Supply Chain Risk Management (2026): Framework, Risk Register and Supplier Delay Early Warning

TL;DR

• Supply chain risk management is the repeating cycle of identifying what could disrupt supply, assessing likelihood and impact, putting mitigations in place, and monitoring for early warning signs.
• Most programs cover the big, rare events well: tariffs, disasters, a supplier going bankrupt. The losses that recur are smaller and slower: a supplier delay agreed in an email that never reaches the plan.
• A usable program needs a risk register with owners, a short list of leading indicators per critical supplier, and a rule for how a delay signal reaches the planner within a day.
• Sentra joins what the ERP and the plan say with what suppliers and buyers say in email, chat and meetings, and raises the gap to the owner with the evidence before the shortage shows up in the numbers.

What supply chain risk management is

Supply chain risk management (SCRM) is the practice of finding, assessing, mitigating and monitoring the risks that could interrupt the flow of goods, information or money from suppliers to customers. Portcast describes it as a cycle: identify risks, assess likelihood and impact, choose mitigations such as dual sourcing or safety stock, then keep monitoring for early warning signs, across every tier and not only direct suppliers.

The definition is settled. The hard part is the last step. Most companies know which suppliers matter and which regions are exposed. Fewer can say, on a given Tuesday, which open purchase orders are already at risk because a supplier told someone they would ship late.

Two formal frameworks are worth knowing. NIST SP 800-161 Rev. 1 covers cybersecurity supply chain risk, including products that are counterfeit or vulnerable because of poor manufacturing and development practices. ISO 28000:2022 sets requirements for a security management system that includes supply chain aspects. Neither tells a planner that a specific shipment will arrive two weeks late. That is operational SCRM, and it is the focus of this guide.

Types of supply chain risk

Group risks by where they start, because the owner and the mitigation differ for each. The categories below follow the grouping used by Portcast, with the early signal you can watch for each.

Supply risk deserves the most attention in most mid-market and enterprise companies because it is frequent and it compounds. One late component holds a finished good, which holds an order, which triggers expedited freight and a service failure that shows up later in OTIF.

A supply chain risk management framework you can run

The cycle has five steps. Each one produces something a reviewer can check.

1. Map critical suppliers and parts. List the suppliers whose failure would stop revenue within 30 days. For each, record the parts they supply, the products those parts feed, current lead time, open purchase orders and whether a qualified second source exists.

2. Score each risk on likelihood and impact. Use a 1 to 5 scale for both and multiply them. Impact should be stated in money or days of lost supply, not adjectives. A risk scoring 15 or more needs a named owner and a mitigation with a date.

3. Choose a mitigation per risk. The standard options are dual or multi sourcing, safety stock on the constrained part, alternate routes or modes, contract terms such as notice periods and penalties, and design changes that remove a single-source part.

4. Define leading indicators and thresholds. For each critical supplier, pick three or four signals that move before a shortage. Examples: on-time confirmation rate, average days of ship-date slippage, open purchase orders past their promise date, and quality holds. Set a threshold that triggers review.

5. Monitor, escalate and review. Decide who sees each signal, how fast, and what they do. Review the register monthly and after every disruption. Record what was known, when, and by whom.

Supply chain risk register template

Copy these columns into a spreadsheet. One row per risk.

Keep it short. A register with 400 rows and no owners is a document. A register with 25 rows, each with a person and a date, is a program.

Supply chain risk monitoring: where early warning breaks

Supply chain risk monitoring usually watches structured data: supplier scorecards, shipment tracking, news and weather feeds. Those are useful. They miss the most common early warning of all, which is a person at the supplier telling a person at your company that something will be late.

That message rarely lands in a field the plan reads. It arrives as an email to a buyer, a line in a weekly supplier call, or a chat message to a quality engineer. The purchase order in the ERP keeps its original promise date. MRP keeps planning against it. The production schedule, the available-to-promise figure and the customer commitment all inherit the wrong date.

Three things make this gap persistent:

• The signal is unstructured. "We're moving the line next week, expect two weeks of slippage on P-220" contains a part, a duration and a cause, but no system parses it.
• The receiver is not the owner. The buyer who reads it may not own the production plan or the customer commitment it threatens.
• Nobody is accountable for the update. Updating the promise date in the ERP is a manual step that competes with every other task that day.

The result is a plan that is confidently wrong for days or weeks. By the time the receipt is missed, the cheap options (re-sequencing, pulling stock from another site, telling the customer early) are gone and the expensive ones (rush freight, overtime, partial shipments) are what remain.

Supplier delay early warning checklist

Use this checklist for each critical supplier. It is designed to catch delays while there is still time to act.

