The Supply Chain Risk Management Process Explained
A working SCRM program follows a structured, repeatable process. Under NIS2 and DORA, showing that your process ran, with evidence, carries as much weight as the risk controls themselves. This guide breaks down every stage and shows how StartComply automates each one.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Chapter V 
Automated workflows 
Audit-ready evidence What you need to know about the SCRM process
- The SCRM process has five stages: identify, assess, prioritize, mitigate, monitor. It runs as a continuous cycle, not a one-time project.
- Annual assessments capture last year’s risk profile. NIS2 and DORA require continuous monitoring between assessments.
- The risk register is the operational output of the SCRM process and the primary audit evidence document under NIS2 and DORA.
- Spreadsheets cannot run a compliant SCRM process at scale. Automation is required, not optional.
- NIS2 requires 24-hour incident notification. DORA requires 4-hour ICT incident classification. The process must connect to your regulatory reporting workflows.
Sources: NIS2 Directive, DORA Regulation. Last updated April 2026.
Why Process Matters as Much as Controls
Most supply chain risk management programs fail not because organisations lack intention, but because they lack process.
Good intentions without a repeatable, documented, measurable process produce audit findings. Under NIS2 and DORA, demonstrating that you have a systematic approach to supply chain risk management carries as much weight as the risk controls themselves. Regulators do not accept verbal assurances. They examine documented processes and the evidence that those processes ran.
The supply chain risk management process has five interconnected stages. They form a continuous cycle, not a one-time project, that repeats as your supply chain changes, threats evolve, and risks are resolved or replaced.
The process cycle: Identify, Assess, Prioritize, Mitigate, Monitor. Then repeat as suppliers, threats, and obligations change.
The Five Stages of the SCRM Process
Risk Identification DORA Art. 28
Map your complete supply chain: direct suppliers, ICT providers, sub-contractors, cloud services, and critical software dependencies. Understand what access, data, and systems each supplier touches.
The scope is broader than most organisations expect at the start. DORA requires financial entities to understand the full sub-contracting chain for critical ICT providers, not just Tier-1 relationships. NIS2 requires organisations to manage the security of their supply chains, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
StartComply imports supplier data from existing procurement and ERP systems and builds a structured, searchable registry, classified by criticality, access scope, and service category.
Risk Assessment NIS2 Art. 21
Evaluate each supplier’s risk profile across six dimensions: cybersecurity posture, operational resilience, financial stability, regulatory compliance, concentration and dependency, and geopolitical exposure.
StartComply automates this through configurable questionnaire workflows. Assessment questionnaires go out automatically on your defined schedule, responses are scored against your risk model, and evidence documents such as ISO 27001 certificates, SOC 2 reports, and penetration test results are collected and stored. Every assessment generates a structured risk register entry without manual data entry.
Assessment frequency follows risk level: critical suppliers quarterly, high-risk semi-annual, standard annual. Any material change at a supplier triggers an unscheduled assessment regardless of cycle.
Risk Prioritization Risk appetite
Not all risks carry the same weight. Prioritization ranks every identified risk by likelihood and impact against your documented risk appetite.
Risks in the high-likelihood and high-impact zone require immediate action. Risks below your appetite threshold get accepted and monitored. StartComply applies your criticality classifications and likelihood/impact model automatically, producing a prioritized risk register without manual scoring. Every prioritization decision is recorded, which matters when auditors examine whether your SCRM program is systematic or ad hoc.
Risk Mitigation Corrective actions
For every risk above your appetite threshold, define and track specific mitigation actions: contractual requirements, supplier corrective action plans, technical access controls, redundancy arrangements, or relationship termination for risks that cannot be adequately managed.
StartComply creates corrective action records directly from assessment findings, including the specific action, internal owner, supplier contact, and target deadline. Automated escalation fires when deadlines approach or pass. Every action generates an audit trail entry from creation to closure.
For the full mitigation strategy guide: Supply Chain Risk Mitigation: Strategies and Tools.
Continuous Monitoring 24h / 4h SLAs
Annual assessments tell you what last year’s risk profile looked like. They do not capture what happened in the eleven months since.
StartComply monitors every supplier continuously: cyber threat intelligence feeds, financial health signals, regulatory and certification status changes, and news alerts. Risk scores update automatically when monitoring signals change. Escalation alerts fire when a supplier’s profile crosses a threshold. This is the ongoing monitoring both NIS2 and DORA require.
When a supplier incident surfaces, StartComply’s escalation workflows connect to your regulatory reporting obligations: 24-hour early warning under NIS2 and 4-hour classification under DORA.
SCRM Process vs. VRM Process: What Changes?
The SCRM process and the VRM process overlap, but they are not identical.
