Abstract: Determining risk associated with a product may comprise identifying a product to be supplied to an entity. A product category associated with the product that is one of a plurality of predetermined product categories is determined. A plurality of risk element associated with the product according to the product category is retrieved from a category standards database. A risk level associated with the product category for each of the plurality of risk elements is determined. An inherent risk associated with the product is calculated according to the risk level determined for each of the plurality of risk elements from the category standards database and independent of any vendor selected to supply product.

Abstract: Managing a vendor may comprise identifying a product to be supplied to an entity. Risk elements associated with the product may be determined by performing a product category-driven risk assessment. A transaction level risk assessment is performed for one or more vendors proposed to supply the product to the entity. At least one management action is determined for reducing risk for a risk element of the plurality of risk elements associated with supplying the product to the entity by a selected vendor from a group comprising the one or more vendors proposed to the supply the product to the entity, wherein the at least one management action is determined according to results of the product category-driven risk assessment and the transaction level risk assessment for the selected entity. A vendor level quality plan for the selected vendor is created that comprises the at least one management action.

Abstract: Establishing a vendor profile may comprise identifying a plurality of risk elements associated with a vendor that supplies one or more products to an entity. Any completed management actions for the vendor that mitigate risk associated with any of the identified risk elements are identified. A performance requirement for the vendor associated with at least one of the products supplied by the vendor to the entity is identified. A performance measurement for the identified performance requirement for the vendor is identified. A residual risk for at least one of the identified risk elements is determined according to a completed management action that reduces risk associated with the at least one of the identified risk elements. A performance level is determined according to the performance requirement and the performance measurement. A vendor profile is created according to the identified risk elements, completed management actions, identified performance requirements, and performance measurement.