Procurement Risks: Why Disruptions Are the New Normal

Ask any procurement professional about the biggest hurdle of the past few years, and their answer is rarely cost alone. More often than not, it’s procurement risk and the disruptions that follow. Supply chains are the breeding ground for these issues: the more dependent a company becomes on its suppliers, the more likely a disruption can result in the company’s failure to meet its commitments.

Before the pandemic and heightened geopolitical tension, disruptions were common but not as omnipresent. In 2018, 56.5% of companies experienced at least one such event. In 2024, that figure rose to 80% and remains just as relevant as we head into 2026.

The turbulent environment means procurement teams have to unwillingly participate in a juggling contest between cost, risk management, and efficiency. Trade-offs are imminent here. Companies will have to accept at least some level of risk but set limits on how far that risk can stretch without disrupting operations.

Below, we outline the procurement risks that defined 2025, the threats that carry into 2026, and the strategies teams can use to manage them, including a practical procurement risks matrix.

Scroll down to find out:

What are procurement risks?
What risks affected companies the most in 2025
Top 5 risks in procurement: 2026 outlook
How procurement risks evolved between 2025 and 2026
Risk management in procurement: How to build a strategy
Frequently asked questions about risk management in procurement
Key takeaways

What are procurement risks?

Procurement risks are uncertainties or vulnerabilities that can disrupt the company’s purchasing or supply chain. Unless the team takes care to identify the risk beforehand, it can lead to financial losses, supply shortages, and, in worst-case scenarios, legal penalties or unsafe working conditions. 

At its core, risk can be described as the likelihood that any procurement measure will fail to meet its goals within agreed-upon cost, timeline, and performance limits. Put simply, it’s a chance that something goes wrong and causes an unwanted outcome (e.g., higher costs, delays, or missed expectations).

Risks can originate both within and outside the organization and impact every stage of the purchasing process. Key procurement risk types include:

• Financial risks: Unexpected costs that undermine budgets and savings targets.
• Procurement process risks: Delays and errors caused by operational gaps.
• Legal or compliance risks: Issues that come up when purchases are made outside of company policy or regulatory requirements.
• Supplier and third-party risks: Dependence on external partners whose failure can disrupt supply or service.
• Procurement contract risks: Weakly defined agreements that lack controls and don’t outline the entire scope of procurement.
• Cybersecurity risks: Threats linked to digital tools and supplier access to systems or data.

What many teams overlook is that risks compound into a chain of unfortunate events. Issues with suppliers increase operational delays. Trade regulations cause financial stress for both you and the vendor. Compliance risk forces companies to change suppliers at the last minute. 

Even at its most stable, each company has to juggle several risks simultaneously as part of its risk management in procurement. The key is to identify where they connect, which matters (and impacts) your company the most, and what limits you can enforce to address them.

Why understanding procurement risk matters

Risk in procurement impacts nearly every sourcing decision and shapes the entire supplier selection process. Although companies consider multiple factors during sourcing, such as cost, location, and specifications, risk often outweighs them all. Given a choice between a lower-priced supplier in a high-risk region and a more expensive option in a stable location, procurement teams will likely gravitate towards the latter.

Poorly defined requirements create procurement contract risk management issues. When statements of work lack clarity, suppliers often protect themselves by charging higher prices, adding buffers, or imposing extra charges, which increase costs before anything is actually delivered.

Furthermore, key business decisions, including which digital solutions to use, are shaped by the level of risk involved. Risk is a key factor when evaluating alternative courses of action, and teams often go with the one that minimizes potential problems.

Risk is a critical aspect of business operations that must be properly managed to remain within a tolerable range. Risk management in procurement helps companies ensure the smooth and successful running of purchasing and supply operations. It also contributes to the overall resilience of a supply chain and to business continuity.

What risks affected companies the most in 2025

2025 proved to be a turning point for supply chain management. In response to tariffs, natural disasters, and cost volatility, companies have begun shifting their supplier networks. Reshoring gained momentum in 2025, with 15% more US CEOs than in 2024 expressing intention to move their manufacturing operations back to the United States. More than 60% pointed to cost control as the main driver, while nearly half cited rising geopolitical tensions.

The trend was clear: risks were here to stay, and waiting on the sidelines wouldn’t work. Companies adapted, changed strategies, and restructured their supply chains to deal with the aftermath. Below are the biggest risks in procurement that shaped the purchasing landscape of 2025.

Tariffs and trade changes

Without a doubt, the introduction of tariffs in April 2025 posed the biggest challenge to companies worldwide. More than four out of five companies (82%) saw their supply chains affected, often through higher material costs and reduced customer demand, especially in the US. 