A vendor risk management process focuses on direct vendor relationships: onboarding, due diligence, contract controls, performance monitoring, renewal, and exit for named vendors. It asks whether each vendor relationship is acceptable and properly controlled.
The SCRM process looks wider. It maps the full chain of suppliers, sub-contractors, ICT providers, software dependencies, logistics partners, cloud services, and downstream failure paths that can affect operational resilience, cybersecurity, and regulatory compliance. It asks how risk travels through the chain, not only whether one vendor passes an assessment.
That difference matters for NIS2 and DORA. SCRM requires visibility into cascading dependencies, concentration risk, sub-supplier exposure, and continuous monitoring across the supplier ecosystem. VRM remains essential, but SCRM adds the supply-chain structure, Nth-party visibility, and resilience view that vendor-level processes can miss.
Practical distinction: VRM manages vendor relationships. SCRM manages the wider supplier ecosystem, including how failures, cyber incidents, and compliance gaps can cascade through that ecosystem.
StartComply Automates Every Stage of This Process
Common SCRM Process Mistakes That Fail Audits
Most audit failures come from process gaps, not from lack of effort. These are the mistakes StartComply is designed to remove.
Treating it as a project, not a program
A one-time supplier assessment exercise followed by a report that no one updates is not supply chain risk management. NIS2 and DORA require a continuous, evidenced program.
Stopping at Tier-1 suppliers
Most organisations assess direct suppliers and assume that covers their supply chain risk. DORA explicitly requires understanding the sub-contracting chains of critical ICT providers.
Running the process from spreadsheets
Spreadsheets cannot distribute automated questionnaires, score responses, track corrective actions, run continuous monitoring, maintain an audit trail, or map activities to regulatory requirements.
No escalation path for high-risk findings
Without defined escalation rules, high-risk findings accumulate in a register unresolved. StartComply’s automated escalation workflows prevent this.
Treating assessment as the end
The assessment produces findings. Findings require actions. Actions need tracking. Tracking needs closure. The process is not complete until corrective actions are resolved or risks are formally accepted, with documentation.
The Risk Register: Your Central Audit Document
The risk register is the operational output of the SCRM process. It is also the document regulators examine in detail.
A well-maintained risk register records for each identified risk: the supplier and relationship identifier, the risk description and category, likelihood and impact scores with rationale, overall risk rating, the risk owner, all mitigation actions with deadlines and current status, residual risk after mitigations, and the formal risk decision, accepted, mitigated, transferred, or escalated.
StartComply maintains this automatically from assessment outputs. As corrective actions progress, as monitoring signals update risk scores, and as new assessments run, the risk register stays current without manual updates. Every change is logged with a timestamp and user record, producing the immutable audit trail that NIS2 and DORA evidence requirements demand.
Audit reality: the risk register is where the process becomes visible. Suppliers, findings, owners, deadlines, decisions, and evidence all need to be traceable.
Process Questions: Answered
What is the SCRM process?
The SCRM process is the structured lifecycle an organisation uses to identify, assess, prioritize, mitigate, and continuously monitor risks across its supply chain. It turns supplier risk management from a one-off assessment into a repeatable, evidenced program that supports NIS2 and DORA compliance.
How many stages does SCRM have?
SCRM has five core stages: identify, assess, prioritize, mitigate, and monitor. The stages work as a continuous cycle. As suppliers, threats, contracts, and regulatory obligations change, the process repeats and updates the risk register.
How often should SCRM run?
SCRM should run continuously, with formal reassessments scheduled according to supplier criticality. Critical suppliers may need quarterly or semi-annual assessments, standard suppliers may follow an annual cycle, and any material supplier change, incident, new access, or ownership change should trigger an unscheduled review.
Who owns the SCRM process?
The SCRM process is jointly owned by cybersecurity, compliance, procurement, risk, and senior management. The CISO typically owns supplier security controls, compliance owns regulatory evidence, procurement owns supplier relationships and contracts, and the board or senior management remains accountable for governance under NIS2 and DORA.
What is the output of the SCRM process?
The main output of the SCRM process is a live risk register supported by supplier inventory records, assessment results, risk scores, mitigation actions, ownership, deadlines, residual risk decisions, and audit evidence. This is the operational record regulators and auditors use to verify that the process is running.
How does DORA affect the SCRM process?
DORA requires financial entities to implement a formal ICT third-party risk management framework covering the full supply chain risk lifecycle: pre-contracting due diligence, ongoing assessment, continuous monitoring, contractual requirements, and exit strategy documentation. DORA also requires a complete register of all ICT arrangements, which maps directly to the identification and inventory stage of the SCRM process.
Run the SCRM Process Automatically, Not Manually.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
