Written by Marijn Overvest | Reviewed by Sjoerd Goedhart | Fact Checked by Ruud Emonds | Our editorial policy
Claude for Supplier Risk: Build Your BCP in 20 Minutes
As taught in the Claude Cowork For Procurement Course / ★★★★★ 4.9 rating
Table of contents
- Why Most Procurement Teams Don’t Have a Real Supplier BCP
- What a Real Supplier BCP Contains
- The Inputs Claude Needs to Build a Real BCP
- The Clarifying Questions Claude Asks Before It Starts
- What the Finished BCP Actually Looks Like
- The BCP is the Start, Not the End
- Where the BCP Fits in Procurement’s Broader AI Adoption
- Conclusion
- Frequently asked questions
- Most procurement teams know they should have a Business Continuity Plan for their top suppliers. Procurement Tactics’ 2026 survey suggests that only about 9% of procurement teams operate in a genuinely proactive, data-driven way, the rest are reactive or mostly reactive.
- The gap is usually not capability. It is capacity. A real BCP takes weeks of workshops, scoring sessions, and sign-off rounds. Most procurement teams do not have the weeks.
- Claude compresses the first full pass of a Business Continuity Plan from weeks to under thirty minutes, top five supplier risks, scored on likelihood and impact, with named mitigations, named contingency actions, and named owners.
Why Most Procurement Teams Don’t Have a Real Supplier BCP
In conversations with procurement leaders over the past year, the Business Continuity Plan comes up in one of two ways. Either the procurement leader says, “We have a BCP”, and then clarifies, under questioning, that it is an outdated document nobody has revisited in two years, or they say, “We should have one, and we don’t”.
The honest reason is almost always capacity. A real BCP is substantial work. It requires workshops with category leads to identify risks, scoring sessions to calibrate likelihood and impact, supplier research to ground the probability estimates, mitigation planning with operations, and sign-off rounds with finance and risk. Across a portfolio of even twenty strategic suppliers, that is weeks of dedicated effort from a procurement team that does not have weeks of dedicated effort available.
The 2026 AI Readiness in Procurement survey found 55% of procurement teams describe themselves as reactive or mostly reactive. Only 9% describe themselves as data-driven and proactive. The gap between those two groups is not a skills gap; most procurement leaders know what a proactive operating model looks like. It is a capacity gap. The teams that are reactive do not have the hours to do the strategic work, and the strategic work that consistently gets displaced is the kind that prevents rather than responds. Business continuity planning sits squarely in that “prevents rather than responds” bucket.
AI changes the maths. A BCP that would take a procurement team three weeks of effort is achievable with Claude in under half an hour for the first full draft, and then a couple of hours of review and refinement. That moves the BCP from aspirational to routine, something done quarterly on the top twenty suppliers rather than biannually on the top five.
What a Real Supplier BCP Contains
A BCP that is useful in a crisis has four characteristics. It is calibrated to the company’s actual scale. It names specific actions rather than intentions. It assigns named ownership. And it is reviewed often enough that it reflects current reality.
The template that consistently produces usable BCPs has four tabs.
Tab 1, Definitions
The definitions tab is where the BCP gets calibrated to the company. Likelihood scores one through five have to mean something specific, a five might be “more likely than not in the next twelve months”, a three “plausible in the next three years”. Impact scores one through five need financial and operational definitions that match the company’s scale. A level-three impact at a €180 million spend company should not mean the same thing as a level-three impact at a €20 million spend company.
This tab is the step procurement teams skip when they use generic BCP templates from the internet. The result is a risk register where a “high” risk could mean anything from a minor annoyance to an existential threat, because the scoring has not been grounded in the company’s own definitions. The BCP that comes out of a calibrated definitions tab is different in kind, not just degree.
Tab 2, Roles and Responsibilities
Every risk needs a named role, not a team, a role. When a risk materialises, a named role determines response time. A risk owned by “procurement” gets no response until somebody inside procurement notices. A risk owned by “the Packaging Category Manager” gets a response because there is exactly one person whose name is on it.
The tab lists the roles involved in risk management for the organisation, Category Managers, Head of Procurement, CPO, Legal, Finance, Operations, with a one-line statement of what each role owns in a BCP response. This is not a RACI chart. It is the response structure.
Tabs 3 and 4, The BCP itself
Tab three is typically a filled example, a worked version of the BCP for context and reference. Tab four is where the real plan lives. For each of the top N suppliers, the plan contains: a brief risk description, likelihood score, impact score, overall risk score, three mitigation strategies (actions taken before the risk materialises), three contingency actions (what is executed the moment the risk becomes real), an assigned owner, and a review frequency.
