Chapter 4 of 8

Supplier Risk Scoring and Expected Loss

3 sections · ~8 min read · 3 practice questions · part of Supply Chain Analytics

Learning objectives

  • Build a weighted multi-criteria risk index and state the normalization and weighting assumptions behind it
  • Convert a qualitative risk rating into an expected annual loss in dollars
  • Evaluate a mitigation investment against the loss it removes and compute the breakeven condition

Scoring indexes rank, they do not price

Most supplier risk programs start with a scorecard: several criteria, each rated on a common scale, combined with weights into a single index. Typical criteria include financial stability, geographic concentration, degree of single-source dependency, quality history, and estimated recovery time after a disruption. Building one requires three explicit choices, each of which changes the answer. The first is direction: decide whether a high raw score means high risk or low risk, and apply it consistently, because a single reversed criterion silently inverts part of the index. The second is normalization: raw criteria arrive in incompatible units, such as defect parts per million, days to recover, and a credit grade, so each must be mapped onto a common scale, most simply an ordinal one-to-five rating with published anchors describing what each level means. The third is weighting, which is a statement of the firm's priorities and not an empirical fact. Weights should be set before seeing the scores, documented, and reused across suppliers, otherwise the index becomes a way of confirming a conclusion already reached. The honest description of the output is that it is an ordinal ranking. An index of 61 is not twice as risky as an index of 30, and the difference between 61 and 56 is well within the noise of a subjective one-to-five rating. Use the index to triage attention, never to justify spend.

Turning a rating into money

The scorecard tells you where to look; expected loss tells you what to do. Expected annual loss is the annual probability that a disruption occurs, multiplied by the expected duration of that disruption, multiplied by the financial exposure per unit of duration. The exposure figure needs care. The right quantity is normally the contribution margin that cannot be earned during the outage, not revenue and not full cost, because variable costs are largely avoided while production is stopped. It should also be net of whatever mitigation already exists: if finished goods inventory covers the first several days of any outage, then only the days beyond that cover are exposed, and the expected loss shrinks accordingly. Each of the three inputs is uncertain, and the probability term is the weakest, typically an informed judgment rather than an estimate from data, because disruptions at a given supplier are rare enough that no useful frequency exists. That weakness is a reason to run the calculation in reverse rather than a reason to skip it.

Breakeven analysis when the probability is a guess

Because the probability input is the least defensible number in the chain, the most useful form of the analysis inverts it. Rather than asking whether expected loss exceeds mitigation cost at an assumed probability, ask what probability would make the firm indifferent. Set mitigation cost equal to the reduction in expected loss and solve for probability. The answer is a threshold, and the decision becomes a much easier question: is the true annual chance of disruption at this supplier plausibly above or below that threshold? Reasonable people can usually agree on which side of a threshold reality sits even when they cannot agree on a point estimate. The same inversion works on any input: hold probability fixed and solve for the duration reduction that would justify the spend, or for the exposure level at which the investment pays. Presenting a threshold alongside the point estimate also disciplines the analyst, because it makes visible how sensitive the recommendation is to the softest assumption. A mitigation that only pays when the probability guess is exactly right is not a robust recommendation.

Worked example

Problem

Marlow Instruments rates three suppliers of a critical machined housing on five criteria, each on a one-to-five scale where 5 means highest risk. Weights are financial stability 0.20, geographic concentration 0.15, single-source dependency 0.25, quality history 0.20, and recovery time 0.20. Ratings are Alpha Forge 2, 4, 5, 2, 4; Bravo Machining 4, 2, 3, 4, 3; Cielo Precision 1, 3, 2, 3, 2. Compute each weighted index and rescale it to a 0 to 100 scale where a straight 1 maps to 0 and a straight 5 maps to 100. Then for the highest-risk supplier, assume a 12 percent annual probability of a disruption lasting 18 days beyond existing inventory cover, with 42,000 dollars of contribution margin exposed per day. A dual-sourcing qualification costing 95,000 dollars per year would cut the exposed duration to 6 days without changing the probability. Compute expected annual loss before and after, the net benefit, and the breakeven probability.

