Not every supplier starts with the same risk profile.
A software consultancy in Sweden. A chemicals manufacturer in India. A logistics provider in Mexico. A mining company in South Africa.
Even before you assess the individual company, the industry it operates in and the countries connected to its operations can tell you a lot about where you should be looking more closely.
The problem?
Doing that research manually across hundreds or thousands of suppliers gets old very quickly.
Procurement teams end up jumping between reports, websites, spreadsheets, ESG databases, and internal assessments just to understand what risks might be relevant. And we hear exactly that from companies evaluating Kodiak Hub: supplier risk assessments are often still pieced together manually using factors such as country risk and industry risk before being passed to compliance teams for further due diligence.
That is why we built Industry Risk.
Industry Risk gives procurement, ESG, and supplier management teams an evidence-based view of the sector-level risks surrounding a supplier, directly inside Kodiak Hub.
No separate research project required.
An industry risk assessment looks at the risks commonly associated with the sector a company operates in rather than only assessing the individual company itself.
Think of it as context.
A supplier may have a strong financial position, complete every questionnaire, and provide all required certificates. But if it operates in an industry with elevated exposure to forced labor, environmental damage, regulatory scrutiny, or geopolitical disruption, you probably want to know that too.
This is particularly relevant for risk-based due diligence.
The OECD recommends that companies identify and assess actual or potential adverse impacts across their operations, supply chains, and business relationships. It also recognizes that the type and severity of those risks differ depending on the operating context and sector.
Recent OECD research makes that difference even clearer. Different industries show very different exposure to environmental and social impacts, with sectors such as agriculture, extractives, and manufacturing associated with a broader range of potential human rights, labor, and environmental impacts than many other sectors.
In other words:
Where a supplier operates matters. What they do matters too.
A good supplier risk assessment should consider both.
Industry risk itself is not difficult to understand.
Doing it consistently across an entire supplier base is.
Someone has to:
Multiply that by 500, 2,000, or 5,000 suppliers and "let's research it" stops being much of a strategy.
That creates another problem: inconsistency.
One category manager may investigate labor practices. Another focuses on environmental exposure. Someone else searches for regulatory issues. A fourth person may simply reuse the assessment from last year.
The result is supplier risk intelligence that is difficult to compare and even harder to operationalize.
And this is not just a tooling problem. It is a prioritization problem.
Risk teams do not need more alerts, reports, and red badges. They need a faster way to understand where deeper due diligence is actually warranted.
Industry Risk brings that sector-level context directly into the supplier scorecard.
Users can search using a NACE code or product description, select the relevant country, and generate an AI-powered Industry Risk report for the supplier.
NACE is the EU's official statistical classification of economic activities. The latest classification, NACE Rev. 2.1, has been used for European statistics from 2025 onward.
Kodiak Hub then uses recent, validated OECD reference materials to generate an evidence-based risk profile across five areas:
Each area receives a clear risk classification, helping teams quickly understand which topics deserve attention.
But the important part is not another score.
It is what you can do with it.
A red rating without context is not particularly useful.
Industry Risk therefore goes beyond simply telling you that an industry presents elevated risk.
The report explains the underlying risk factors, provides source documentation, and suggests mitigation measures that procurement or ESG teams can investigate further.
The highest-risk category is also highlighted with a suggested remediation approach.
So instead of:
"Supplier X: High Risk."
You get closer to:
"This supplier operates in a sector and geography with elevated labor risk. Here is what is driving that assessment, the evidence behind it, and the areas you should investigate next."
That is a much better starting point for a conversation.
Industry Risk is designed to become another layer of intelligence within the supplier lifecycle, rather than another standalone risk tool to check occasionally.
Before approving a new supplier, procurement can understand which industry-specific risks deserve additional scrutiny.
A higher Human Rights & Labour risk could trigger additional questions.
A higher Environmental risk could require specific policies, certifications, or evidence.
A higher Regulatory & Compliance risk could warrant additional internal review.
Instead of sending every supplier the same 200-question questionnaire, teams can make due diligence more risk-based.
Spend is not the only thing that should determine how closely a supplier is managed.
Industry Risk can provide another signal when deciding which suppliers require deeper governance, more frequent assessments, or additional monitoring.
A relatively small supplier could still warrant significant attention if its activities create outsized regulatory, environmental, or human rights exposure.
Risk should not sit in a separate system that nobody opens before the QBR.
Because Industry Risk lives inside Kodiak Hub, Category Managers and Supplier Relationship Managers can consider industry context alongside supplier performance, quality, compliance, financial data, and other supplier information.