The aftermath was brutal and pushed companies down one of several procurement risk management paths: pass on the additional costs to the customer (increase pricing), double their safety stock, or switch to nearshoring or dual sourcing. Reshoring to the US remains in high demand, even still. However, the manufacturing ecosystem isn’t yet ready to support it at full capacity.

Climate-led disruptions

2025 turned out to be one of the costliest years in terms of natural disasters. The Palisades fires in Southern California spread over 23,448 acres and destroyed multiple neighborhoods and infrastructure. Across Southeast Asia, cyclones and floods claimed more than 1,750 lives and caused over $25 billion in damage.

Floods in China cause indirect losses of CNY 90 billion annually from factory shutdowns, transportation disruptions, and delayed production, which often outweigh the cost of physical damage itself. As a whole, natural disasters resulted in US$224 billion in losses, 92% of which were attributed to climate change. 

The impact of these disruptions will be felt for years to come. Shipments are delayed, factories shut down or take time to rebuild, and materials are in short supply. A clear example of procurement risk already shows a tangible aftermath: LA companies may face shortages of drywall, roofing, and plumbing materials for the next 2-3 years as the construction of buildings after the Palisades fires begins.

Critical infrastructure failures

In 2025, several high-profile infrastructure outages showed how quickly a failure outside your supplier base can still interrupt your purchasing process. The AWS US-EAST-1 outage exposed all the risks and impact of e-procurement: it lasted over 15 hours and disrupted dependent platforms. Banks also reported issues with account access and card payments during the incident. In April, the Iberian Blackout across Portugal and Spain paralyzed supply chains for hours. 

Without backup plans or supplier risk management in procurement, the damage spreads beyond a brief pause in the system. A 10-hour outage disrupts the entire network. Manufacturing stops because factories can’t operate, shipments are delayed because there’s not enough product, and payments stall due to a system error. 

Commodities as leverage

On top of tariffs, the geopolitical landscape continued to cave in under the tension of the ongoing wars and sanctions. Commodities became not just supplies but also political tools used to strategically pressure other countries. 

For example, China introduced export controls on seven rare earth elements and magnets in response to tariffs. The fallout was instant. Automotive manufacturers in the US and Europe were forced to temporarily shut down their factories and reduce utilization. The prices for rare earth elements were six times higher than those in China.

China applied similar pressure in agriculture. When it paused exports of key fertilizers in late 2025, prices surged, and buyers had to scramble for alternatives, often incurring higher costs just to maintain production. The so-called “0.1% rule” raised the bar even further. Products made outside China require approval before export if they contain even a small share of Chinese rare earths.

Cybersecurity breaches

As technology gains traction, so does the risk of it. In 2025, companies across various sectors, from retail to manufacturing, were forced to reconsider their approach to procurement security risks. 

Between January and September 2025, businesses in the US suffered 4,701 ransomware attacks, with half targeting manufacturing, healthcare, and other critical sectors. Jaguar Land Rover, an automobile company, and United Natural Foods Inc., a major food distributor, suffered major cyberattacks during which production halted for nearly a month in both cases.

These incidents aren’t isolated. They occur worldwide and are likely to continue, so the only option for companies is to develop a mitigation plan for procurement risks and controls to enforce it.

Top 5 risks in procurement: 2026 outlook

The concept of procurement risk has evolved significantly over the years. Instead of a sudden spike that shook the markets but ended just as abruptly as it started, you’re facing long-term pressures that affect sourcing, supplier management, and procurement. Risks became structured, and because of that, some might argue, easier to predict. 

A new year doesn’t mean a clean slate. Many risks that plagued companies in 2025 will persist in the years to come, even stronger in some cases. Below are the top 5 risks in procurement that companies should prepare for in 2026.

1. Geopolitical uncertainty

According to the Institute of Internal Auditors, 45% of North American and 38% of global respondents rank geopolitical risk among their top concerns for 2026, up from 26% and 28% the year before. Having learned the lesson of the turbulent 2025, companies are concerned about just how quickly government-enforced regulations can shift the trajectory of their sourcing strategy.

Markets are no longer just shaped by their players—the state is getting more involved. What began as a temporary measure during the pandemic, when governments stepped in to support supply chains, turned into a strategic tool. Some countries intervene heavily with government ownership and subsidies, while others strategically target specific sectors, such as energy, defense, and technology.

Access to critical materials and resources will continue to be used as strategic leverage in 2026. The geopolitics of scarcity is the go-to strategy for many countries going forward. Governments actively enforce stricter export controls to protect their assets. Supply chains can no longer just be built around what’s available and where. Now, you need to consider which country has a grip on these resources and the likelihood of existing control tightening.

