Turn Supplier Risk From a Blind Spot Into a Strategic Advantage
Screen every supplier for ESG risk exposure in days with S&P Global Risk Exposure Assessment (REA) and Supplier Risk Management (SRM)
Supply Chain Risk in 2026: More Pressure, Less Visibility
Procurement, sustainability, and risk teams are being asked to manage increasingly complex supply chains with limited resources. At the same time, regulatory requirements, geopolitical uncertainty, cybersecurity threats, and climate-related disruptions continue to expand the range of risks that organizations must monitor and address.
S&P Global Sustainable1 research points to a growing resilience gap in global supply chains, where rapidly increasing risk exposure is not matched by equally mature management practices.
Analysis from S&P Global's Risk Exposure Assessment (REA) indicates that 78% of analyzed companies face Moderately High to Very High levels of exposure to both Climate Change and Cybersecurity risks. Yet nearly half (47%) of companies assess their direct supply chain risk exposure as Very Low, suggesting that interconnected sustainability and operational risks may be significantly underestimated.
Common Supply Chain Risk Management Challenges
The pain points you're being asked to solve
- Limited visibility beyond Tier 1 - you can't audit or engage everyone.
- Questionnaire fatigue - suppliers push back on repeated, inconsistent ESG surveys.
- Fragmented and accelerating regulation - CSDDD, UK Modern Slavery Act, CSRD, SEC climate, sector-specific due-diligence laws.
- Scarce audit and procurement resources - you need to focus effort where it matters most.
- Inconsistent supplier disclosures - hard to compare, benchmark, or trust.
- Geopolitical and tariff volatility - reshuffling sourcing priorities faster than assessments can keep up.
- Climate and physical risk disruption - exposure often invisible until an incident occurs.
- Cybersecurity risk in third-party ecosystems - one supplier can compromise the enterprise.
- Forced labor and human-rights due-diligence obligations - with rising legal and reputational stakes.
The two-layer solution: modeled exposure + engaged management
Risk Exposure Assessment (REA) and Supplier Risk Management (SRM)
REA is a standalone, modeled assessment that does not require supplier participation. It can generate a risk profile for a supplier using limited inputs, including headquarters location and GICS Sub-Industry classification, subject to data availability and methodological constraints.
For organizations seeking deeper insight, REA can be complemented with Supplier Risk Management (SRM), our engaged supplier assessment. While REA provides a broad view of potential exposure, SRM delivers evidence-based insight into how selected suppliers identify, manage, and govern sustainability and business risks.
-
Risk Exposure Assessment (REA)
-
Supplier Risk Management (SRM)
Both REA and SRM can be used individually. In addition, a Performance Gap Analysis highlighting concrete areas for supplier development and remediation planning is available in combination with SRM.
Why REA is different: a self-standing solution that works without supplier engagement
REA is designed to work even when your suppliers won't – or can't – respond. It measures an entity's exposure to business, financial, operational, reputational, legal, and regulatory risks linked to its specific environmental, social, and governance profile on a 0–100 scale translated into a 7-grade risk level (Very Low → Very High).
Key facts about REA
No questionnaires. No supplier onboarding. No waiting.
REA can be generated from minimum inputs: headquarter location and GICS Sub-Industry (Level 4) code, subject to data availability and methodology limitations.
Complements – not replaces – engaged assessments.
REA can be used even if you already rely on engaged supplier questionnaires, audits, third-party ratings, or internal risk assessments. It helps you decide which suppliers to engage first, where to focus due diligence, and where modeled exposure may reveal risks before suppliers respond.
Multi-dimensional coverage.
REA spans three dimensions and 14 risk factors
Seven-grade risk scale
from Very Low to Very High makes prioritization intuitive across procurement, risk, and sustainability teams.
Built on S&P Global data depth
REA draws on Sustainable1 Environmental Analytics, Climate Analytics, ESG Scores (CSA/MSA), Asset Location and Geographic Segment data, Supply Chain data, Business Involvement Screens, and external sources including World Bank, V-Dem[1], and ITUC[2] Global Rights Index.
Transparent aggregation logic.
Raw data → Risk Indicator → Risk Factor (subject to a Controversy Multiplier) → Dimension → Total Risk Exposure Assessment.
[1] V-Dem - Social group equality in respect for civil liberties
[2] International Trade Union Confederation (ITUC)
Graphic 1: S&P Global Supplier Risk Exposure Assessment Screening criteria
Graphic 2: REA Supplier portfolio dashboard
Graphic 3: SRM Supplier portfolio dashboard
SRM: the engaged assessment layer for the suppliers that matter most
When your triage – via REA or your own methods – flags suppliers that need deeper evaluation, SRM delivers a structured, evidence-based view of how those suppliers actually manage ESG risk.
What SRM delivers
SRM provides a structured assessment of ESG management quality through 62 industry specific questionnaires with on average 47 questions. Drawing from 39 industry-agnostic and 23 industry-specific questions – covering up to 28 criteria and 400 data points, depending on the supplier’s industry.
The assessment combines five question types:
Policy focus
public evidence of commitments, policies, and governance practices.