That creates a much more complete conversation.
You are no longer asking only:
"How is this supplier performing?"
You can also ask:
"What is changing around this supplier that we need to manage?"
Not every supplier deserves the same level of investigation.
And that is the point.
Industry Risk helps teams identify where deeper research and due diligence are likely to create the most value.
That is particularly important as due diligence expectations continue to expand globally. An OECD mapping published in 2026 identified 21 legislative measures relating to human rights, labor, and environmental due diligence across 11 jurisdictions.
Procurement cannot respond to that complexity simply by throwing more people at spreadsheets.
It needs a scalable way to prioritize.
This distinction matters.
A high-risk industry does not automatically mean you have a bad supplier.
And a low-risk industry does not automatically mean you have a good one.
Industry Risk should tell you where to look, not make the supplier decision for you.
Imagine two suppliers operating in the same higher-risk sector.
One may have mature controls, excellent working practices, strong certifications, transparent reporting, and a proven history of corrective action.
The other may not.
Their underlying industry exposure could be similar. Their actual supplier risk may be very different.
That is why industry risk becomes much more useful when connected with the rest of the supplier record: assessments, documentation, audits, performance, quality, financial health, compliance, and improvement actions.
Industry Risk adds context to the decision.
It does not replace the decision.
AI can make supplier research dramatically faster.
But "the AI said so" is not good enough for supplier due diligence.
Especially when procurement needs to explain a decision to Compliance, Sustainability, Quality, senior management, an auditor, or potentially the supplier itself.
That is why every Industry Risk report includes the sources behind its findings.
Kodiak Hub uses validated OECD reference materials from the previous five years and provides linked references so users can investigate the underlying evidence themselves.
This gives teams the speed of AI without turning the assessment into a black box.
Reports are also refreshed against the reference base twice annually, in July and December, and users can provide thumbs-up or thumbs-down feedback with comments directly in the platform.
AI should help people reach better decisions faster.
It should not ask them to stop asking questions.
Of course, procurement teams do not spend their days memorizing NACE classifications.
That would be a fairly niche party trick.
So Industry Risk also allows users to search using a product or activity description.
This is particularly helpful when suppliers operate across multiple activities or locations.
A supplier does not have to be permanently tied to one industry-country combination. Teams can investigate the context that is actually relevant to the products, services, operations, or sourcing scenario they are evaluating.
That makes the assessment more useful for real-world supplier management, where multinational companies rarely fit neatly into one box.
There are already several ways to investigate ESG and supplier risk.
The problem is usually how they fit into the procurement workflow.
Manual research can provide significant depth, but doing it supplier by supplier takes time and creates consistency problems.
External ratings can be valuable too, but procurement teams may still need additional context for suppliers, industries, locations, or activities that do not fit neatly into a predefined rating.
Industry Risk takes a different approach.
It generates the assessment when you need it, using the industry and geographic context relevant to the supplier, and puts the resulting intelligence directly where your team already manages that supplier.
That means less:
Research -> spreadsheet -> presentation -> email -> supplier system
And more:
Risk -> evidence -> decision -> action
All inside the same supplier workflow.
Supplier industry risk is the potential exposure associated with the sector or economic activity in which a supplier operates. It can include human rights, labor, environmental, regulatory, compliance, and geopolitical risks that may be more prevalent in certain industries or locations.
Users search by NACE code or product description and country. Kodiak Hub generates an AI-powered risk profile using recent validated OECD reference materials and categorizes risk across Overall Risk, Human Rights & Labour, Environmental, Regulatory & Compliance, and Geopolitical dimensions.
Not necessarily. Industry Risk provides contextual risk intelligence about the supplier's sector and operating environment. It should be considered alongside supplier-specific information such as assessments, compliance documentation, financial health, performance, quality, audits, and other risk data.
NACE is the European Union's classification system for economic activities. It provides a standardized way of categorizing industries and business activities. NACE Rev. 2.1 has been used for European statistics from 2025 onward.
Yes. Industry Risk can help teams identify areas requiring additional due diligence during onboarding and qualification. For example, elevated environmental or human rights risk can inform which additional questions, documentation, or internal reviews should be required.
Industry Risk uses validated OECD reference materials from the previous five years. Reports provide linked source references so users can review the evidence behind the AI-generated assessment.
Yes. Users can search different NACE codes, product descriptions, and country contexts rather than permanently restricting a supplier to one industry-country combination.
Reach out to our team and they'll walk you through the feature! Or read more about Kodiak Hub's supply chain risk & resilience monitoring.