How to mitigate geopolitical uncertainty

Geopolitical change is now a constant and should be treated as such by both procurement and risk management. Tariffs, export controls, and sanctions may have seemed sudden in 2025, but they should be expected in the years to come.

• Assess the geopolitical exposure of your suppliers. Investigate who the parent company is and where the main manufacturing operations are located. Supplier risk management in procurement should start at the source: identify the origin of the raw materials you need.
• Plan for cost volatility. Build budget models that account for sudden increases in costs from tariffs or regulations. Ask, “What would happen if costs spiked by 10-20%?” and analyze which categories of spend would be affected first and to what extent.
• Diversify your supplier base. Instead of relying on suppliers from a single region, spread your network over several locations with different cost-risk ratios.
• Adopt flexible contracts. During negotiations, agree upfront on how pricing and delivery terms can adjust if tariffs, sanctions, or policies change. Addressing this early helps limit procurement contract risk and avoid last-minute renegotiations.

2. Supplier and sourcing instability

The financial strain on suppliers is higher than ever. Costs for materials and labor are rising, but contracts can’t keep up, as buyers often resist price increases. At least one-fifth of automotive suppliers are currently in financial distress, while the global insolvency rate is expected to grow by 3-4% in 2026.

Sourcing paralysis is another significant issue that’s likely to arise in 2026. Both buyers and vendors are reluctant to commit to a year-long contract. Short-term partnerships are now the most probable outcome of any negotiation, with lengthy relationships taking a backseat.  

Tariffs introduce a whole new set of risks that not every supplier is ready to tackle. Some vendors may shift their focus to markets where they can sell without tariffs, often to your company’s competitors. If you operate globally, switching suppliers can result in higher risks and costs at home and tougher competition abroad, as former vendors may support rival supply chains.

How to mitigate supplier instability

The main objective of procurement risk management here is to identify a potential insolvency early, before it can disrupt the company’s operations. Try these practices:

• React to warning signs. Besides a drop in performance KPIs, factors such as repeated delivery delays, sudden price change requests, or unusual payment terms might be signs of financial instability. Investigate them before performance drops further.
• Separate suppliers by criticality. Identify which vendors would halt production or impact customer demand if they were to fail. Focus your risk management efforts on those relationships.
• Regularly review supplier risk. High-risk or high-impact suppliers should be reviewed several times a year, so procurement can adjust volumes or sourcing strategies before issues escalate.
• Assess the financial situation before onboarding. Procurement contract risk management starts with financial due diligence. Before signing an agreement, determine where the supplier stands financially and whether they’ll be able to support your operations.

3. ESG and Scope 3 compliance

One would think that with a tense geopolitical situation and businesses struggling to stay afloat amidst tariffs, sustainability would be put on the back burner. These challenging circumstances, in fact, had the opposite effect: research by MIT found that 85% of companies are continuing their ESG practices or even doubling down on them. 

Regionally, sustainability is prioritized for different reasons. The EU is tightening the noose on its businesses with stricter CSRD regulations that require EU companies to disclose their environmental and societal impact. Organizations in the US, on the other hand, are pressured to pursue green sourcing and other sustainable practices by their investors, competitors, or their own leadership. 

Scope 3 emissions are also a big concern. Even though they account for 75% of total company-wide emissions, most businesses don’t have enough data from suppliers to accurately calculate them. Additionally, nearly a third continue to use spreadsheets to track Scope 3 data. Others are simply reluctant to track them since the ROI isn’t always clear.

How to mitigate ESG compliance risk

Poor sustainability practices are primarily caused by manual reporting and inaccurate data, which leaves procurement and risk management teams vulnerable when regulators, customers, or leadership request proof.

• Standardize what you ask suppliers to provide. Define a simple set of required data fields and evidence (methodology, reporting period, boundaries, verification) and request it regularly. Consistency keeps the data accurate and reduces back-and-forth every reporting cycle.
• Treat ESG as part of supplier risk management in procurement. Review ESG indicators alongside performance, continuity, and financial health KPIs. That way, sustainability isn’t treated as a separate workflow but is embedded in the purchasing process.
• Use tools that reduce manual tracking. Spreadsheets become virtually unusable as soon as your supplier network grows and you need to update data more frequently. A structured solution with workflows and reminders helps procurement collect, refresh, and store information without switching between tabs. For example, Precoro centralizes supplier and purchasing data in one system, so teams can find the information they need in a matter of seconds.

Anna Inbound Sales Representative at Precoro

We'll help ensure 100% compliance with your procurement policy across all departments and locations.

