Most supplier risk registers share a life cycle. Built with enthusiasm over several weeks, comprehensive and colour-coded, reviewed once, updated sporadically, and quietly abandoned within a year. The failure is almost never the analysis. It’s that the thing built was too heavy to maintain.

Scope it Down Aggressively

A register covering four hundred suppliers is a data-entry project with no upside. Most of those suppliers could disappear tomorrow and you’d replace them within a fortnight.
Cover the suppliers where failure genuinely hurts: sole sources, long-lead items, anything requiring qualification or certification to switch, and anything where a stoppage propagates to customers within days. For most mid-sized manufacturers that’s twenty to forty suppliers. A register of forty entries can be maintained. A register of four hundred cannot.

Record What Drives Decisions

For each supplier, the useful fields are narrower than the standard template suggests. What they supply and which products it feeds. Whether a qualified alternative exists, and how long switching would genuinely take. Your share of their revenue — both directions of this matter, since being a tiny customer means low priority, and being their largest means their failure is your problem. Financial health, at whatever level you can observe. Geographic and sub-tier concentration. Current performance trend.
Then one field that most registers omit and that makes the document actually useful: what we would do on day one. Not a full contingency plan — a sentence. Switch to supplier B, six-week qualification, expect four weeks of shortage. Written calmly in advance, it’s worth more than anything produced during the event.

Automate The Parts That Decay

Registers die because manual fields go stale. Performance data, lead time trends, spend concentration, and open exposure should all be pulled from transaction data rather than typed in. That leaves only genuine judgement fields for humans to maintain, and those change slowly.
If updating the register is a two-hour job every quarter, it will happen. If it’s a two-day job, it won’t.

Give it Somewhere to Live

A register with no forum is a document. Put fifteen minutes on an existing monthly meeting and review only exceptions: suppliers whose risk position changed, mitigations that are overdue, new sole-source dependencies created since last time. That last item catches the slow drift that creates most new exposure — someone consolidates volume to one supplier for a good commercial reason and nobody registers that a second source just disappeared.

A Reasonable First Version

One page per critical supplier, most fields populated automatically, one paragraph of human judgement, reviewed monthly by exception. Build that, use it for six months, then decide whether it needs more. It almost never does.
The test of whether it’s working isn’t completeness. It’s whether anyone reaches for it when something goes wrong. A register consulted during an actual supplier problem has earned its keep; one that stays closed during exactly the event it was built for was never the right document.
ticktick.ai maintains supplier risk profiles from live transaction data, so performance, concentration, and exposure fields stay current without manual updating.