Best Practices

How to Create a Supplier Inventory

The supplier inventory is the foundation of every TPRM programme — without a complete inventory, no risk can be managed.

A complete supplier inventory in 5 steps — from data collection through structuring to ongoing maintenance with 360TPRM.

Steps 1-3: Data collection and structuring

Step 1 — Identify data sources: accounting/ERP (vendor master list), procurement (contract database), IT (software and cloud service list), business units (external services and providers in use), compliance/legal (existing DPAs and supplier contracts). Step 2 — Consolidate the data: merge all sources, identify and clean up duplicates, fill in missing information. Step 3 — Structure the inventory: define a consistent format (DORA Art. 28 (3) as a minimum standard), define mandatory fields: name, service, classification, contract data, data location, contact.

DORA-compliant format from the start

Building the supplier inventory directly in a DORA-compliant format (EBA RTS) saves having to restructure later. 360TPRM supports this format natively.

Steps 4-5: Classification and ongoing maintenance

Step 4 — Classify suppliers: assess every captured supplier against criticality criteria, document the classification result in the inventory, add the 360TPRM risk score as an additional data point. Step 5 — Ensure ongoing maintenance: a process for new suppliers (no contract without an inventory entry), a process for changes (classification review on material changes), an annual inventory review as a mandatory checkpoint; 360TPRM maintains risk scores automatically every day.

The first inventory is always incomplete

Rule of thumb: when building the first inventory, typically 20-40% of actual suppliers are initially overlooked. Systematic data collection from every source is essential.

FAQ

What's the difference between a supplier inventory and a contract database?+

The contract database holds contract documents. The supplier inventory holds structured risk and classification information. The two are complementary.

How detailed does the inventory need to be?+

Critical suppliers: complete information (DORA Art. 28 (3)). Standard suppliers: basic information (name, service, classification). Quality over completeness.

Build and maintain supplier inventory

See in a 45-minute demo how 360TPRM specifically meets your requirements.

Request free demo →