Vendor Risk Scoring with AI: Three Behavioral Signals Worth Tracking

Why the obvious designs miss

The obvious first design combines payment history (days late, dispute rate) with sentiment analysis of public news. It feels rigorous. There are 18 months of payment data and a news feed scanning for supplier mentions, and every vendor gets a score from 0 to 100.

The problem is that the scores stay stable right up until a vendor causes trouble. A logistics supplier scored at 74 out of 100, medium-low risk, delivers late on five consecutive shipments. Look back at the signals and the payment history is fine. The news feed found nothing. The score never moved.

The second design adds financial health indicators from public filings and trade credit databases. Better. It still misses what the first one missed, and it adds false positives: vendors whose numbers look unusual because of growth or restructuring but who are operationally reliable.

The insight behind the third design: vendor problems show up in behavior before they show up in financials or news. By the time a supplier is in the news for financial trouble, the relationship is already at risk. The signal you want is earlier.

Signal 1: Response time variance on quote requests

When a supplier's sales team starts taking longer to respond to RFQs, something has changed. They may be short-staffed. They may be overwhelmed with other clients. They may be in financial difficulty and reducing their commercial team. They may have deprioritized your account.

The signal is the change in variance, not the absolute response time. A supplier who used to respond within 4 hours and now averages 18, with wide swings between quotes, has changed how it operates. That change tends to show up weeks before the first missed delivery.

A threshold to start from: flag a supplier if their rolling 30-day average RFQ response time has increased by more than 40% compared to their 12-month baseline, or if the standard deviation of their response times has doubled. Either condition triggers a yellow flag. Both conditions together trigger a review.

This requires storing response times on every RFQ sent and received. Most ERPs record the RFQ sent date and the quote received date. The data is there. It just isn't usually surfaced as a metric.

Signal 2: Invoice discrepancy rate

An invoice discrepancy (an amount that does not match the purchase order, a billing code mismatch, a missing line item) is usually treated as an administrative error and corrected. Most finance teams handle this dozens of times a month and track it only as workload, not as a vendor signal.

When a supplier's invoice discrepancy rate rises, it is a behavioral signal. A vendor with a 2% discrepancy rate who climbs to 8% over two months is experiencing something internal: turnover in their billing team, accounting software issues, or a business under pressure cutting corners. The cause may be as harmless as a switch of accounting systems. It may be a receivables crisis, with the supplier billing early or inflating quantities to pull cash forward.

The threshold: a discrepancy rate that rises more than 3 percentage points above baseline over a rolling 45-day window triggers a flag. Above 10% sustained for 30 days, regardless of baseline, triggers a review regardless.

Signal 3: Communication pattern changes

This is the hardest signal to extract systematically, and in our view the most telling. When the pattern of communication from a supplier changes (who is writing to you, how formal the language has become, how often things get escalated), something has changed in that organization.

Concretely: a supplier whose account manager changes for the third time in 12 months is a different risk profile than one with the same contact for three years. A supplier who used to confirm deliveries proactively and now requires you to chase for confirmation has changed their operational behavior. A supplier escalating payment queries to senior contacts rather than resolving them at the accounts level has a cash problem.

A lightweight NLP classifier over supplier email threads can flag three patterns: contact churn (new email addresses from the same domain at a rate above 1 new contact per quarter), escalation frequency (emails from addresses at director level or above when prior history was working-level), and resolution latency on disputes (how long from dispute raised to resolution confirmed).

The contact churn signal sounds minor. It is not. High staff turnover at a supplier means institutional knowledge is leaving, account management continuity is breaking down, and the organization is likely under pressure. Three new contacts at a single supplier in six months is worth a phone call.

How the scoring system works

Each of the three signals produces a component score. The composite risk score should not be a simple average. Weight each signal by how early it tends to fire and by how much the supplier matters to operations (a critical single-source supplier with one yellow flag gets more attention than a commodity supplier with two yellow flags and easy alternatives).

Run across a few hundred supplier relationships, a system like this should produce a short weekly list of flags for a person to review. Without it, supplier problems are discovered at the point of failure: a missed delivery, a quality issue, a sudden unavailability. The flags exist to move that discovery a few weeks earlier.

What this will not catch

Behavioral scoring misses sudden failures: a supplier who goes from green to catastrophic in a week because of an event that does not show up in behavioral signals. A fire at a warehouse. A sudden regulatory sanction. A principal who disappears.

For those cases, the system does not help much. The mitigation there is supplier diversity, safety stock and contract terms that protect you when a supplier fails suddenly. Better scoring will not help. The scoring system optimizes for the predictable failures. The unpredictable ones require a different kind of resilience.