0 / 24

Model 25 of 74 · Operations & Delivery

Vendor & Supply Chain Management Maturity Assessment

Assess how well your organisation runs its vendor relationships once contracts are signed: ownership, performance, value, risk, visibility and supply chain resilience.

Pillars & areas

Manage

Run each relationship well

  1. 01Ownership, Onboarding & Change
  2. 02Performance Management & SLAs
  3. 04Relationship Governance & Value

See

Spot risk early

  1. 03Risk & Dependency Management
  2. 05Supply Chain Visibility

Strengthen

Build resilience

  1. 06Diversification & Resilience

Levels

  1. 1DependentReactive & undocumented
  2. 2ManagedGoverned & measured
  3. 3PartneredStrategic & end-to-end

01 Ownership, Onboarding & Change

Does every vendor relationship have a clear owner, a good start, controlled changes and a planned exit?

0/4 answered

OC-1Who owns each vendor relationship once the contract is signed?

Think about whether someone in the business is responsible for making each relationship work day to day, or whether vendors are left alone after procurement hands over.

OC-2How structured is your vendor onboarding process?

Think about what happens between signing the contract and the vendor being fully operational — is there a defined handover?

OC-3How are changes to scope, volumes or requirements agreed with vendors during a contract?

Consider what happens when your needs change mid-contract: is there a controlled process, or do teams agree extras informally?

OC-4How does your organisation handle vendor exits and transitions?

Consider whether there is a plan for what happens when a vendor relationship ends, or whether exits are chaotic and disruptive.

02 Performance Management & SLAs

How does the organisation set expectations, measure vendor performance, and hold suppliers accountable?

0/4 answered

PMS-1How does your organisation define performance expectations with vendors?

Think about whether performance standards are clearly documented and agreed, or whether expectations are vague and assumed.

PMS-2How frequently and rigorously does your organisation review vendor performance?

Consider whether performance reviews are regular and data-driven, or whether they only happen when something goes wrong.

PMS-3How does your organisation respond when a vendor consistently underperforms?

Think about whether underperformance triggers a structured escalation, or whether it is tolerated until it becomes critical.

PMS-4How does your organisation incentivise strong vendor performance?

Consider whether good performance is acknowledged and rewarded, or whether vendors only hear from you when things go wrong.

03 Risk & Dependency Management

How well does the organisation understand and manage the risks that vendors and supply chains introduce?

0/4 answered

RDM-1How does your organisation identify and assess risks associated with its vendors?

Think about whether vendor risk is formally assessed covering financial, operational, cyber, compliance, and geopolitical dimensions.

RDM-2How well does your organisation understand its critical vendor dependencies?

Consider whether you know which vendors, if they failed tomorrow, would halt your operations — and whether that dependency is documented.

RDM-3How does your organisation manage the risk introduced by your vendors' own suppliers (sub-tier risk)?

Think about whether you have visibility beyond your direct suppliers into the deeper supply chain.

RDM-4How does your organisation ensure vendors meet its security, privacy, and compliance requirements?

Consider whether compliance obligations are clearly communicated, monitored, and enforced throughout the vendor relationship.

04 Relationship Governance & Value

Is each key vendor relationship governed well, handled well when things go wrong, and delivering the value expected?

0/4 answered

RG-1How would you describe the nature of your organisation's relationship with its key vendors?

Think about whether interactions are purely transactional (orders and invoices) or whether there is genuine two-way dialogue and shared goals.

RG-2How does your organisation check that a vendor relationship is delivering the value it was meant to?

Think beyond whether the vendor meets its SLAs: are the outcomes and benefits that justified the contract actually being achieved?

RG-3How easy does your organisation make it for vendors to deliver well?

Consider your side of the relationship: paying on time, giving clear requirements, making decisions promptly and providing access when needed.

RG-4How are incidents and service failures involving a vendor handled?

Think about an outage, missed delivery or quality failure caused by a vendor: how quickly and jointly is it managed and learned from?

05 Supply Chain Visibility

How much does the organisation see and understand about the status, flow, and health of its supply chain?

0/4 answered

SCV-1How much real-time visibility does your organisation have into the status of orders, shipments, and deliveries?

Think about whether you can see where things are in the pipeline right now, or whether you only know when something arrives or fails to arrive.

SCV-2How well does your organisation track total cost of ownership across its supply chain?

Consider whether you understand the full cost including logistics, quality failures, management overhead, and hidden costs — not just the unit price.

SCV-3How does your organisation use data and analytics to manage its supply chain?

Think about whether supply chain decisions are based on data and trends, or on gut feel and anecdotal evidence.

SCV-4How well is supply chain information shared with the teams that depend on it?

Consider whether operations, sales and customer service hear about supply delays and lead-time changes in time to plan, or only when customers complain.

06 Diversification & Resilience

How well is the supply chain protected against disruption through diversification, contingency planning, and stress testing?

0/4 answered

DR-1How dependent is your organisation on single-source suppliers for critical inputs?

Think about whether the failure of any single vendor would halt a critical business process — and whether alternatives are ready.

DR-2How does your organisation prepare for supply chain disruptions?

