nobody ever queries is a column that shouldn't be there.
| Column | Question It Answers |
|---|---|
| Supplier ID / Name | Which supplier, unambiguously (names change; an ID doesn't) |
| Category / Spend Area | What do they actually supply, and how much does it matter commercially |
| Risk Tier | Critical, Significant, Standard or Low, set at classification (Stage 2 of the lifecycle) and revisited, not fixed forever |
| Inherent Risk Rating | How risky is this relationship before any controls are applied |
| Key Risk Drivers | Why it's rated that way in one line: sole source, data access, jurisdiction, safety relevance |
| Last Due Diligence Date | When was this actually checked, not assumed |
| Next Review Due | When does it need checking again, set by tier-based cadence, not a single calendar for everyone |
| KRI Status | Green, Amber or Red: the live monitoring signal from Stage 5, so deterioration shows up before the scheduled review does |
| Open Findings | Reference and rating of anything currently outstanding, so nothing sits invisible between audits |
| Remediation Status | Is the open finding actually being worked, and by when is it due to close |
| Escalation / Exit Flag | Has this relationship crossed a threshold that puts Stage 8 (exit or replacement) into play |
| Risk Owner | One named person accountable, not a department or a distribution list |
Worked Example
Six fictional suppliers, four tiersInvented entries, chosen to show the range: a clean Low-tier relationship, a Critical one mid-remediation, and one flagged for exit.
| Supplier | Tier | Category | KRI | Open Findings | Next Review | Flag |
|---|---|---|---|---|---|---|
| Supplier A, sole-source component | Critical | Manufacturing input | Amber | F1, Partial Compliance | 3 months | None |
| Supplier B, IT hosting | Critical | Data processing | Red | F2, Non-Compliance (screening gap) | Immediate | Escalated to Risk Committee |
| Supplier C, regional freight | Significant | Logistics | Green | None open | 6 months | None |
| Supplier D, packaging | Standard | Consumables | Amber | F3, Partial Compliance | 9 months | None |
| Supplier E, office supplies | Low | Commodity | Green | None open | 12 months | None |
| Supplier F, specialist subcontractor | Critical | Manufacturing subassembly | Red | F4, Non-Compliance (repeat, 3rd cycle) | Immediate | Exit/replacement triggered |
How It Gets Used
A register is only as good as its update discipline| Trigger | What Updates |
|---|---|
| Scheduled due-diligence refresh (Stage 3) | Inherent risk rating, key risk drivers, last DD date, next review date |
| Monitoring alert fires (Stage 5) | KRI status, immediately, not at the next scheduled review |
| Incident raised (Stage 6) | Open findings column, with reference and severity |
| Corrective action progresses (Stage 7) | Remediation status, updated on evidence of progress, not on the owner's word |
| Exit trigger met (Stage 8) | Escalation/exit flag, and the entry stays visible until the transition is confirmed complete |
One person owns the register itself, distinct from the individual risk owners listed in it. Their job is making sure it reflects reality, not making every entry green.
Download the blank template
A CSV with the schema above, one worked example row, and space to add your own. Opens in Excel, Google Sheets, or any spreadsheet tool.
Download supplier-risk-register-template.csvWhat this is not
It's a starting schema, not a finished system. A real register usually lives inside a GRC platform with automated KRI feeds rather than a spreadsheet, and the exact columns should flex to the regulatory regime and sector it sits in.
The worked example is entirely invented. No supplier named here exists, and none of the findings, ratings or dates describe any real relationship.
Part of a set
This register is the connective tissue for the full lifecycle described in Third-Party Risk, End to End, and the same discipline, independent verification, graded findings, owned actions, closure that isn't self-certified, is worked in detail against a fictional company in An Internal Audit, End to End.