What is a geographic risk score in supplier risk management?

What the score measures

A geographic risk score is a number, or sometimes a simple banding like low, medium, or high, attached to a supplier site that captures how exposed that location is to a disruption tied to its physical place. Most procurement teams already run supplier risk scores for financial health, compliance history, and on-time delivery. The geographic layer asks a different question: what happens if a flood, an earthquake, a port closure, or a regional grid outage hits that exact coordinate. It has nothing to do with whether the supplier itself is reliable.

In practice, a geographic risk score usually blends a handful of inputs: natural hazard exposure at the site's coordinates (flood plain, seismic zone, wildfire history), infrastructure dependency (distance to the nearest port, rail corridor, or substation), and sometimes regional political or regulatory stability. Vendors selling these scores pull from public hazard datasets and commercial risk feeds, then hand you one figure per supplier.

One score per supplier isn't one score per category

A lot of risk teams get tripped up on this point. A geographic risk score tells you how exposed Supplier A's facility is on its own. It says nothing about the fact that Supplier A, Supplier B, and Supplier C all sit in the same industrial park outside the same mid-sized city, three kilometers from the same river. Each supplier might carry a moderate individual score. Stack them on a map and a single flood event could take out well over half a category's capacity in one afternoon.

That's the gap between a supplier geographic risk rating and a concentration risk score. The rating is about one vendor. The concentration score is about your whole supplier base in a category, plotted as clusters. Most risk management tools give you the first and assume you'll build the second yourself, usually by exporting the vendor list and cross-referencing addresses against a map by hand.

That manual step is where single points of failure hide. A spreadsheet sorted by country can look nicely diversified. The same list plotted as pins on satellite imagery can show every one of those "diversified" suppliers sitting inside the same business park or pulling from the same port catchment.

How a concentration risk score gets built

A concentration risk score works from the geography up instead of the supplier down. Rather than scoring each vendor's site in isolation, it takes category spend, maps it to the physical locations behind it, and looks for clustering: how much spend sits within a given radius, inside the same flood plain, or dependent on the same stretch of port or rail infrastructure. The output is a ranked list of clusters, each one showing what share of category spend would be exposed if that patch of ground had a bad week.

That's a structurally different question from "is this supplier financially sound" or "does this supplier's region carry earthquake risk." It's "how much of this category would I lose at once, and where exactly." Sourcing Concentration runs that read once a year against your category spend, producing a concentration map and a ranked cluster list instead of leaving someone to eyeball a vendor list against a map.

What to ask for before you buy one

If a platform hands you a "geographic risk score" and nothing else, find out what unit it scores. Per-supplier scores earn their keep in onboarding and due diligence, but they answer almost nothing about category-level concentration unless someone also aggregates the underlying coordinates and checks for overlap. Ask the vendor directly whether the output is a number per supplier, or a map of where spend actually piles up on the ground.

For a category manager trying to find the industrial park nobody had noticed everyone sources from, the second answer is the one that matters.