Book a Demo

4. Cyberattacks on supply chains

The number of cyber incidents in 2025 almost doubled compared to 2024, and the same trend is likely to continue. The widespread use of AI doesn’t help. Attackers began using AI-driven malware to disrupt critical infrastructure. The risk goes beyond lost data and extends to days of downtime or confidentiality breaches. 

There’s a silver lining, however. Digital sovereignty is now a top priority for governments. The US, the EU, and China are all moving to expand AI infrastructure and treat it as a strategic asset tied to national security, rather than a commercial market.

Logistics is the most targeted sector. Cyberattacks that numbered just 20 in 2021 surged by 965% by 2025. While companies can prevent cyberattacks on their own infrastructure, they have almost no control over the security of ports and transportation hubs that their supply chains pass through.

How to mitigate cyberattacks on supply chain

A single breach at a carrier or port can disrupt deliveries and force you to make expensive last-minute sourcing decisions, so it’s important to take action early.

• Act fast on the procurement side. Contact suppliers and ask what orders, shipments, or confirmations are affected. Ask them to switch to alternative transportation routes while systems are down, and check whether the current inventory can cover the gap.
• Treat system integrations as a risk. Confirm the incident directly with the affected partner, ideally by phone. Then pause or disconnect APIs or integrations between your systems, such as ERPs or logistics software.
• Build procurement security risks into planning. Don’t treat cyberattacks as an IT-only event. Conduct company-wide scenario planning based on risk levels and past disruption patterns.
• Reduce dependence on a single transportation hub over time. Create contingency routing plans that assume cyberattacks on major hubs will happen again. Redesign distribution networks and supplier concentration to prevent a single outage from disrupting the entire supply chain.

5. Physical supply chain disruptions

Disruptions to critical infrastructure are still largely overlooked by procurement and risk management. According to the two-year outlook in the World Economic Forum's Global Risks Report, they ranked only 22nd. Yet these disruptions are becoming more frequent. The beginning of 2026 already proved that, with a major Berlin blackout and continuous power outages in Ukraine. 

Most critical infrastructures, such as power grids, ports, and railways, were built decades ago. Old structures are deteriorating at a rapid rate and require large investments that companies (if it’s private infrastructure) or municipalities (if it’s public) simply can’t afford.

Extreme weather also exposes just how fragile infrastructure really is. Power grids, ports, railways, and water systems weren’t designed to handle today’s frequency of floods, heatwaves, and storms. Each event weakens them further and makes outages and shutdowns more likely the next time around.

How to mitigate physical supply chain disruptions

After a critical structure fails, procurement has little room to act beyond damage control. Preparation is your only advantage when it comes to infrastructure disruption.

• List your infrastructure dependencies. Identify which plants, warehouses, and critical suppliers rely on the same power grids, ports, rail corridors, or border crossings. By outlining these dependencies, you can clearly identify the weakest links in your supply chain and where a single outage could disrupt multiple categories.
• Prepare alternate routes and transport modes. Define backup routes and transport options before you need them. Know which ports, carriers, and hubs you’ll switch to if a lane goes down, and make sure they’re already approved.
• Plan for extreme weather. Assume floods, heatwaves, and storms will happen more often, and build buffers into lead times and inventory for vulnerable routes.

How procurement risks evolved between 2025 and 2026

New risks didn’t suddenly appear when the calendar flipped to 2026. What caught procurement teams off guard in 2025 is now something they’re expected to plan for.

Risk management in procurement: How to build a strategy

If your team only reacts to risks after the damage is done, sooner or later, you’ll encounter a situation your company won’t recover from quickly. A strategy for risk management in procurement should be embedded into the core of your operations and adapt as things change. First and foremost, it’s a tool that gives teams what they lack in times of uncertainty: prepared decisions.

Develop a complete procurement risk management strategy from scratch with the following steps.

1. Set the scope and key objectives

Start with the goals that procurement must protect: supply continuity, cost stability, compliance, service levels, and customer commitments. Set the scope as well, including categories, regions, suppliers, and logistics hubs, so the team knows what falls under the procurement risk management strategy and what doesn’t.

2. Identify risks

Examine the entire purchasing process and identify potential disruptions, both internal and external, including supplier failure, price volatility, logistics disruptions, policy violations, fraud, and regulatory changes. Seek input from involved stakeholders and other departments like accounts payable, IT, legal, and key suppliers. They might know more about specific issues that procurement isn’t familiar with.

3. Define risk appetite and risk tolerance

Procurement inherently relies on external markets and third-party partners, none of which it can fully control. Some level of uncertainty is simply part of the job. Rather than wondering how to eliminate risk entirely, companies need to assess their level of risk appetite and risk tolerance. 