• Confirmation discipline. Every purchase order gets a written confirmation with a ship date within two business days. Unconfirmed orders are listed daily.
• Promise date ownership. One person owns updating the ERP promise date when a supplier changes it, with a same-day target.
• Shared inbox or channel. Supplier communication goes to a shared address or channel, not only to one buyer's inbox, so absences do not hide signals.
• Weekly call notes. Supplier calls produce written notes with any date change stated as part number, old date, new date and reason.
• Slippage tracking. Track the difference between first promised date and actual ship date per supplier. A rising trend is a risk signal even when each slip is small.
• Downstream link. Each critical part is linked to the products and customer orders it feeds, so a slip can be priced in revenue and days.
• Escalation rule. Any slip that threatens a customer commitment reaches the planner and the account owner within one business day.
• Post-incident review. After every shortage, record when the first signal appeared, who saw it, and when the plan changed. The gap between those dates is the number to shrink. A root cause analysis keeps the evidence in one place.

Worked example: a supplier delay the plan did not know about

Assumptions, illustrative only. A manufacturer builds 2,000 units a week of one product line. Each unit needs one housing from a single supplier. The purchase order for 6,000 housings has a promise date of the 10th. Safety stock covers 3 days of production. Contribution margin is $45 per unit.

On the 1st, the supplier's account manager emails the buyer: the supplier is moving a press to a new building, and the order will ship on the 20th, ten days late. The buyer replies to acknowledge and makes a note to update the system. The ERP still shows the 10th.

• What the plan believes. Housings arrive on the 10th. Production continues at 2,000 a week. Customer orders are promised on that basis.
• What is true. Housings arrive on the 20th. With 3 days of safety stock, the line stops for about 7 working days, or roughly 2,800 units.
• Cost if found on the 10th. About 2,800 units of delayed output, $126,000 of contribution at risk if the orders are lost, plus air freight on part of the shipment and overtime to recover.
• Cost if found on the 1st. Nine days to act. The planner can pull housings from a second site, re-sequence other product lines into the gap, split the order to air-ship a partial quantity, and tell affected customers early. Most of the margin is protected.

The arithmetic is simple. The difference between the two outcomes is entirely about when the planner learned what the buyer already knew.

Common mistakes in supply chain risk management

• Treating SCRM as an annual assessment. A risk register reviewed once a year cannot catch a delay that develops in a week.
• Watching only structured feeds. News, weather and tracking data matter, but supplier delays are usually announced by people in email and calls first.
• No owner per risk. A risk owned by "procurement" is owned by nobody. Name one person.
• Scoring impact in words. "High impact" cannot be compared. Use days of supply lost or revenue at risk.
• Ignoring small, repeated slips. A supplier that is two days late every order is a capacity or planning problem in progress. Track the trend.
• Stopping the review at the supplier. Ask why your own plan did not adjust. The answer is often that the signal reached someone who did not own the plan.

How Sentra catches this automatically

Sentra understands how a company really runs, and acts on it before anyone asks. It reads email, chat, meetings and documents alongside ERP, CRM, HRIS and BI data, and works out what is true now and why.

For supply risk, that means Sentra holds both sides of the gap described above. It sees the purchase order with its promise date of the 10th in the ERP. It also reads the supplier's email to the buyer saying the order will ship on the 20th, and the note from the weekly supplier call that mentions the press move. Because Sentra knows when a fact became true and when it stopped being true, it treats the new ship date as the current fact and the ERP date as stale, and flags the contradiction.

It then works out who should act. The buyer already knows, so the finding goes to the planner who owns the production schedule and the account owner whose customer orders depend on it, with the supplier email, the purchase order and the affected products attached as evidence. A named person approves each finding before it reaches anyone else, and before Sentra acts or sends anything.

Every person sees only what their permissions at the source allow. Sentra replaces none of your systems. The ERP stays the system of record for the order, and your planning tool stays in charge of the schedule. Sentra has 200+ integrations, holds SOC 2 Type II and ISO 27001, and runs in the cloud, in an isolated VPC or air-gapped on premises.

The same pattern catches the related failures: a delivery promise that drifts and later shows up as an OTIF miss, rush freight that covers for a plan nobody updated, and a stockout the record says should not exist. At Lenskart, a retailer with 3,200 stores, time to root cause went from 3 to 4 days to about 30 minutes.

To see Sentra find the supplier delays your plan does not know about, book a demo.

How to start

Start with the ten suppliers whose failure would stop revenue fastest. Build the register rows for those ten, with an owner and three leading indicators each. Then run one test: pick a recent shortage and trace when the first signal appeared, in which channel, and when the plan changed. If the gap is more than a day, the program's weakest point is how signals travel, not how risks are scored. Fix that first, then widen the scope tier by tier.

FAQ