The discipline is that every risk produces a plan in exactly this format. Consistency across rows is what makes the BCP usable in a crisis. When something goes wrong, nobody wants to be building the plan. They want to be executing one.
The Inputs Claude Needs to Build a Real BCP
Four files produce a usable first draft.
The blank BCP template (ideally the four-tab version described above). The structured template is what makes Claude produce a BCP rather than an essay on risk management. Without the template, the output is prose; with it, the output is a plan.
The company briefing. Company profile, spend baseline, supplier portfolio structure, operating context, and regulatory environment. This is what tells Claude what the organisation actually is, and therefore what a level-three risk means for it. Without this, the scoring defaults to generic ranges that are not useful for the specific procurement team.
The active supplier list with spend. At a minimum, the top thirty suppliers by spend, with category, contract status, tier classification, and any existing watch-list flags. Claude uses this to select which suppliers belong in the top-five focus of the BCP and to understand concentration risk.
The spend overview. A rollup of category spend, supplier concentration, and recent spend dynamics. The spend overview is what grounds Claude’s impact scoring in real numbers. A supplier responsible for 62% of a critical category is not the same risk as a supplier at 3%, and the scoring should reflect that.
Procurement teams without one or more of these inputs can still produce a BCP, but the output gets proportionally more generic. The team that invests twenty minutes preparing the inputs gets a significantly better output than the team that skips that step.
From the field
Enterprise procurement director evaluating AI contract and risk analysis tools
The Clarifying Questions Claude Asks Before It Starts
A well-designed BCP prompt instructs Claude to ask clarifying questions before building the plan. Four typically come back, and the answers shape the output materially.
What does the supplier tier structure look like? Some organisations operate a strategic/preferred / approved / other tier structure. Others use a Kraljic-derived model. Others have no formal tiering. Claude needs the answer to understand which suppliers carry the most risk and therefore deserve the deepest BCP treatment.
How should risk scoring be weighted between likelihood and impact? Some procurement organisations weigh impact more heavily, the logic being that a high-impact risk deserves attention even at a lower probability. Others multiply the two scores evenly. The answer changes, which risks bubble to the top of the BCP.
Are there suppliers already on a watch list? A supplier flagged for financial distress, geopolitical exposure, or quality issues belongs on the BCP regardless of where standard scoring would place them. The watch list is a signal Claude should not have to infer.
What is the time horizon for probability scoring? A likelihood of three for “next six months” is a much more severe risk than the same score for “next five years”. Procurement teams typically use twelve to eighteen months for BCP planning; the answer should be explicit.
Five minutes on these four questions disproportionately improves the output. Teams that skip the clarifying exchange and paste a generic BCP prompt end up with generic risk registers. Teams that engage with the questions get a BCP specific to their organisation.
What the Finished BCP Actually Looks Like
A worked example grounds the abstract. Consider an anonymised procurement organisation managing roughly €180 million of annual spend, with the packaging category sitting at €8 million and the primary packaging supplier, call it Supplier A, accounting for 62% of packaging spend as a single source. On-time delivery performance is running at 84% against a 95% target. The supplier has been qualified on the approved list for eight years; no alternatives are currently active.
Claude’s BCP places Supplier A as the top risk in the category. The risk description: single-source dependency on a strategic packaging supplier with deteriorating on-time delivery performance and no qualified alternative. The likelihood score: three, reflecting a plausible disruption within the next twelve months, given the OTD trend. The impact score: five, reflecting the supply-chain exposure and the cost of qualifying an alternative under pressure. Overall risk score: fifteen, making this the highest-priority risk in the packaging BCP.
The mitigation strategies: qualify a secondary supplier within ninety days; increase safety stock of critical SKUs to six weeks of cover; initiate a quarterly financial health review of Supplier A and escalate any deterioration. The contingency actions: activate the pre-qualified secondary supplier immediately; notify operations and sales of the supply disruption; escalate to the CPO if the disruption exceeds forty-eight hours; initiate a cross-functional war-room if the disruption exceeds seven days. Owner: the Packaging Category Manager. Review frequency: monthly.
That level of specificity is what separates a usable BCP from a generic risk list. Every risk in the BCP gets this treatment. The procurement team’s job is to review, refine, and own the output, correcting scoring where Claude’s impact estimate is too high or too low, adjusting mitigation strategies based on internal knowledge Claude does not have, and confirming ownership with the named role. Twenty minutes of review against a plan produced in ten minutes is the shift that makes the weekly or monthly BCP cadence realistic.
The BCP is the Start, Not the End
A BCP is useful only if it is maintained. The BCPs that actually work in a crisis have two properties that most procurement BCPs lack.
