Review and risk
Review against the exact document, record the gap, score the risk.
Reviewers check each requirement against a specific evidence version and scope, raise findings where it falls short, and score the risks that matter, one by one.
Reviews that say what they relied on
- For each requirement, record whether the evidence supports it, partly supports it, does not support it, has expired or does not apply. “Not applicable” needs a reason.
- Each review points at one evidence version and states whether its scope covers the service you use.
- Private notes stay with your team. Suppliers can never read them.
Findings and risks, kept individual
- Findings carry an owner, a severity, the requirement they relate to and the evidence versions involved.
- Risks are scored likelihood times impact on a 5 × 5 scale with anchored descriptions from your policy, then banded low, moderate, high or critical. The thresholds are yours to set.
- Residual risk is re-scored by a reviewer after safeguards. Holding a certificate never lowers it automatically.
- High and critical items are always shown individually. No average ever hides one.
Confidence, shown separately
- How much of the questionnaire is covered by evidence, how old that evidence is, whether its scope matches and whether anyone checked it are shown alongside the risk, not folded into it.
- Anything not yet known stays “unknown”. Missing information never shows as good news.
See it with your own suppliers.
We are looking for a small number of early customers to pilot it with. Tell us how you look after suppliers today and we will show you how it would work for you.