I regularly talk to procurement managers who know risks exist but don't have a structured overview of where their biggest dependencies actually sit.
Three years ago, that was still a theoretical problem. Since the pandemic's supply chain disruptions, the geopolitical shifts, and the rise in regulatory requirements, it's an operational one.
Whoever doesn't know their procurement risks can't manage them. Whoever doesn't manage them gets surprised by them. And surprises in procurement are expensive.
Several developments are stacking on top of each other right now in a way that puts structural pressure on procurement.
Geopolitical instability is the first driver. Trade conflicts, sanctions, and regional tensions in the Middle East, Asia, and Eastern Europe are affecting supply chains in ways that were barely foreseeable five years ago. Raw material markets that were stable for decades are now swinging. Transport routes get rerouted. Lead times stretch out without warning.
Raw material and energy price volatility adds to this. If you buy raw-material-intensive categories, metals, plastics, paper, energy, you know the planning certainty of past years no longer exists. That makes budget planning harder and strengthens the case for framework agreements with price adjustment clauses.
Regulatory density is the third factor. CSDDD, the German Supply Chain Act, CBAM, the requirements around supplier transparency keep growing. This isn't just a compliance topic, it's an operational risk. Suppliers who can't or won't meet these requirements won't be an option going forward.
Supplier concentration rounds out the picture. Many mid-market companies have consolidated their supplier base in recent years for efficiency reasons. That saved money, but created dependencies that are now becoming visible.
Not all risks are equal. A sensible risk structure for mid-market companies breaks down into four categories.
Supply risk is the first category. The core question is what happens if a critical supplier stops delivering. Causes include supplier insolvency, natural disaster, geopolitical disruption, transport problems. Supply risk is the most direct one, and the one that shuts down your own operations the fastest. The right action is to identify at least one qualified alternative supplier for every critical category where a delivery stop would jeopardize your own production or core service. That takes time, but it isn't optional.
Price risk is the second category. The core question is which cost positions could rise significantly over the next 12 months. Causes include raw material markets, energy prices, transport costs, currency movements with international suppliers. The right action is to build price adjustment clauses into framework agreements that link development to an index, instead of just fixed annual prices. It also helps to factor price scenarios into the budget for categories exposed to volatility.
Quality and compliance risk is the third category. The core question is whether our suppliers meet the requirements we set for them, and that regulators set for us. Causes include quality problems in the supplier chain, missing certifications, failure to meet supply chain due diligence requirements. The right action is regular supplier evaluations, documented due diligence processes for relevant suppliers, and active communication around sustainability requirements.
Dependency risk is the fourth category. The core question is where we're single-sourced, meaning fully dependent on one supplier. Causes include supplier consolidation, scaling, lack of market knowledge, personal relationships that prevent switching. The right action is to identify single-source situations and either consciously accept them or actively address them. Not every single-source situation needs to be resolved, but it needs to be known.
Full-scale supply chain risk management like large enterprises run doesn't make sense for the mid-market. But a pragmatic risk assessment does, and it doesn't need a new system.
Step one is identifying critical categories. Which purchasing categories are indispensable to your core business? These are the categories where a delivery stop causes immediate damage.
Step two is answering three questions for every critical category. How many qualified suppliers exist? Is there price volatility? Are there compliance requirements that aren't reliably met?
Step three is assigning a risk level. Green means stable, alternatives exist, compliance secured. Yellow means watch, action needed within three to six months. Red means immediate action needed.
Step four is deriving actions. For red, that means qualify alternative suppliers, review contract terms, inform leadership. For yellow, that means half-yearly review, clear escalation paths.
A single procurement manager can do this in a day. The result is a clear picture of your own risk position, no external consultants, no new system.
Risk management ultimately comes down to data availability. Whoever keeps their RFQ history, supplier evaluations, and contract data digitally is in a far better starting position than whoever has to search through an email archive.
Here's what that looks like in practice. If a supplier fails and procurement can check a digital platform for which alternative suppliers bid on past RFQs, and at what prices, the response time is significantly shorter.
cusoso Target stores RFQ and supplier data in a structured, searchable way. Not a full risk management tool, but a data foundation that matters when it counts.
We buy mostly locally, are we still exposed? Yes. Local suppliers are affected by global developments, through raw material prices, energy, regulation. Also, local suppliers can fail too. Supply risk exists regardless of geography.
How is procurement supposed to assess geopolitics? Isn't that management's job? Procurement doesn't need geopolitical expertise. It needs a mechanism that flags early when critical suppliers sit in affected regions. That's a monitoring task, not an analysis task.
The Supply Chain Act only applies to larger companies, is this relevant for us? Formally, the German Supply Chain Act currently applies from 1,000 employees. But if you supply customers with more than 1,000 employees, those customers increasingly ask you about due diligence. The topic arrives through the supply chain, not just through the law.
What's the minimum we should do right now? Identify critical categories. For each one, check whether there's an alternative supplier. The answer "no" isn't a problem in itself, but it needs to be known and documented.
Procurement risks can be roughly mapped in a day, no new system, no consultants. The first step is the list of critical categories.
cusoso Target makes RFQ and supplier data searchable, so no time gets lost digging through the email archive when it matters most. Whether it fits your procurement organization is something our quick check shows in 3 minutes.
