Country risk in procurement: a framework for supplier geography decisions

Country risk is the procurement blind spot that keeps getting more expensive. In 2025 and into 2026, tariffs on Chinese semiconductors and machinery rose above 60% under the Trade Act of 1974, sanctions on Russian titanium and nickel disrupted aerospace and metals supply chains, and the risk of Strait of Hormuz closures drove marine insurance premiums on Gulf cargoes up 400% in a single quarter. Yet most procurement organizations still evaluate supplier geography on two variables: landed cost and quality score. The country itself — its political trajectory, regulatory volatility, currency regime, and logistics fragility — rarely appears in the sourcing scorecard.

That gap is no longer tolerable. A proper country risk framework changes which suppliers even make it to the RFP stage. This article lays out a 6-dimension model procurement teams can deploy today.

---

Why country risk is not the same as supplier risk

Supplier risk management has matured significantly in the last five years. Financial health monitoring, cybersecurity questionnaires, and ESG scorecards are standard practice. But these tools evaluate the supplier entity, not the environment it operates in. A financially healthy supplier in a country experiencing a currency crisis, sanctions escalation, or port strike is still a disrupted supplier. The distinction matters because mitigation paths diverge: supplier-level risk can be addressed through contract terms and performance management, while country-level risk requires geographic diversification, regulatory hedging, and geopolitical monitoring that no single supplier can resolve.

The MIT Sloan Management Review observed that "the conventional playbook for managing supply chain risk — designed for natural disasters, supplier failures, and short-term market volatility — is falling short in the face of persistent, politically motivated disruptions such as trade wars, sanctions, and armed conflict." The conventional playbook evaluates risk per supplier. Country risk demands evaluation per geography.

---

The 6 dimensions every sourcing scorecard should include

Drawing on frameworks from BCG, SupplyOn, and WTW, a procurement-specific country risk index should evaluate six dimensions. Each carries different weight depending on the category: technology components are more sensitive to export controls, raw materials to resource nationalism, and finished goods to logistics infrastructure.

BCG's framework, published in 2024, aggregates these into four buckets: trade and business climate metrics, national security and foreign relations assessments, internal political stability and societal health indicators, and specific regulatory and export-control issues. The weighting is category-specific. A semiconductor buyer should weigh export controls at 30% of the total score. A metals buyer should weight resource nationalism and sanctions at 35%.

---

What the diversification data actually shows

The instinct when country risk rises is to ask "should we leave Country X?" The data suggests a different answer. A study of Japanese multinational corporations from 2009 to 2022, published by CEPR, shows that firms respond to rising geopolitical risk not by full decoupling or reshoring but by incremental diversification — particularly into ASEAN economies. Sunk investments in existing facilities, established supplier networks, and skilled labor pools make complete relocation economically unattractive. What works is adding capacity elsewhere, not moving it all.

WTW's 2026 guidance confirms the pattern: "Many organizations have already expanded into other regions such as Vietnam, Malaysia, Mexico, Central America, India, Bangladesh and Eastern Europe, which offer competitive manufacturing capabilities, growing infrastructure and favorable trade agreements." The strategy is multi-regional, not binary. Organizations adopting "local-for-local" models and proximity sourcing — near-shoring or friend-shoring — enhance operational flexibility without the cost of full geographic restructuring.

---

Sanctions compliance as a geography gate

The most underappreciated dimension in supplier geography decisions is sanctions and export-control compliance. Mondaq notes that "particular focus is required for creating adequate visibility to the lawfulness of third parties and their banks (sanctions risk), as well as end uses and ultimate end users (export controls risk), or upstream suppliers and the absence of forced labor for the inbound supply chain." This is not a once-at-onboarding check. A supplier can become sanctioned mid-contract. A raw material can become restricted by a new import ban. A banking channel can close overnight.

Procurement teams should treat sanctions exposure as a binary gate in the country score, not a weighted dimension. Countries on active sanctions programs or subject to forced-labor import bans should be excluded from sourcing events for affected categories unless a specific compliance regime — validated by legal counsel — is in place. The Rule Ltd framework recommends quarterly supplier location reviews and immediate reassessment after any sanctions change, new conflict, or regulatory shift.

---

Building the risk threshold system

A country risk score is only useful if it triggers action. The framework needs three tiers:

• Green (score 0-30): Standard sourcing. No additional due diligence beyond normal supplier onboarding. Includes countries with stable regulation, strong contract enforcement, and minimal sanctions exposure — e.g., Germany, Singapore, Canada.
• Amber (score 31-60): Enhanced due diligence required. Mandatory dual-sourcing or inventory buffer for critical categories. Currency hedging clauses in contracts. Includes countries with moderate political volatility or FX risk — e.g., India, Brazil, Thailand.
• Red (score 61-100): Restricted. Exceptions require sign-off from the geopolitical risk committee (procurement, legal, compliance, finance). Mandatory alternative geography plan for any new sourcing event. Includes countries under active sanctions regimes or with severe political instability.

These thresholds should be reviewed quarterly by the cross-functional committee. SupplyOn's Risk Compass and similar tools continuously evaluate 30+ geopolitical, economic, and regulatory indicators mapped directly to supplier data. The goal is a living risk score, not an annual spreadsheet update.

---

What this means in practice

• Build the index by category, not by country. A country score for electronics components is different from the same country's score for agricultural commodities. Weight the six dimensions according to what breaks first in each category. Electronic components: export controls at 30%. Raw materials: resource nationalism and sanctions at 35%. Finished goods: logistics infrastructure at 25%.
• Map your exposure in one week. Pull your top 100 suppliers by spend. Assign each a country. Cross-reference against corporate sanctions policy. Identify any single-country concentration above 30% in a critical category. This is the minimum viable assessment. It typically reveals 2-3 high-priority diversification targets within a week of focused work.
• Write geography clauses into new contracts. Include change-in-law, sanctions, and export-control clauses with rights to relocate production if legal or geopolitical conditions change. Mondaq and WTW both emphasize that contract protection for country-level disruption is underused and should be treated as standard in any cross-border procurement agreement.
• Stress-test the top five risk scenarios. Simulate: sanctions on your top supplier country, closure of a major shipping strait, a 25% tariff increase on your primary sourcing region, a currency devaluation exceeding 20%, and a port strike lasting 60 days. For each scenario, pre-define the trigger threshold (e.g., "if tariffs exceed 25%, activate alternative geography within 90 days") and the specific mitigation action.
• Assign governance ownership. Create a geopolitical risk committee that meets quarterly. Membership: procurement, legal, compliance, finance, supply chain. The committee owns the country risk model, approves red-zone exceptions, and reviews the exposure map after any major geopolitical event. Without this governance structure, the framework is a spreadsheet, not a decision tool.

---

Frequently asked questions

---