Build the assessment around your own products, suppliers, inputs, destination markets, and business decision—not a generic “China risk score.” Map material dependencies, document what is known and how it is evidenced, rank risks, assign actions and owners, then refresh the assessment when the business or its rules change.
What should a supply-chain risk assessment answer?
It should show where your business depends on China-linked suppliers, facilities, materials, routes, or services; what could disrupt those dependencies or cause harm; how well you can substantiate your understanding; and what you will do about the most significant risks. The appropriate scope depends on your products, supplier tiers, markets, applicable jurisdictions, and risk tolerance.
As an Amazon Associate I earn from qualifying purchases.
This is a decision tool, not a legal opinion or a definitive ranking of China-related risk. The available facts do not establish a risk finding for any particular company, product, supplier, or sector. A country-level rating cannot replace a company-specific map of its supply chain.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I assess supply-chain risk?
Use a repeatable workflow that links each material risk to evidence, controls, a response, and an accountable owner. Start with the decision the assessment must support—for example, whether to qualify another source or improve traceability—so the work stays focused on actionable dependencies.
-
Set the scope and decision
Specify the business unit, products, critical materials and components, destination markets, and decision under review. Identify the jurisdictions whose laws or controls could apply to the goods, parties, transactions, and destinations. Record important scope exclusions so that readers of the assessment know what it does not cover.
-
Map suppliers, inputs, facilities, and routes
Start with direct suppliers and their relevant facilities, then identify critical inputs, transport routes, ports, and key service providers. Ask for upstream supplier and origin information where an input is material to the product or the risk decision. A tier-one supplier list is not a complete supply-chain map.
For each data point, distinguish what is independently evidenced, what a supplier has asserted, and what remains unknown. Record the evidence and its date; a claim without supporting evidence should not be treated as verified visibility.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Identify risks that fit the business
Consider concentration and continuity; supplier and counterparty reliability; political, economic, and business conditions; trade restrictions, sanctions, and export controls; human-rights and forced-labor impacts; logistics; fraud; and financial exposure. Tailor the review to the business rather than assuming all categories are equally material.
Rank #2
Trade.gov’s guidance covers market conditions and partner risk. For organizations whose activities are subject to the U.S. Export Administration Regulations (EAR), the Bureau of Industry and Security (BIS) includes regular vulnerability assessment in its export-compliance guidance. These resources do not establish that every China-related transaction is controlled.
-
Rate and prioritize each material risk
For each risk statement, assess likelihood and severity, note existing controls and evidence quality, and determine the residual risk after those controls. Identify the affected people, business functions, products, or markets. Prioritize significant actual and potential impacts rather than treating every uncertainty as equally urgent.
The OECD’s due-diligence guidance emphasizes a risk-based approach and engagement with business partners and stakeholders to improve outcomes over time. It also says: “They do not expect companies to be perfect in everything, everywhere, all at once.”
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Choose a treatment and assign ownership
Select a response proportionate to the risk: improve traceability, engage the supplier, qualify an alternate source, prepare inventory or logistics contingencies, change contract terms, escalate a compliance question, or pursue exit or remediation where warranted. For every action, name an accountable owner, deadline, and measurable indicator.
-
Monitor and refresh the assessment
Set a review schedule appropriate to the business and define event triggers, such as a supplier or ownership change, a new product or route, a regulatory change, an adverse event, or a material loss of visibility. BIS says EAR-related compliance programs should conduct risk assessments regularly, at least annually, and maintain the program as relevant to the organization. That cadence applies in the export-compliance context; it is not a universal legal timetable for every business.
How do I map suppliers beyond tier one?
Work outward from the inputs and services that matter most to the decision. Ask direct suppliers to identify upstream suppliers, production locations, and origins for those inputs; request supporting records where feasible; and trace further back when the potential impact or dependency warrants it. Focus first on gaps that could change your prioritization or response.
