Procurement field guide

A procurement risk register should make the next action obvious.

A risk register is useful when it connects a specific uncertainty to its possible consequence, available evidence, assigned owner, response action, due date, and remaining exposure. Generic labels alone do not support a decision.

Reviewed August 9, 2026

Practical guidance · Buyer decision support

Describe

Write the cause, event, and consequence in detail.

Instead of recording a vague label such as supplier risk, describe the condition that may occur and what it would affect. The wording should be specific enough that another reviewer understands why the item matters.

Name the underlying condition.
Describe the possible event.
State the operational or commercial consequence.

Control

Assign evidence, ownership, action, and timing.

Each material item should have an accountable owner, current evidence, response action, target date, and review status. Actions may reduce likelihood, reduce consequence, transfer exposure, avoid the condition, or accept it with authority.

Assign one accountable owner.
Use dated evidence.
Record approval for accepted exposure.

Review

Keep residual exposure connected to the decision.

Closing an action does not always remove the risk. The register should show what remains after the response, whether escalation is required, and how the item affects supplier selection, contracting, implementation, or continuity.

Reassess after actions complete.
Link material risks to decision notes.
Archive the final register with the purchase record.

Evidence trail

Official sources

Use the current source and the requirements that apply to the specific purchase or opportunity.

NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management

Bring the record into view

Continue the decision

Use this guide to organize the next step, then bring the requirement, supplier field, quotes, or unresolved risk to the procurement desk.

Start a procurement review