Busting 5 common supplier risk myths

That gap matters more every year. A supplier in a high-risk region becomes a headline. A sanctions update cuts off a component. A key customer sends a long due diligence survey with a tight deadline. A bank asks how you manage human rights and environmental risk before renewing a credit line. None of these wait for a regulation to apply.

Regulation is part of the picture. CSRD and ESRS, CSDDD, national due diligence laws, and EU rules on forced labour and deforestation (which comes to effect in under two months) all ask companies to know their suppliers. But the Omnibus I package narrowed several of these, and many companies are now out of scope. The underlying need hasn’t changed: buy from suppliers you understand, spot problems before they become disruptions, and show your work when someone asks.

Supplier risk is a business question

Good supplier management starts with risk screening. Before you onboard a new supplier, renegotiate a contract or answer a customer’s questionnaire, you need a clear view of exposure: which countries, which sectors, which companies, and which issues.

With that view, procurement can make sourcing decisions on evidence, sustainability teams can focus their follow-up, and leadership can see where the business is exposed. Without it, every request starts from zero, usually in a spreadsheet.

When we talk to procurement and sustainability leads about automating that work, we hear the same five objections. Each one is reasonable. None of them holds up for long.

1. “We don’t have time to implement another tool.”

You don’t need to implement everything at once. Start with screening.

Link your suppliers to the Position Green database and run a risk screening straight from each supplier profile. Risk signals appear before a single survey is sent, so you can see early which suppliers deserve attention and which don’t.

That is where the value shows first: a ranked view of your supply base instead of a spreadsheet of names. Surveys, approval flows and reporting can follow once the screening has earned its place.

2. “The regulation is delayed and we’re out of scope now.”

The deadlines moved. The risk didn’t.

As an example, under Omnibus I, CSDDD now applies only to the very largest groups, with national laws due by July 2028 and compliance from July 2029. CSRD scope shrank too. For many companies, that reads as permission to park supplier due diligence.

But most of the manual effort never came from one directive. Customers still need supplier data to meet their own obligations, and if you sell to a company that is in scope, their due diligence becomes your questionnaire. Lenders and insurers still screen supply chain risk. National laws and EU rules on forced labour and deforestation are still coming. Building a screening process now, at your own pace, costs far less than a rushed one later, when a customer audit, an incident or a new rule forces the issue.

3. “Can we trust an automated risk score?”

You shouldn’t treat any risk score as a verdict. It is a signal that tells you where to look.

Our scoring is expert-validated. It combines recognised external indices and ratings with Position Green’s own risk methodology which is built on the ESRS DMA best practice for defining materiality of risks and impacts.so every score rests on sources you can name and explain to an auditor. When a result needs interpretation, our advisors are available to help.

Most importantly, the decision stays with your team. Clear approval flows let you review the signal, add context, and record the final call, along with who made it and why. Automation does the sorting. People do the judging.

4. “Our suppliers are tired of surveys.”

Yes, they are. That is exactly why screening comes first.

Sending the same long questionnaire to every supplier is how survey fatigue starts. It burdens low-risk suppliers, buries the answers that matter, and lowers response rates across the board.

Screen first, then survey only where exposure is high and evidence is thin. And when a survey does go out, it adapts to the supplier’s size and industry, so a ten-person packaging firm is not answering the same questions as a multinational mining company. Fewer surveys, shorter surveys, better answers.

5. “We can do this in Excel.”

You can, for a while.

A spreadsheet works fine for a few dozen suppliers and one person who knows where everything is. It starts to strain when the list grows to hundreds, when an auditor asks how a risk rating was reached, or when a customer, a lender and a regulator each ask for the same data in a different shape. Version control, evidence trails and follow-up reminders all become manual work on top of the manual work.

The question isn’t whether Excel can hold the data. It’s how many hours your team spends keeping it true.

Start small, start with signal

Whether you report under ESRS, have just left its scope, or were never in it, the pattern is the same. Questions about your suppliers keep arriving, from customers, lenders, auditors and your own board. Answering them by hand gets more expensive every year, and knowing your exposure late gets more expensive still.

You don’t need a big-bang implementation to change that. Link your suppliers, run a screening, and see where your real exposure sits. Then decide where surveys, approvals and reporting add value.