Visibility is often weaker upstream. The OECD reports that 28–43% of estimated child labour for export goods is indirect, occurring in preceding tiers such as raw-material extraction or agriculture. The OECD topic page does not state a year for this estimate. The range is not China-specific and should not be read as a current rate for a particular company, product, or sector.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Trade.gov’s resources include country-risk and company/partner-risk information, an International Company Profile, and the Consolidated Screening List for restricted parties in certain U.S.-regulated transactions. Screening and other checks need to fit the transaction and applicable rules; a list search alone is not a complete supplier map.
What should go in the risk register?
Use one row per material supplier/input risk or dependency. The following is a practical working template synthesized from due-diligence, risk-assessment, recordkeeping, and program-maintenance guidance; it is not an official government form.
| Field | What to record |
|---|---|
| Supplier/input | The supplier, critical input, component, or service in scope. |
| Tier and facility/location | Known supplier tier and relevant production or processing location; distinguish verified details from supplier assertions and unknowns. |
| Destination market | The product or transaction market relevant to the assessment. |
| Risk statement | A specific way the dependency could cause disruption, non-compliance, or adverse impact. |
| Evidence and date | Source, supporting record, date collected, and evidence quality. |
| Likelihood and severity | The assessment of probability and consequence, using a consistent scale defined by the business. |
| Current controls | Controls already in place and what they cover. |
| Residual risk | The risk remaining after current controls. |
| Mitigation | The selected response and measurable indicator of progress or effectiveness. |
| Accountable owner | The person or function responsible for the action. |
| Deadline and review trigger | Target completion date and the event or condition that prompts reassessment. |
| Status | Current action state, such as open, in progress, or complete. |
Keep the evidence trail with the register so reviewers can distinguish an observed fact from an assumption or a supplier statement. If the organization uses likelihood or severity scales, define them and apply them consistently; do not imply numerical precision that the evidence cannot support.
Which legal and human-rights risks need special attention?
Applicability depends on the company’s jurisdiction, goods, parties, transactions, and destination markets. Confirm current official rules and lists when making a business decision, and get qualified legal or trade-compliance advice where needed.
Recommended Free Tools
- Export controls: Where activity may be subject to the U.S. EAR, BIS describes eight elements of an effective compliance program: management commitment, regular risk assessment, export authorization procedures, recordkeeping, training, audits, corrective actions, and ongoing program maintenance. Determine jurisdiction, classification, licensing, and party-screening obligations for the specific activity.
- Forced labor and human rights: Trade.gov collects U.S. resources relating to the Uyghur Forced Labor Prevention Act (UFLPA), Customs and Border Protection materials, Department of Labor tools, and related guidance. For EU exposure, the European Commission states that the Forced Labour Regulation applies from 14 December 2027. Its resources include guidance, a risk database, traceability tools, and an SME preparedness checklist.
- Sanctions-related due diligence: European Commission guidance published 19 February 2024 addresses risk assessment and due diligence for business partners, transactions, and goods, including circumvention red flags, in the context of export-related sanctions. It is not a general rule for all China-linked sourcing.
How can I reduce dependence on China without creating new supply risks?
Treat diversification as a scenario to assess, not an automatic cure. For feasible alternate suppliers or locations, compare the full transition and operating picture before committing:
- Total landed cost, lead time, and qualification and ramp time.
- Available capacity and the supplier’s ability to meet quality requirements.
- Supplier and geographic concentration, plus logistics resilience.
- Regulatory exposure and the traceability available for upstream inputs.
- Effects on workers and other stakeholders, as well as the residual dependency after the change.
A new source may reduce one concentration while introducing cost, quality, capacity, geographic, logistics, or worker impacts. Record the assumptions behind the comparison and the transition risks; do not count a source as a viable contingency until it can meet the relevant requirements.
When should the assessment change?
Refresh the relevant parts when a defined trigger occurs, not only at a calendar review. A material supplier change, ownership change, new product or route, regulatory development, adverse event, or significant loss of upstream visibility can alter the risk picture. Keep the broader review cadence proportionate to the business, while observing any specific legal or compliance-program requirements that apply.
Official resources change. Check the current versions of applicable government rules, restricted-party lists, and guidance at the time of assessment and before decisions that rely on them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