Consider whether there are documented contingency plans for scenarios like a key supplier going bankrupt, a logistics route being cut, or a raw material shortage.

DR-3How does your organisation assess the geographic and geopolitical risks in its supply chain?

Think about whether you understand where your supply chain is physically located and what regional risks (political instability, natural disasters, trade restrictions) could affect it.

DR-4How does your organisation test the resilience of its supply chain?

Consider whether you run simulations, tabletop exercises, or real stress tests — or whether you only discover weaknesses during actual disruptions.

Self-assessment report

Vendor & Supply Chain Management

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Vendor & Supply Chain Management maturity model

No organisation operates in isolation. Whether you manufacture physical products, deliver professional services, or run a technology platform, your ability to deliver depends on the vendors and supply chain partners you choose, how you manage them, and how resilient those relationships are when things go wrong. Yet many organisations treat vendor management as a procurement afterthought — signing contracts and hoping for the best.

True supply chain maturity means moving beyond transactional, price-driven relationships toward strategic partnerships built on shared visibility, mutual accountability, and deliberate resilience. It means knowing not just who your suppliers are, but who their suppliers are; not just whether they delivered last month, but whether they can deliver next year if conditions change.

This model picks up where procurement leaves off. Choosing suppliers and agreeing contracts is covered by the Procurement model; this one assesses what happens after the contract is signed: who owns each relationship, how performance and value are managed, how well vendor and supply chain risks are understood, and how resilient the supply chain is when things go wrong. It covers the practices that separate organisations who are at the mercy of their supply chains from those who actively shape them.

24 questions across 6 key areas, assessing how your organisation manages vendors and its supply chain once contracts are in place, from onboarding through to resilience. Takes approximately 10-15 minutes to complete.

Scoring is based on 3 maturity levels per question. Your overall score reflects the average maturity across all areas, giving you a clear picture of where your supply chain practices are strong and where they need attention.

Who this assessment is for

  • Supply chain and vendor management leaders
  • Business owners of key vendor relationships
  • Operations directors and COOs
  • Risk and compliance officers responsible for third-party risk
  • IT leaders managing technology vendor portfolios
  • Finance leaders overseeing supplier spend and total cost of ownership

The three maturity levels

  • Level 1 — Dependent: Vendor relationships are reactive and ad-hoc. Selection is driven by price and convenience, performance is not systematically tracked, and risks are invisible until they cause disruption. The organisation is at the mercy of its supply chain — when a vendor fails, the impact is immediate and severe because there are no alternatives, no contingency plans, and no early warning systems.
  • Level 2 — Managed: Vendor management follows defined processes. Selection uses structured evaluation criteria, contracts include meaningful SLAs, performance is reviewed regularly, and key risks are identified and documented. The organisation has control over its supply chain — it knows who its critical vendors are, tracks their performance, and has basic contingency plans in place. Relationships are professional and governed, though still largely transactional.
  • Level 3 — Partnered: Vendors are treated as strategic partners, not interchangeable suppliers. The supply chain is visible end-to-end, diversified against disruption, and continuously improved through shared data, joint planning, and collaborative innovation. The organisation and its key vendors share goals, co-invest in improvement, and build resilience together. Supply chain management is a competitive advantage, not just an operational function.

The 6 areas assessed

  1. Ownership, Onboarding & Change — Does every vendor relationship have a clear owner, a good start, controlled changes and a planned exit?
  2. Performance Management & SLAs — How does the organisation set expectations, measure vendor performance, and hold suppliers accountable?
  3. Risk & Dependency Management — How well does the organisation understand and manage the risks that vendors and supply chains introduce?
  4. Relationship Governance & Value — Is each key vendor relationship governed well, handled well when things go wrong, and delivering the value expected?
  5. Supply Chain Visibility — How much does the organisation see and understand about the status, flow, and health of its supply chain?
  6. Diversification & Resilience — How well is the supply chain protected against disruption through diversification, contingency planning, and stress testing?

How this model relates to other frameworks

  • ISO 28000 — Security Management Systems for the Supply Chain
  • NIST SP 800-161 — Cyber Supply Chain Risk Management (C-SCRM)
  • CIPS (Chartered Institute of Procurement & Supply) Global Standard for Procurement and Supply
  • SCOR (Supply Chain Operations Reference) Model
  • ISO 20400 — Sustainable Procurement Guidance
  • SIG (Standardized Information Gathering) Questionnaire for Third-Party Risk
  • APICS / ASCM Supply Chain Management Body of Knowledge

Frequently asked questions

What is the Vendor & Supply Chain Management maturity model?

Assess how well your organisation runs its vendor relationships once contracts are signed: ownership, performance, value, risk, visibility and supply chain resilience. It is an original, simplified model with three maturity levels (Dependent, Managed and Partnered), assessed through 24 questions across 6 areas: Ownership, Onboarding & Change, Performance Management & SLAs, Risk & Dependency Management, Relationship Governance & Value, Supply Chain Visibility and Diversification & Resilience.

How long does the Vendor & Supply Chain Management assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Dependent), 2 (Managed) or 3 (Partnered). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.