First, they are reviewed on a schedule that matches the risk. Top-tier strategic suppliers get monthly reviews. Tier-two gets quarterly. Tier-three gets semi-annual. The review updates performance data, adjusts scoring where circumstances have changed, and revalidates the mitigation and contingency actions. AI-assisted BCPs make this cadence realistic, the update takes an hour, not a day, and therefore the BCP actually reflects current reality rather than a point-in-time snapshot from the last strategic planning cycle.
Second, they are connected to the teams that execute them. A BCP that lives in a SharePoint folder nobody visits is a document, not a plan. A BCP that is reviewed in a monthly category meeting, updated after each supplier QBR, and escalated during cross-functional risk reviews is operational. The difference is not the document; it is the operating rhythm that surrounds it.
For procurement teams building this capability across the function, the rhythm matters more than the template. The AI Fundamentals for Procurement Teams program covers the prompt engineering and template design that make the BCP producible; the structured training also covers the operational rhythm that turns a first BCP into a living supplier risk management capability.
Where the BCP fits in procurement’s broader AI adoption
In my experience, contract review and supplier BCP are the two workflows where AI earns its place in procurement fastest. The commercial findings in a contract review pay for the AI investment directly; the supplier BCP, closes a governance gap that most procurement teams know they have and have not had the capacity to fix. After those two, spend analysis, negotiation preparation, and category strategy follow in roughly that order.
Procurement teams that start their AI adoption with these two workflows, a first contract review of a top-three supplier, a first BCP of the top five, tend to get internal support for the next wave faster than teams that start with lower-visibility use cases. The first contract review surfaces a commercial finding; the first BCP surfaces a governance closure. Both make the procurement team look good to the CPO and the CFO. Visibility feeds funding, and funding determines how quickly AI adoption scales.
Related resource: Scheduled Tasks in Claude Cowork, The procurement automation playbook for Scheduled Tasks, eight specific tasks to automate, how to write effective scheduled prompts, and the best practices for managing recurring workflows while you sleep.
Conclusion
Most procurement teams do not ignore supplier risk because they do not care about it. They ignore it because the day-to-day operational workload leaves very little room for proactive planning. Business Continuity Plans often become documents that are either outdated, incomplete, or never fully developed in the first place.
Claude changes that dynamic by making supplier risk management more practical and repeatable. What once required weeks of workshops, scoring exercises, and coordination can now begin with a structured first draft built in under thirty minutes. That does not remove the need for procurement judgement, cross-functional alignment, or ongoing supplier management. But it does remove one of the biggest barriers to building a real BCP in the first place: time.
The procurement teams that will benefit most from AI are not necessarily the ones trying to automate everything. They are the teams using AI to finally make strategic work operational, reviewing supplier risks more consistently, updating continuity plans more frequently, and creating processes that stay relevant instead of sitting untouched in a folder.
Because in supplier risk management, the goal is not simply to react faster when a disruption happens. The real advantage is being prepared before it does.
Frequentlyasked questions
How long does it take to build a first supplier BCP with Claude?
Thirty to forty-five minutes for the first draft, assuming the four input files are ready. A further hour for the procurement team to review, refine, and validate. The second BCP in the same organisation is typically faster, around twenty-five minutes end-to-end, because the definitions tab is already calibrated.
How many suppliers should be in the BCP?
Start with the top five by strategic importance or spend concentration. Expand to the top twenty as the team builds confidence. Below that, a lighter-weight risk assessment is usually sufficient.
How often should the BCP be reviewed?
Top-tier strategic suppliers monthly. Tier-two quarterly. Tier-three semi-annually. The AI-assisted BCP makes the monthly cadence realistic in a way the manual version never was.
Who owns the BCP once it's written?
The Category Manager for each supplier in the plan, with the Head of Procurement or CPO owning the portfolio view. Escalation to Legal, Finance, and Operations is defined in the Roles and Responsibilities tab.
Can Claude access supplier financial health data directly?
Claude can analyse supplier financial data if provided, uploaded reports, credit checks, or public filings. Direct live connection to commercial supplier-intelligence services is not a default Claude capability; procurement teams that want this typically pair Claude with a dedicated supplier-intelligence platform and use Claude for the analysis layer.
Is this workflow appropriate for regulated industries like pharmaceuticals or defense?
Yes, with policy adjustments. Regulated industries typically require stronger data-handling terms (enterprise Claude plan with the appropriate commercial agreement) and more conservative language on contingency actions involving regulated information. The underlying framework is the same.
About the author
My name is Marijn Overvest, I’m the founder of Procurement Tactics. I have a deep passion for procurement, and I’ve upskilled over 200 procurement teams from all over the world. When I’m not working, I love running and cycling.
