Risk Assessments

Hi there

Your question mentions indirect categories, a term typically used in procurement or supply chain organizations. So I will do my best to answer through that lens, and I apologize in advance if I misunderstand the question.

During my years reporting into a supply chain organization, we defined direct categories as those products, supplies, goods, and services you need for your core business activity. Conversely, indirect categories were defined as the non-essential products and services that support the business but not in a mission-critical way and tend to be more transactional. You typically would not find your indirect categories critical based on that methodology.

That is not to say that there might not be an indirect category critical to your organization. When we think about critical vendors, we recommend you ask the following questions:

• Would there be a significant impact on the organization's operations if the vendor fails?
• Could the organization face significant risk if the vendor fails to meet expectations?
• Could the vendor significantly impact our customers?
• Significant investments and resources are required to implement the third-party relationship and manage the risk?

You can apply this same question set to your indirect categories to help you determine if any of them may be critical.

I hope that answer was helpful, but I would love to hear our other members weigh in.