A pharma company watches its suppliers by what they do
Thousands of suppliers were assessed once, at onboarding, by questionnaire. Adding payment data, public records and news turned a yearly exercise into a risk view that updates itself.
An illustrative scenario. The company is fictional and the figures show how the method works; they are not a client result.
The situation
A pharmaceutical manufacturer buys from thousands of suppliers: raw material makers, contract manufacturers, logistics firms, marketing agencies and consultants. Each was assessed by questionnaire when it was onboarded. After that, the file was rarely opened.
The compliance team knew that risks changed faster than the annual review, but had no way to see which suppliers to look at first.
What we looked at
- The vendor master and its change history
- Three years of purchase orders and payments
- Company registration and filing records
- Sanctions lists and adverse news
- The employee master, for possible conflicts
What we found
| Signal | What it pointed to |
|---|---|
| Suppliers sharing bank accounts or addresses with employees | Possible conflicts of interest |
| Frequent bank detail changes | Payment fraud risk |
| Suppliers that had stopped filing statutory returns | Possible distress or shell companies |
| Heavy dependence on a single supplier for a key input | Continuity risk |
| Adverse news after onboarding | Reputation risk |
Most suppliers scored low and needed nothing more. A short list, ranked by risk and spend, went to compliance and procurement each month.
What changed
- Risk follows behaviour. Scores update as payments, records and news change.
- Questionnaires where they help. Detailed questionnaires now go only to suppliers whose score or category calls for one.
- Clear actions. Each high-risk supplier has an owner and a decision: review, restrict or exit.
Products and services
CompliBear TPRM builds the risk score from data. Read Know every vendor by what it does, or see third-party risk.