Risk appetite refers to the type and amount of risk a company is willing to undertake to achieve its objectives. On the other hand, risk tolerance sets the acceptable range of deviation for a specific objective or risk category. To put it bluntly, it sets thresholds on the risk levels the company accepts. For example, it might allow sole-sourcing for low-value purchases like office supplies, but won’t accept it for critical materials.

To define both, analyze the risks you’ve identified in the previous step, and answer these questions:

• What issues are we willing and able to tolerate?
• Where do we draw the line on these risks before taking action?

For example, a company may accept short delivery delays for non-critical categories, but draw the line at any disruption that stops production or affects customer orders. 

4. Assess risks with a procurement risk matrix

To further analyze the risks your company might face, prioritize them with a procurement risk management matrix. This tool helps you identify which risks require immediate attention and which can be addressed later.

Typically, procurement professionals use a simple 3x3 or 5x5 grid that ranks risks by two criteria: likelihood (how likely the risk is to happen) and impact (how painful for the company it would be if it did). Score each risk from the lowest to the highest on each scale and then decide further action. 

Likelihood can be ranked as follows on a 5x5 grid:

• 1 – Rare. Unlikely to happen in the next 2–3 years. No known incidents internally or in your industry.
• 2 – Unlikely. Could happen, but not expected. Has occurred elsewhere in the industry, not in your supply chain.
• 3 – Possible. Has happened before or could reasonably happen within the next 12 to 24 months.
• 4 – Likely. Has happened recently or is already showing warning signs. Expected within the next year.
• 5 – Very likely. Already happening or expected to occur repeatedly unless action is taken.

Impact is typically defined this way on a procurement risks matrix:

• 1 – Insignificant. Minimal disruption. No customer impact, minor internal inconvenience.
• 2 – Minor. Short delays or small cost increases. Teams can handle the issue without escalation.
• 3 – Moderate. Noticeable cost impact, operational delays, or missed SLAs. Management attention required.
• 4 – Major. Production halt, customer delivery failures, regulatory exposure, or serious financial loss.
• 5 – Severe. Business-critical disruption. Revenue loss, reputational damage, legal action, or long-term customer loss.

5. Choose risk response strategies

After prioritizing the risks, determine how each should be managed. Not all issues require direct mitigation, but every one needs a clear plan of action and a defined owner, a person responsible for the task. 

Risk management in procurement typically follows a simple framework, known as the Four T’s (Terminate, Treat, Transfer, Tolerate) or Avoid, Reduce, Transfer, Accept approach:

• Terminate or Avoid. If the risk is too great, the best option is to disengage with it if possible. For instance, procurement may exit a market, offboard a supplier, or redesign a product to remove a high-risk material or dependency. This approach is sensible when the impact is severe, and other alternatives exist.
• Treat or Reduce. Most procurement risks fall into this category. Teams lower the likelihood or impact by adding additional controls such as dual sourcing, safety stock, or clearer contract terms. The risk doesn’t disappear, but its ability to disrupt operations drops.
• Transfer. Procurement can shift part of the risk management onto the supplier through contract clauses or service-level agreements. This approach is most effective for financial, legal, or delivery-related risks that can be clearly defined in a contract.
• Tolerate or Accept. If a risk falls within the agreed-upon tolerance limits, procurement may choose to accept it and monitor any warning signs that arise. The decision should be made only after thorough consideration, not while the disruption is still ongoing.

6. Monitor, review, and update on a set cadence

Risk management in procurement doesn’t end after initial risk identification. Review high-impact risks several times a year and update after major events. Track whether controls are actually working, document outcomes, and report changes, so leadership can adjust thresholds and priorities before the next disruption occurs.

Frequently asked questions about risk management in procurement

Key takeaways

Procurement risk no longer comes from isolated events; it’s essentially the environment in which companies operate. Tariffs can reshape sourcing overnight, climate change can cut off supply for months, and governments can enforce controls over raw materials. These pressures now stack on top of each other, so waiting for things to settle isn’t a lasting strategy anymore.

Resilient teams build structure to strengthen their risk management in procurement. Clear risk appetite and tolerance set boundaries for decision-making. A simple risk matrix helps teams focus on what actually matters. Ongoing supplier, logistics, and data visibility make it easier to spot pressure early and act before issues escalate. 

Most importantly, risk management is most effective when it’s built into everyday procurement processes. The harsh reality is that frequent disruptions and increasing risks are the new normal for supply chains, so they must be treated as such.

See how Precoro embeds risk control into everyday procurement.