Demystifying Supply Chain Risk Assessment
Figure 2-1: SoT key risk areas for suppliers, supplies / components, and services
These 15 are further decomposed into 260 + risk categories, 700 + risk factors, and 2,200 + specific risk measures. SoT Body of Knowledge( BoK) version 1.5 introduces a new tier of AIspecific categories that address AI model integrity, AI infrastructure security, and AI governance and compliance [ 5 ]. This addition reflects the maturation of AI supply chain risk as a distinct discipline [ 6 ]. Each risk measure takes the form of a yes / no question designed to elicit specific, actionable information about potential vulnerabilities or risk indicators. This structure enables organizations to navigate from broad risk domains to increasingly specific assessment criteria tailored to their particular needs.
THE QUESTION-BASED METHODOLOGY
SoT’ s fundamental insight is that effective supply chain due diligence requires asking the right questions in a systematic manner. Most organizations develop ad hoc questionnaires that vary by procurement team, resulting in inconsistent assessments and blind spots. SoT provides a comprehensive question library covering the full spectrum of supply chain risks identified through extensive research and practical experience.
Consider the risk category“ Supplier Financial Stability Risks”( RC-13). Rather than merely asking whether a supplier is financially stable, SoT provides specific, measurable risk measures such as the following:
• Does the company have an Earnings Before Interest, Taxes, Depreciation, and Amortization( EBITDA) margin less than 0 %?
• Has the company filed for bankruptcy in the past 5 years?
• Does the company have a debt-to-equity ratio exceeding 2:1?
• Are company revenues declining more than 15 % year-over-year?
• Are revenues significantly concentrated in a single product line or customer subject to AI or forced labor regulatory disruption?
EDM Association – Journal of Innovation 81