A due-diligence programme with a thousand suppliers and the capacity to assess forty a quarter does not have an information problem, it has an ordering problem. UFLPA and CSDDD both expect a risk-based approach, which means the order has to be defensible: not the biggest suppliers, not the ones someone remembered, but a ranking you can show the reasoning behind. That is what this produces from three columns — a supplier list ranked by impact × risk, with every number decomposable into factor, weight and source.
Risk is what could go wrong at that supplier. Impact is what it costs you if it does. A supplier who is high on one and low on the other is not an emergency; the ones high on both are the wave you send first.
| Country risk | 0.15 | corruption, labour rights, environment and rule of law, from published indices |
| Sector risk | 0.15 | what the work itself carries, before location |
| Conflict minerals | 0.10 | 3TG exposure implied by what they make |
| Incident history | 0.10 | sanctions, forced-labour and debarment findings against them |
| Information opacity | 0.10 | how little they have disclosed — not knowing is a risk, not a neutral |
| Annual spend | 0.15 | what you buy from them, from your own ledger |
| Substitution difficulty | 0.15 | how replaceable they are — sole source is the hard case |
| Continuity criticality | 0.10 | what stops if they stop |
Two of the risk factors are knowable before you upload anything, and they are published openly: see country × sector baselines for the country and sector halves. The other three need a specific company, which is what the upload supplies.
The factor most tools quietly drop is the one for missing information. A supplier who has disclosed nothing scores worse than one who has disclosed something unflattering, and a supplier you sent a questionnaire to who did not answer scores worse still than one you never asked — because you paid to find out and they declined. Otherwise the ranking rewards opacity, and the least visible part of the supply base sinks quietly to the bottom of the list.