→ To the quick check
Three years ago, that was still a theoretical problem. Since the pandemic's supply chain disruptions, the geopolitical shifts, and the rise in regulatory requirements, it's an operational one.
Whoever doesn't know their procurement risks can't manage them. Whoever doesn't manage them gets surprised by them. And surprises in procurement are expensive.
Why 2026 is a particular year for procurement risk
Several developments are stacking on top of each other right now in a way that puts structural pressure on procurement.
Geopolitical instability is the first driver. Trade conflicts, sanctions, and regional tensions in the Middle East, Asia, and Eastern Europe are affecting supply chains in ways that were barely foreseeable five years ago. Raw material markets that were stable for decades are now swinging. Transport routes get rerouted. Lead times stretch out without warning.
Raw material and energy price volatility adds to this. If you buy raw-material-intensive categories, metals, plastics, paper, energy, you know the planning certainty of past years no longer exists. That makes budget planning harder and strengthens the case for framework agreements with price adjustment clauses.
Regulatory density is the third factor. CSDDD, the German Supply Chain Act, CBAM, the requirements around supplier transparency keep growing. This isn't just a compliance topic, it's an operational risk. Suppliers who can't or won't meet these requirements won't be an option going forward.
Supplier concentration rounds out the picture. Many mid-market companies have consolidated their supplier base in recent years for efficiency reasons. That saved money, but created dependencies that are now becoming visible.
The four most important risk types in procurement
Not all risks are equal. A sensible risk structure for mid-market companies breaks down into four categories.
Supply risk is the first category. The core question is what happens if a critical supplier stops delivering. Causes include supplier insolvency, natural disaster, geopolitical disruption, transport problems. Supply risk is the most direct one, and the one that shuts down your own operations the fastest. The right action is to identify at least one qualified alternative supplier for every critical category where a delivery stop would jeopardize your own production or core service. That takes time, but it isn't optional.
Price risk is the second category. The core question is which cost positions could rise significantly over the next 12 months. Causes include raw material markets, energy prices, transport costs, currency movements with international suppliers. The right action is to build price adjustment clauses into framework agreements that link development to an index, instead of just fixed annual prices. It also helps to factor price scenarios into the budget for categories exposed to volatility.
Quality and compliance risk is the third category. The core question is whether our suppliers meet the requirements we set for them, and that regulators set for us. Causes include quality problems in the supplier chain, missing certifications, failure to meet supply chain due diligence requirements. The right action is regular supplier evaluations, documented due diligence processes for relevant suppliers, and active communication around sustainability requirements.
Dependency risk is the fourth category. The core question is where we're single-sourced, meaning fully dependent on one supplier. Causes include supplier consolidation, scaling, lack of market knowledge, personal relationships that prevent switching. The right action is to identify single-source situations and either consciously accept them or actively address them. Not every single-source situation needs to be resolved, but it needs to be known.
Pragmatic risk assessment without a big system
Full-scale supply chain risk management like large enterprises run doesn't make sense for the mid-market. But a pragmatic risk assessment does, and it doesn't need a new system.
Step one is identifying critical categories. Which purchasing categories are indispensable to your core business? These are the categories where a delivery stop causes immediate damage.
Step two is answering three questions for every critical category. How many qualified suppliers exist? Is there price volatility? Are there compliance requirements that aren't reliably met?
Step three is assigning a risk level. Green means stable, alternatives exist, compliance secured. Yellow means watch, action needed within three to six months. Red means immediate action needed.
Step four is deriving actions. For red, that means qualify alternative suppliers, review contract terms, inform leadership. For yellow, that means half-yearly review, clear escalation paths.
A single procurement manager can do this in a day. The result is a clear picture of your own risk position, no external consultants, no new system.
What digitalization delivers for risk management
Risk management ultimately comes down to data availability. Whoever keeps their RFQ history, supplier evaluations, and contract data digitally is in a far better starting position than whoever has to search through an email archive.
Here's what that looks like in practice. If a supplier fails and procurement can check a digital platform for which alternative suppliers bid on past RFQs, and at what prices, the response time is significantly shorter.
cusoso Target stores RFQ and supplier data in a structured, searchable way. Not a full risk management tool, but a data foundation that matters when it counts.
Frequently asked questions
We buy mostly locally, are we still exposed? Yes. Local suppliers are affected by global developments, through raw material prices, energy, regulation. Also, local suppliers can fail too. Supply risk exists regardless of geography.
How is procurement supposed to assess geopolitics? Isn't that management's job? Procurement doesn't need geopolitical expertise. It needs a mechanism that flags early when critical suppliers sit in affected regions. That's a monitoring task, not an analysis task.
The Supply Chain Act only applies to larger companies, is this relevant for us? Formally, the German Supply Chain Act currently applies from 1,000 employees. But if you supply customers with more than 1,000 employees, those customers increasingly ask you about due diligence. The topic arrives through the supply chain, not just through the law.
What's the minimum we should do right now? Identify critical categories. For each one, check whether there's an alternative supplier. The answer "no" isn't a problem in itself, but it needs to be known and documented.
The next step
Procurement risks can be roughly mapped in a day, no new system, no consultants. The first step is the list of critical categories.
cusoso Target makes RFQ and supplier data searchable, so no time gets lost digging through the email archive when it matters most. Whether it fits your procurement organization is something our quick check shows in 3 minutes.
→ To the quick check