Step by step

  1. Alpha Forge weighted terms: 2 x 0.20 = 0.40, 4 x 0.15 = 0.60, 5 x 0.25 = 1.25, 2 x 0.20 = 0.40, 4 x 0.20 = 0.80. Weighted index = 0.40 + 0.60 + 1.25 + 0.40 + 0.80 = 3.45.
  2. Bravo Machining weighted terms: 4 x 0.20 = 0.80, 2 x 0.15 = 0.30, 3 x 0.25 = 0.75, 4 x 0.20 = 0.80, 3 x 0.20 = 0.60. Weighted index = 3.25.
  3. Cielo Precision weighted terms: 1 x 0.20 = 0.20, 3 x 0.15 = 0.45, 2 x 0.25 = 0.50, 3 x 0.20 = 0.60, 2 x 0.20 = 0.40. Weighted index = 2.15.
  4. Rescale with the formula (index minus 1) divided by 4, times 100. Alpha = (3.45 - 1) / 4 x 100 = 2.45 / 4 x 100 = 61.25. Bravo = (3.25 - 1) / 4 x 100 = 56.25. Cielo = (2.15 - 1) / 4 x 100 = 28.75.
  5. Expected annual loss at Alpha today = 0.12 x 18 days x 42,000 dollars per day = 0.12 x 756,000 = 90,720 dollars per year.
  6. Expected annual loss after dual sourcing = 0.12 x 6 days x 42,000 = 0.12 x 252,000 = 30,240 dollars per year.
  7. Reduction in expected loss = 90,720 - 30,240 = 60,480 dollars per year.
  8. Net benefit = 60,480 - 95,000 = negative 34,520 dollars per year. Benefit-to-cost ratio = 60,480 / 95,000 = 0.64.
  9. Breakeven probability: set p x (18 - 6) x 42,000 = 95,000, so p x 504,000 = 95,000, giving p = 95,000 / 504,000 = 0.1885 or 18.85 percent per year.
  10. Equivalently, at the assumed 12 percent probability the mitigation would have to cost no more than 0.12 x 12 x 42,000 = 60,480 dollars to break even.

Answer. Risk indexes are Alpha Forge 61.25, Bravo Machining 56.25, and Cielo Precision 28.75 on the 0 to 100 scale, so Alpha ranks highest but its 5-point lead over Bravo is inside the noise of a subjective 1-to-5 rating and should not by itself drive spending. On the money question, the 95,000-dollar dual-sourcing program removes 60,480 dollars of expected annual loss and therefore destroys about 34,520 dollars of value per year at the stated assumptions, a benefit-to-cost ratio of 0.64. The decision hinges entirely on the probability estimate: the program breaks even at an annual disruption probability of 18.85 percent. The right conversation is therefore not about the score but about whether a disruption at Alpha is genuinely more likely than roughly one year in five. If it is, proceed; if not, either negotiate the mitigation cost below 60,480 dollars or find a cheaper way to shorten the outage, such as holding additional finished goods cover.

Practice

Work each question before opening the solution.

  1. An alternative program costing 95,000 dollars per year would halve the disruption probability from 12 percent to 6 percent but leave the 18-day duration unchanged. Compare it to the dual-sourcing option and explain the result.

    Show solution for question 1

    Expected loss becomes 0.06 x 18 x 42,000 = 45,360 dollars, a reduction of 90,720 - 45,360 = 45,360 dollars per year, which is less than the 60,480 dollars saved by the duration-reduction option at the same price. Halving probability halves total expected loss, whereas cutting duration from 18 to 6 days removes two thirds of it, so at equal cost the duration lever wins here. The general lesson is that when residual duration is long, shortening recovery usually beats reducing likelihood, and recovery time is also easier to verify through an actual exercise than a probability estimate is.

  2. Cielo Precision scores 28.75, the lowest risk index, and a buyer proposes moving all volume there. Give two reasons the index alone does not support that move.

    Show solution for question 2

    First, the index is ordinal and criteria-limited: it contains no price, capacity, or technical capability information, so it cannot say whether Cielo can absorb the volume at an acceptable cost. Second, concentrating all volume at one supplier would itself change the inputs, raising Cielo's single-source dependency rating from 2 toward 5 and adding roughly (5 - 2) x 0.25 = 0.75 to its weighted index, or 18.75 points on the rescaled scale, pushing it to about 47.5. A risk score computed on the current allocation does not describe the world after the allocation changes.

  3. The finance team argues that the 42,000 dollars per day should be revenue rather than contribution margin, which would roughly triple the exposure. How does this change the recommendation, and which figure is correct?

    Show solution for question 3

    Tripling exposure to about 126,000 dollars per day would raise the expected loss reduction to roughly 181,440 dollars and make the 95,000-dollar program clearly worthwhile, with the breakeven probability falling to about 6.3 percent. Contribution margin is the correct basis, because during an outage the firm does not incur the variable material, freight, and direct labour costs embedded in revenue, so revenue overstates the true loss. The exception worth modelling separately is permanently lost customers, where the loss extends beyond the outage window and should be added as a distinct term rather than by inflating the daily rate.