We then undertake a second risk-based assessment of all suppliers, which considers factors such as: spend, previous incidents and performance, geographical criteria, self-assessment score, and public reporting practices.