Program measures
how the supplier identifies, manages, and mitigates key ESG impacts and risks.
KPIs
REA spans three dimensions and 14 risk factors
Verification
certifications or external assurance that support the credibility of procedures and systems.
Denominators
company information such as revenue, operations, and workforce, used to contextualize selected program and verification responses.
Clear evidence requirements: policy questions require public evidence, while other question types may be supported by public or private evidence.
Regulation-aware design. SRM is aligned with or informed by CSDDD, UK Modern Slavery Act, SASB, CSRD, and GRI, supporting your regulatory readiness workstreams.
CSA-powered efficiency.
Suppliers can pre-fill data from prior CSA or SRM assessments (up to the previous two methodology years), reducing questionnaire fatigue.
Clear performance labels
on a seven-tier scale (Very weak → Very strong) benchmarked against industry peers.
Sustainability Portal delivery
Suppliers receive invitations through the S&P Global Sustainability Portal; results and raw data are available to suppliers and approved buyers.
Performance Gap Analysis
available in combination with SRM, highlights concrete areas for supplier development and remediation planning.
Graphic 2: S&P Global Supplier Risk Management
How REA and SRM work together: from thousands of suppliers to focused action
A practical workflow, illustrated in the SRM methodology:
| Stage | Action | Example Funnel |
|---|---|---|
| 1. Screen (REA) | Modeled ESG risk exposure across the entire supplier base – no engagement required | ~2,000 suppliers |
| 2. Prioritize | Focus on suppliers with substantial modeled exposure | ~500 suppliers |
| 3. Engage (SRM) | Invite prioritized suppliers to complete SRM via S&P Global Sustainability Portal to assess management practices | ~500 suppliers |
| 4. Identify Gaps | S&P Global's Performance Gap Analysis surfaces persistent weaknesses | ~100 suppliers |
| 5. Remediate / Audit | *Focus your actions to engage on corrective actions and, where warranted, on-site audits | ~30 suppliers |
*Client led stage. S&P as methodology provider does not provide engagement services for corrective actions or on-site audits.
Already using engaged questionnaires, third-party ratings, or audits?
REA still adds value. Use it to validate, triangulate, and prioritize – surfacing modeled exposure that engaged assessments alone may miss, especially where supplier disclosures are limited or lagging.
Use cases across the enterprise
Procurement & sourcing
Segment your supplier base by inherent ESG risk in a matter of days. Focus onboarding due diligence on suppliers where modeled exposure is highest - driven by industry, geography, and 14 risk factors.
Sustainability & ESG
Build a defensible, methodology-grounded evidence base for supplier ESG risk, aligned with CSRD, CSDDD, and other disclosure and due-diligence frameworks.
Risk & compliance
Support human-rights due diligence, modern slavery reporting, and third-party risk programs with a scalable screening layer plus targeted engaged assessments for the suppliers that matter most.
Supply chain resilience
Overlay modeled climate physical risk, cybersecurity, and supply chain risk factors - grounded in Sustainable1 datasets - to inform network design and contingency planning against a backdrop of tariff volatility, geopolitical fragmentation and climate and biodiversity risk.
Benefits at a glance
- Scale without waiting. REA delivers modeled risk exposure without supplier onboarding - because it needs only HQ location and GICS Sub-Industry code as a minimum input.
- Depth where it counts. SRM captures evidence-based management practice across up to 400 data points.
- Reduced questionnaire fatigue. SRM data can be pre-filled from prior CSA and SRM assessments (where available).
- Regulatory alignment. Designed to support CSDDD, UK Modern Slavery Act, SASB, CSRD, and GRI reporting workstreams.
- Methodological transparency. Granular 0–100 scale underlying the clear 7-grade labels, documented aggregation logic, and disclosed assumptions and limitations.
- Complementary – not disruptive. Use REA alongside your existing engaged questionnaires, audits, and ratings.
Methodology credibility
REA and SRM are built by S&P Global Sustainable1, drawing on the same ecosystem behind the Corporate Sustainability Assessment (CSA), S&P Global ESG Scores, MSA, Business Involvement Screens, Environmental Analytics, and Climate Analytics.
- REA aggregates raw data → risk indicators → risk factors (with a Controversy Multiplier) → dimensions → total risk exposure, using linear scoring with mathematical or analytical thresholds, MSA controversy signals, and gap-filling logic based on GICS industry and country averages.
- SRM scores supplier responses at question, criteria, and dimension level, with industry-specific weighting and peer benchmarking.
Both are subject to documented assumptions and limitations - including, for REA, dependence on data availability (asset location, supply chain coverage, external country data), and for SRM, dependence on supplier disclosure and evidence quality.
Implementation workflow
*Client led stage. S&P as methodology provider does not provide engagement services for corrective actions or on-site audits.
FAQs
Ready to see your supplier base in a new light?
You don't need to wait for supplier responses to understand your ESG risk exposure. Start with REA today – a self-standing, modeled assessment that works with the data you already have. Add SRM when you're ready to go deeper with the suppliers who matter most.