Supplier risk register with heat map
One register for supplier risks across financial, supply continuity, quality, geopolitical, cyber, ESG and compliance areas, with inherent and residual scores, owners, mitigation and review dates.
- Free Excel file, no sign-up
- Eight supplier risk types
- Inherent and residual scoring
- Heat map and overdue reviews
| A | B | C | D | E | |
|---|---|---|---|---|---|
| 4 | Supplier | Risk type | Inherent | Residual | Next review |
| 5 | Brianza Plastics | Single or concentrated source | 20 Critical | 12 High | 2027-01-13 |
| 6 | Lumen Packaging | Financial | 12 High | 6 Medium | 2027-04-21 |
| 7 | Cloudmere Software | Cyber and data | 10 High | 4 Low | 2027-10-02 |
What is inside
4 sheets, ready to use.
Yellow cells are yours to fill in. Grey cells calculate. Every sheet has a worked example so you can see the expected format.
Read me
Purpose, steps, colour legend and assumptions.
Risk register
One row per risk: likelihood and impact before and after mitigation, rating, owner, status and next review.
Heat map
Count of risks on a 5 x 5 grid, inherent or residual, plus totals by rating and overdue reviews.
Settings
Rating bands, review intervals, risk types and the 1 to 5 likelihood and impact scales.
How to use it
Four steps from download to a decision.
No macros, no add-ins. It works in Excel, Google Sheets and LibreOffice.
01
Add one row per risk and score likelihood and impact from 1 to 5, before and after mitigation.
02
Ratings, the next review date and overdue flags are calculated.
03
Use the heat map to see where exposure sits, inherent or residual.
04
Review Critical and High risks with the supplier owner at every business review.
Spreadsheet or platform
Start in Excel. Move when the volume or the stakes grow.
The template and the platform use the same structure, so nothing you set up here is wasted.
This spreadsheet is enough when
- You track a few dozen known risks
- Risk reviews happen in a quarterly meeting
- You do not need outside signals such as financial or news alerts
Move it into EvaluationsHub when you need to
- Score risk continuously instead of once a quarter
- Combine risk with performance, ESG and contract data on one supplier record
- Assign mitigation actions with owners and due dates
- Report exposure by category, segment or site to leadership
Questions
Before you download
What is the difference between inherent and residual risk?
Inherent risk is the exposure before any controls. Residual risk is what remains after mitigation. Spend your attention where residual risk stays high.
Is the template really free?
Yes. The file downloads directly, with no form and no email address.
When should we move this out of Excel?
When several people rate the same suppliers, when suppliers need to see their results, or when actions get lost between file versions. That is usually the point where a shared platform pays back. Signs you have outgrown the spreadsheet → Running SAP, Coupa, Dynamics or Oracle? See the ERP layer →
Related templates
Next steps in the supplier lifecycle.
Templates that pick up where this one ends.
ESG and sustainability supplier questionnaire
19 ESG questions across governance, climate, human rights and ethics.
View template →
Weighted supplier scorecard with segment presets
Six dimensions, weights by segment, tiers and next actions.
View template →
Supplier business review (QBR) pack
Agenda with timings, RAG scorecard, action log and decisions.
View template →
Run it live
Run this process with your suppliers, not just in a file.
Start a free sandbox and set it up yourself: send requests and surveys to real suppliers, collect answers and see scores in one place.
